3 ms·

NYT again buried the lede. This was never a 0-day. How is it that companies and governments still fail to install updates years later?!? “One month before the

NYT again buried the lede. This was never a 0-day. How is it that companies and governments still fail to install updates years later?!? “One month before the Shadow Brokers began dumping the agency’s tools online in 2017, the N.S.A. — aware of the breach — reached out to Microsoft and other tech companies to inform them of their software flaws. Microsoft released a patch, but hundreds of thousands of computers worldwide remain unprotected.”

jorblumesea 7y ago
Yeah, this speaks more to the incompetence of local government than it does any kind of intelligence agency. Although the normalization of exploiting CVEs is a worrying trend.
dubbel 7y ago
Of course it was a 0-day. It was one until the day that Microsoft released patch MS17-010 on the 12th of March 2017. So for around 5 years it was a 0-day that was used by the NSA and possibly other unknown actors.
- azernik 7y ago
  0-day generally refers to the day the vulnerable party learns of the vulnerability, so it would be substantially earlier.
  - dubbel 7y ago
    True, I was wrong about that. I looked at it from the perspective of the affected customers. In that case it was a 0-day until probably February 2017.
HillaryBriss 7y ago
i kind of agree. but then again, in today's climate, is failing to install updates really a lede? i mean people have been not installing updates in a timely manner for decades now.
joe_the_user 7y ago
Baltimore is one of the poorest and most dysfunctional cities in the US. I don't know the details but it seems logical that a place like this would be where the servers wind-up not updated. The critique I'd make of the NSA isn't that they developed this tool but that they spent time constructed the tool instead of time spent actually securing American infrastructure.
- MaxfordAndSons 7y ago
  > securing American infrastructure That's not their job though, is it? I'm not sure whose job it is, maybe the DHS or something like that. Admittedly their name might make you think it is, but I wouldn't expect a governmental agency to ever do anything but it's mandated job.
  - cududa 7y ago
    How in the world is that up to DHS? Municipalities all run their own infrastructure
  - joe_the_user 7y ago
    That's not their job though, is it? Actually, it is: "The NSA is also tasked with the protection of U.S. communications networks and information systems." [1], [1] https://en.wikipedia.org/wiki/National_Security_Agency https://en.wikipedia.org/wiki/National_Security_Agency , Hopefully, it is clear that in-context I meant communications infrastructure

jorblumesea 7y ago

Yeah, this speaks more to the incompetence of local government than it does any kind of intelligence agency. Although the normalization of exploiting CVEs is a worrying trend.

dubbel 7y ago

Of course it was a 0-day. It was one until the day that Microsoft released patch MS17-010 on the 12th of March 2017. So for around 5 years it was a 0-day that was used by the NSA and possibly other unknown actors.

azernik 7y ago
0-day generally refers to the day the vulnerable party learns of the vulnerability, so it would be substantially earlier.
- dubbel 7y ago
  True, I was wrong about that. I looked at it from the perspective of the affected customers. In that case it was a 0-day until probably February 2017.

HillaryBriss 7y ago

i kind of agree. but then again, in today's climate, is failing to install updates really a lede? i mean people have been not installing updates in a timely manner for decades now.

joe_the_user 7y ago

Baltimore is one of the poorest and most dysfunctional cities in the US. I don't know the details but it seems logical that a place like this would be where the servers wind-up not updated. The critique I'd make of the NSA isn't that they developed this tool but that they spent time constructed the tool instead of time spent actually securing American infrastructure.

MaxfordAndSons 7y ago
> securing American infrastructure That's not their job though, is it? I'm not sure whose job it is, maybe the DHS or something like that. Admittedly their name might make you think it is, but I wouldn't expect a governmental agency to ever do anything but it's mandated job.
- cududa 7y ago
  How in the world is that up to DHS? Municipalities all run their own infrastructure
- joe_the_user 7y ago
  That's not their job though, is it? Actually, it is: "The NSA is also tasked with the protection of U.S. communications networks and information systems." [1], [1] https://en.wikipedia.org/wiki/National_Security_Agency https://en.wikipedia.org/wiki/National_Security_Agency , Hopefully, it is clear that in-context I meant communications infrastructure