-9

WannaCrypt-like SMB spreading technique was widely used in Stuxnet, as docummented by Symantec and Kaspersky.

Read this: W32.Stuxnet Dossier (2010,Symantec PDF)

Now we have the name of the exploit: EternalBlue

WannaCry ransomware used in widespread attacks all over the world

The Leaked ... Hacking Tool That Will Wreak Havoc For Years To Come

It is pretty disingenuous for Microsoft to blame the NSA when they have known about it for this long.

So Microsoft reacted within 2 days to close the barn door, and has released patches for all previous Windows versions from XP through 8.

Microsoft Customer Guidance for WannaCrypt attacks (5/12/17, MS TechNet)

Now just ask yourself, how did Microsoft so miraculously come up with these multiple patches for this diverse group of operating systems, in time to release them on Sunday, Mother's Day, unless they were hoarding them themselves?

They released some to extended customers but not all. Selective pay-for-play.

While Microsoft griped about NSA exploit stockpiles, it stockpiled patches: Friday's WinXP fix was built in February - "It took three months to release despite Eternalblue leak."

I will give them credit for building the fix into Windows 10.

My question is: What is different now?

Sub-question: Are we to believe that we can trust Microsoft in the future? I certainly can understand paying extra for patches like this, but the fact that they kept them secret begs the question of their trustworthiness.

Improve this question
5
  • 3
    You're making the leap that MS knew about the flaw since 2008 simply because there was another flaw found in the SMB service - that's an error in logic. MS patched that flaw a few times over the years: krebsonsecurity.com/2015/03/microsoft-fixes-stuxnet-bug-again
    – schroeder ♦
    Commented May 18, 2017 at 6:52
  • 3
    The rest of the question is simply conspiracy theory and rabble-rousing
    – schroeder ♦
    Commented May 18, 2017 at 6:53
  • @schroeder I have softened the tone about saying they knew about this exploit since 2008, in light of factual references. And the rest of the question still stands, based on facts.
    – SDsolar
    Commented May 19, 2017 at 20:28
  • Why should Microsoft release free patches for an operating system they'd been trying to get people to move off due to ongoing maintenance issues for ages? If the NSA had told them about the flaw whilst the affected operating systems were under support, using a responsible disclosure policy, they'd have been fixed years ago. I'd say it's better not to trust governmental agencies which aren't acting in the best interests of the public, in favour of hoarding vulnerabilities to use for future attacks against unspecified targets...
    – Matthew
    Commented May 19, 2017 at 20:42
  • They released them privately because people are still paying them for extended support for XP. There are corporations and government agencies that don't like they spyware aspects of the newer OSs. Releasing them to the public was a way to help stop the spread of this particular threat because individuals who are not paying for support are still using it.
    – SDsolar
    Commented Sep 7, 2017 at 15:35

2 Answers 2

Reset to default
3

Presumably Microsoft developed the patches for Windows XP and 2003 for their paying customers at the same time as the patches for 7+, i.e. in/for March.

They then decided to release them for free, which just required putting them on a webserver (since they aren't being distributed by Windows Update AFAIK).

Your first link doesn't work for me, but I would suspect the SMB vulnerabilities are different between Stuxnet and WannaCrypt? Otherwise why would EternalBlue be such a big deal?

Improve this answer
0
4

Stuxnet spread by leveraging vulnerabilities MS08-067 and MS10-061, which were patched in 2008 and 2010 respectively. https://www2.cs.arizona.edu/~collberg/Teaching/466-566/2012/Resources/presentations/2012/topic9-final/report.pdf

WannaCrypt spreads via the MS17-010, which was patched in March 2017.

Not the same vulnerability.

Improve this answer
2
  • Upvote for providing an authoritative reference. TNX. However, this does not answer the question.
    – SDsolar
    Commented May 19, 2017 at 20:20
  • @SDsolar you seem to be confusing this particular vulnerability in the SMB stack (EternalBlue) with others that have popped up over the years. Do you understand these are not the same thing? SMB is a complex protocol with thousands of lines of code, stretching back decades. Security vulnerabilities and bugs pop up in it from time to time. Microsoft is currently recommending users disable the older SMB v1.0 for this reason.
    – myron-semack
    Commented Sep 7, 2017 at 14:06

Not the answer you're looking for? Browse other questions tagged .