4 ms·

Not a big fan of Microsoft in general, and I generally distrust anything it does, but I'm beginning to like this Brad Smith fellow. He's been pushing for quite

by mtgx 9y ago

Not a big fan of Microsoft in general, and I generally distrust anything it does, but I'm beginning to like this Brad Smith fellow. He's been pushing for quite a few privacy initiatives inside Microsoft, and he's now also taking on NSA and calling for a Digital Geneva Convention. I also think Microsoft "got lucky" this time. Shadow Brokers sit on EternalBlue for at least 6 months. They could've released it before the NSA even alerted Microsoft that such a bug exists in its operating system (probably earlier this year). That would've hurt Microsoft's image a lot more. So I think this should also be a warning to Microsoft (and other software companies). If there is some other backdoor in Windows or bug on which Microsoft may decide to sit on to give the NSA a few extra months to exploit it, its image could be hurt a lot. Some other group may discover it and and then turn it into another global ransomware attack, before Microsoft even has a chance to patch it. So lesson of the day: don't do back room (or door) deals with the NSA, whether because of fear, for money, "patriotism," or some other reason, because it could come back and hurt you 10 times more when you're put in the spotlight as the main party responsible for a global attack.

drzaiusapelord 9y ago
>They could've released it before the NSA They were looking for buyers this whole time. Perhaps you are unaware but there's an entire cottage industry of selling and buying of vulnerabilities out there. There are many zero days being sat on. No one is getting 'lucky.' They will be sold and used as needed by whatever group. There seems to be this narrative developing about how this exploit is some rare thing. There are hundreds of serious exploits discovered in Windows a year and those are the ones we know about. There was no nation state involved with conficker, slammer, codered, heartbleed, etc. So its silly to focus solely on the NSA here. Exploits will be found, forever. We don't have the ability to make defect-free software.
j_s 9y ago
EternalBlue CVE-2017-0144 was [edit:allocated/reserved instead of "assigned" per tweet] 2016-09-09. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0144 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0144 Source: https://twitter.com/_supernothing/status/864021595303456768 https://twitter.com/_supernothing/status/864021595303456768 > MS has known about this bug since 09/2016 (when CVE was assigned) and patched in 03/2017. 240day
- belltaco 9y ago
  From the source that that tweet gets the "date" from: >Date Entry Created 20160909 >Disclaimer: The entry creation date may reflect when the CVE-ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. Do you have a better source for the 240day claim?
  - j_s 9y ago
    I included a link to the tweet's source. AFAIK, this CVE's "Date Entry Created" is an interesting metadata artifact without any additional significance currently (no futher background info publicly available at this time). I don't know if MITRE makes any additional info (such as "who") public, though I'm sure it is stored somewhere. I haven't had a chance to review the same value for other CVE's to determine how "normal" it is for the create date to be so long before when the CVE goes public, nor how things correlate for the associated Shadow Brokers fixes. -- https://twitter.com/thegrugq/status/853142591289802752 https://twitter.com/thegrugq/status/853142591289802752 > There are no acknowledgements for MS17-10 which patched most of the big bugs from the ShadowBrokers drop. https://www.renditioninfosec.com/2017/05/call-to-microsoft-to-release-information-about-ms17-010/ https://www.renditioninfosec.com/2017/05/call-to-microsoft-t... > Microsoft has not disclosed how it came to know about the vulnerabilities included in the MS17-010 patch. Microsoft also has not disclosed any information about “in the wild” exploitation of these vulnerabilities.

by mtgx 9y ago

drzaiusapelord 9y ago

>They could've released it before the NSA They were looking for buyers this whole time. Perhaps you are unaware but there's an entire cottage industry of selling and buying of vulnerabilities out there. There are many zero days being sat on. No one is getting 'lucky.' They will be sold and used as needed by whatever group. There seems to be this narrative developing about how this exploit is some rare thing. There are hundreds of serious exploits discovered in Windows a year and those are the ones we know about. There was no nation state involved with conficker, slammer, codered, heartbleed, etc. So its silly to focus solely on the NSA here. Exploits will be found, forever. We don't have the ability to make defect-free software.

j_s 9y ago

EternalBlue CVE-2017-0144 was [edit:allocated/reserved instead of "assigned" per tweet] 2016-09-09. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0144 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0144 Source: https://twitter.com/_supernothing/status/864021595303456768 https://twitter.com/_supernothing/status/864021595303456768 > MS has known about this bug since 09/2016 (when CVE was assigned) and patched in 03/2017. 240day

belltaco 9y ago
From the source that that tweet gets the "date" from: >Date Entry Created 20160909 >Disclaimer: The entry creation date may reflect when the CVE-ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. Do you have a better source for the 240day claim?
- j_s 9y ago
  I included a link to the tweet's source. AFAIK, this CVE's "Date Entry Created" is an interesting metadata artifact without any additional significance currently (no futher background info publicly available at this time). I don't know if MITRE makes any additional info (such as "who") public, though I'm sure it is stored somewhere. I haven't had a chance to review the same value for other CVE's to determine how "normal" it is for the create date to be so long before when the CVE goes public, nor how things correlate for the associated Shadow Brokers fixes. -- https://twitter.com/thegrugq/status/853142591289802752 https://twitter.com/thegrugq/status/853142591289802752 > There are no acknowledgements for MS17-10 which patched most of the big bugs from the ShadowBrokers drop. https://www.renditioninfosec.com/2017/05/call-to-microsoft-to-release-information-about-ms17-010/ https://www.renditioninfosec.com/2017/05/call-to-microsoft-t... > Microsoft has not disclosed how it came to know about the vulnerabilities included in the MS17-010 patch. Microsoft also has not disclosed any information about “in the wild” exploitation of these vulnerabilities.