2 ms·

1. It was more than just a known known flaw, there was actual tools released, it was not simply "hey we know this flaw in SMB is there 2. Timely discloure is

by syshum 10y ago

1. It was more than just a known known flaw, there was actual tools released, it was not simply "hey we know this flaw in SMB is there 2. Timely discloure is very important, and could have infact prevented this, If the NSA knew about this years ago then chances are far far far far more systems including the older XP/2003 system could have been patch, and some systems may have never had the flaw at all. So it is completely false to say that even if the NSA would have disclosed it when they found it everything would have still happened the way it did. The Patches where only released for Win7/10/2008/2012 2 months ago, many companies hold back MS patches for any where from 1 to 3 months because MS has shitty quality control. On top of that MS stopped allowing individual patches instead going to a "update rollup" meaning you take all of MS's shitty patches or none of them Further XP and 2003 Patchs where not released until Sat.

zokier 10y ago
1. I'm not convinced that the tool release was instrumental for the success of this worm, considering the timeline. Besides, having PoC code for public vulnerabilities is not exactly rare. 2. If a worm is based on the disclosure and hits two months after public disclosure of a hole, then it doesn't really matter if that disclosure happens in 2014, 2017, or 2020. Heck, in this case specifically it could be argued that the delay has been beneficial because we are now better equipped in general to manage such attacks. If you can't get critical security patches deployed in two months, then it is your problem, not NSAs or MS'. If you can't deal with MS patch quality then don't frikkin use their software. Running XP/2003 in a non-isolated environment is irresponsible as hell and utterly inexcusable. This sort of infection was completely predictable outcome for XP/2003. Considering that MS was under no obligation to patch XP/2003, I can't imagine what the admins were planning to do in this inevitable situation other than bury their heads into sand.
- syshum 10y ago
  > If a worm is based on the disclosure and hits two months after public disclosure of a hole, then it doesn't really matter if that disclosure happens in 2014, 2017, or 2020. Heck, in this case specifically it could be argued that the delay has been beneficial because we are now better equipped in general to manage such attacks. First off I never said disclose publicly, I said disclose to software vendors. Further you can not know if it disclosed soon after discovery, which I personally believe was discovered long before 2014, probably has been in the NSA inventory for a decade or more, it would have had a worse impact, or that a ransomware worm would have been developed 2 months later Ransomware is reality new in this kind of attack, most likly if this would have been released in say 2007 it would have been a Spam Botnet or a DDOS Botnet if anything, not Ransomeware. >>>If you can't deal with MS patch quality then don't frikkin use their software. Ohh that is the dream. I use bullshit like this to advocate dropping MS like a bad habit, every year I get more traction in my crusade to rid my company of MS

by syshum 10y ago

zokier 10y ago

1. I'm not convinced that the tool release was instrumental for the success of this worm, considering the timeline. Besides, having PoC code for public vulnerabilities is not exactly rare. 2. If a worm is based on the disclosure and hits two months after public disclosure of a hole, then it doesn't really matter if that disclosure happens in 2014, 2017, or 2020. Heck, in this case specifically it could be argued that the delay has been beneficial because we are now better equipped in general to manage such attacks. If you can't get critical security patches deployed in two months, then it is your problem, not NSAs or MS'. If you can't deal with MS patch quality then don't frikkin use their software. Running XP/2003 in a non-isolated environment is irresponsible as hell and utterly inexcusable. This sort of infection was completely predictable outcome for XP/2003. Considering that MS was under no obligation to patch XP/2003, I can't imagine what the admins were planning to do in this inevitable situation other than bury their heads into sand.

syshum 10y ago
> If a worm is based on the disclosure and hits two months after public disclosure of a hole, then it doesn't really matter if that disclosure happens in 2014, 2017, or 2020. Heck, in this case specifically it could be argued that the delay has been beneficial because we are now better equipped in general to manage such attacks. First off I never said disclose publicly, I said disclose to software vendors. Further you can not know if it disclosed soon after discovery, which I personally believe was discovered long before 2014, probably has been in the NSA inventory for a decade or more, it would have had a worse impact, or that a ransomware worm would have been developed 2 months later Ransomware is reality new in this kind of attack, most likly if this would have been released in say 2007 it would have been a Spam Botnet or a DDOS Botnet if anything, not Ransomeware. >>>If you can't deal with MS patch quality then don't frikkin use their software. Ohh that is the dream. I use bullshit like this to advocate dropping MS like a bad habit, every year I get more traction in my crusade to rid my company of MS