6 ms·
Basically, this is a successful old-fashioned computer worm, operating at a scale we've not seen for more than 10 years. On modern operating systems most attack
by guscost 9y ago
Basically, this is a successful old-fashioned computer worm, operating at a scale we've not seen for more than 10 years. On modern operating systems most attack surfaces that were easy to crack in the past have been locked down at least to the point where it is nearly impossible to find an exploit in a common protocol like this that doesn't require user interaction (hence the popularity of phishing). Apart from that we've just gotten lucky, really. Many of the most catastrophic bugs in recent years (Heartbleed, etc) were never successfully turned into exploits of this nature. Instead they were discovered and fixed quickly by researchers.
This worm targets older Windows versions that are installed (and use the exploited protocol) in a lot of critical infrastructure, and the worm was hoarded by the NSA all packaged up and ready to deploy (because it can propagate through SMB and therefore would be perfect for a future Stuxnet-like operation). So of course some criminals get their hands on it, and hey look it works. It's an absolutely bonkers story.
- gerdesj 9y ago"older Windows versions" Win 10 is vulnerable without the patch that came out in march.
- guscost 9y agoWow, I've heard various rumors about the scope but that is pretty serious.
- cschmittiey 9y agoAny chance you've got a source on that? Most everything I've read said Win10 was protected since March. Edit: I'm dumb, misread the above comment as saying "Win10 was affected even with the patch in March."
- criley2 9y ago>Win 10 is vulnerable without the patch that came out in march Microsoft clearly disputes this in their own posts on the subject. https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ https://blogs.technet.microsoft.com/msrc/2017/05/12/customer... "Customers running Windows 10 were not targeted by the attack today." What's your source?
- kristofferR 9y agoWannaCry ("the attack") didn't target Windows 10 installations (probably since most Win10 users have updates enabled), but Windows 10 is still vulnerable without the patch.
- ibic 9y agoAgain, where is the source? I seriously doubt that the worm author would let go such a profitable target if they can infect Windows 10. According to this: https://www.netmarketshare.com/operating-system-market-share.aspx?qprid=10&qpcustomd=0 https://www.netmarketshare.com/operating-system-market-share... Windows 10 has almost 4 times users than XP (and supposedly the gap is growing larger)
- deleted 9y ago[deleted]
- erikbye 9y agoJust have a look at the XML configuration files for the exploits used. They are on GitHub. Windows 10 was not a target.
- technion 9y agoThe difference would be that Win 10's forced updates mean nearly every Win 10 user is patched. It would be a much less successful target (though still a target > 0).
- codehusker 9y agoFrom your source: "Customers who are running supported versions of the operating system (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows 10, Windows Server 2012 R2, Windows Server 2016) will have received the security update MS17-010 in March. If customers have automatic updates enabled or have installed the update, they are protected. For other customers, we encourage them to install the update as soon as possible." If you don't have the update, you are not protected, you are vulnerable.
- guscost 9y agoActually, the latest news suggests this thing is a hybrid worm/phishing trojan which can use the SMB exploit where that works best (e.g. once it is inside a local network).