4 ms·
>Win 10 is vulnerable without the patch that came out in march Microsoft clearly disputes this in their own posts on the subject. https://blogs.technet.micros
by criley2 9y ago
>Win 10 is vulnerable without the patch that came out in march
Microsoft clearly disputes this in their own posts on the subject.
https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ https://blogs.technet.microsoft.com/msrc/2017/05/12/customer...
"Customers running Windows 10 were not targeted by the attack today."
What's your source?
- kristofferR 9y agoWannaCry ("the attack") didn't target Windows 10 installations (probably since most Win10 users have updates enabled), but Windows 10 is still vulnerable without the patch.
- ibic 9y agoAgain, where is the source? I seriously doubt that the worm author would let go such a profitable target if they can infect Windows 10. According to this: https://www.netmarketshare.com/operating-system-market-share.aspx?qprid=10&qpcustomd=0 https://www.netmarketshare.com/operating-system-market-share... Windows 10 has almost 4 times users than XP (and supposedly the gap is growing larger)
- deleted 9y ago[deleted]
- erikbye 9y agoJust have a look at the XML configuration files for the exploits used. They are on GitHub. Windows 10 was not a target.
- technion 9y agoThe difference would be that Win 10's forced updates mean nearly every Win 10 user is patched. It would be a much less successful target (though still a target > 0).
- codehusker 9y agoFrom your source: "Customers who are running supported versions of the operating system (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows 10, Windows Server 2012 R2, Windows Server 2016) will have received the security update MS17-010 in March. If customers have automatic updates enabled or have installed the update, they are protected. For other customers, we encourage them to install the update as soon as possible." If you don't have the update, you are not protected, you are vulnerable.
- rjbwork 9y agoIf you or your IT dept is not installing updates, especially security patches, over 2 months after they come out, somethings horribly wrong.
- unpatchedyay 9y agoPosting from a throwaway for obvious reasons, but the place where I work still hasn't applied these patches after I warned their IT dept about the NSA vulns a month ago... luckily I'm at least able to apply the patch to my own system manually. If it hits us I'm pretty sure we're screwed on the order of a few thousand systems.
- dorian-graph 9y agoThe reality is, this is very common.
- rjbwork 9y agoThen what, realistically, can be done when nation-state knowledge of vulnerable systems is hoarded for cyber-warfare purposes?
- criley2 9y agoFrankly, there is only one solution I can see anymore: Laws must be passed to: * Force the US government to report vulnerabilities to vendors * Create a regulatory body to monitor the use of vulnerabilities in clandestine operations and ensure that mandatory reporting is upheld I cannot see anything less working. Get that through US and EU governments, and you'll likely have the vast majority of vulnerabilities being reported and patched. Of course this is akin to asking the US and Russia to convert their nuclear stockpile into reactor fuel.
- rlpb 9y agoI think you need to read their statement more critically. "Not vulnerable" is not the same as "not targeted".