Shadow Brokers exploits are patched or inactive on supported Windows platforms

https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/

by alpb • 9 years ago

131 84 9 years ago

blogs.technet.microsoft.com

justinjlynn• 9 years ago

Customers still running prior versions of these products are encouraged to upgrade to a supported offering.

That's a very polite way to say "fuck you, pay me".

beagle32• 9 years ago

On the other hand, how long do you expect them to support a product past its "use by" date?

top_post3• 9 years ago

Agreed. For a comparison - https://www.kernel.org/category/releases.html

bigbugbag4• 9 years ago

If the "use by" date could be valid is it were not arbitrarily imposed by the same people who drop support for the sole reason of pushing customers towards the more recent product that includes more surveillance and advertising revenue opportunity.

top_post3• 9 years ago

They officially researched and responded to what was going to be a fucking hyped out insane event at most major organizations on easter weekend. The fuck you goes to you, it's not the 90s anymore, Microsoft well and truly have their shit together.

noir_lord2• 9 years ago

Agreed, 2017 MS is vastly almost inestimably better than 1997 Microsoft.

I don't use their products (except vscode/typescript) but I appreciate the work they do anyway since windows botnets etc are an ever present threat to the fabric of services running on the internet.

_jal• 9 years ago

This is true. They've become vastly better citizens, in terms of their past nastiness and the externalities inflicted on the rest of us, and quite a bit more technically competent since the security push and the end of the Ballmer regime.

Still seem abusive towards their customers, but that's most huge software companies, and doesn't bother me concretely, since I'm not one.

stordoff2• 9 years ago

Windows 7 released in 2009, and MS will keep issuing security patches until 2020. They also responded to this on Friday/Saturday of Easter weekend.

There's not a whole lot you can blame MS for here, except for the bugs existing in the first place (which is all but inevitable given the size of the codebase and the amount of scrutiny under which various groups put it).

Markoff3• 9 years ago

the problem is not really Windows, but hardware abandoned by manufacturers, my mother has perfectly good/sufficient computer for her needs running Win7, which can't be upgraded any further (wanted to upgrade from Vista to W10 or W8, to find the most recent I can get is W7) because of video drivers not supported anymore and there is not really workaround, so it would require buying new video card, which in the end means I might as well just buy for her new Android tablet an get rid off PC or might as well, just install there Linux in the end

bigbugbag4• 9 years ago

Hopefully you do not have a recent CPU as support for those will be dropped on any windows but 10. Microsoft tried to do this with skylake but met so much resistance that it pushed the date further for those and went on for the newer cpu only.

jsz0• 9 years ago

You pay either way because Microsoft is not a charitable organization. Either you spend as much (if not more) upfront for ridiculously long term support or you pay for upgrades and get a better operating system every few years. For obvious reasons the overwhelming vast majority of the world has picked the second option.

userbinator• 9 years ago

Unofficial patches will appear, if these are important enough for "Customers still running prior versions of these products". But looking at the list, all these exploits appear to be SMB server/RPC related; regardless of what Windows version you use, exposing that service to the Internet is not a good idea.

mikaraento• 9 years ago

Do note that an SMB exploit does give you privilege escalation once inside a network.

pinpeliponni• 9 years ago

I noticed Microsoft has been very careful not to mention NSA.

hexadecimated8• 9 years ago

The provenance of these exploits is irrelevant to whether or not their products have been patched, so why would they?

jameskegel• 9 years ago

I keep reading your response and it does not refute what OP is saying.

stordoff2• 9 years ago

Why would they? The immediate concern is whether or not the exploits are still a risk, not determining the origin. Any future use of them is likely to be groups other than NSA at this point anyway.

If/when Microsoft do call out the NSA, I imagine it'll a) be filtered through their press/PR teams and b) be after they've had time to verify the source (it seem overwhelmingly likely to be NSA-originated, but I'd guess MS will do their own investigation and not just take it at face value).

toyg• 9 years ago

MS will never "call out" anybody, in particular nobody in the US government - one of the few entities on the planet who can make Redmond lives materially harder. MS and authorities have a long history of peaceful collaboration and there is no reason to believe this state of things will change anytime soon.

mike_hearn• 9 years ago

Looking at their acknowledgements list it seems advisories always have acknowledgements even when it's Microsoft themselves who find the flaw. However, the MS17-010 patches didn't have any. If that's because they'd have to acknowledge the NSA, then it seems like more stuff is on the way: MS17-019 is also missing from the list. That's also patched in March and is "a vulnerability in Active Directory Federation Services (ADFS). The vulnerability could allow information disclosure if an attacker sends a specially crafted request to an ADFS server, allowing the attacker to read sensitive information about the target system."

noja• 9 years ago

in other words "Not all"

nthcolumn4• 9 years ago

For sure those vulns disclosed are not all so NSA must tell MS all now (whether MS knew all - eg. backdoors - in the first place is another thing).

pluma3• 9 years ago

Of the three remaining exploits [...] none reproduces on supported platforms, which means that customers running Windows 7 and more recent versions of Windows or Exchange 2010 and newer versions of Exchange are not at risk.

So none of the exploits should be a problem if you're on somewhat recent versions of Windows and Exchange (as applicable). If you're still on Windows Vista, XP, 2000 or NT, you likely have bigger problems already.

21• 9 years ago

somewhat recent versions of Windows

Windows 7 was released in 2009, eight years ago. I wouldn't call that "somewhat recent"

nthcolumn4• 9 years ago

So NSA knew 90 days ago and gave MS the heads up. They patched hurriedly eg. 14th March for EternalBlue - but didn't say anything to their customers re:patches must go ASAP (many large corporations have to phase them - i.e not at all at once on First Tuesday) so many companies are currently still vulnerable and probably won't hit them until next Tuesday after the Bank Holiday. What a mess.

hexadecimated8• 9 years ago

Once a patch is released, it's generally quite straightforward to compare before and after, reverse engineering it to find the vulnerability. So the general advice is always to patch as soon as possible.

nickpsecurity• 9 years ago

Even automatically... ;)

http://bitblaze.cs.berkeley.edu/papers/apeg.pdf

fulafel• 9 years ago

Corporations don't have to delay critical security patches, they just elect to do so based on some motives that compete with security.

archvile• 9 years ago

"Some motive" I think would equate to fear of breaking mission critical or legacy applications. In a high-stakes environment, I'd imagine functionality would win out initially over security, until everything has time to be tested properly.

scurvy• 9 years ago

I worked at MSN a while ago, and even we didn't patch everything immediately. It had to go through our team's QA first. We found a few bad installers and that reinforced the practice.

hannob• 9 years ago

So NSA knew 90 days ago and gave MS the heads up.

Where do you get that conclusion from? I don't read any such claim from this advisory. MS seems at least for now to stay silent how they got info about those exploits.

There are various ways this could've happened. NSA could've warned them. Shadowbrokers could've warned them. Someone else with inside knowledge could've given them anonymous tips. From the current available information we don't know that.

strictnein2• 9 years ago

The Shadowbrokers were trying to sell these exploits. There's screenshots from ~90 days ago with these all listed for sale with slightly modified names.

This probably explains why MS skipped February's patch day. They were extremely busy fixing all of these and wanted to do them all at once.

nthcolumn4• 9 years ago

No you're right I have no idea. For all I know these vulns could have been crafted by MS themselves as convenient backdoors at the behest of the NSA et al with tested patches on ice for the eventuality that they had to go away some day.

yuhong2• 9 years ago

Which also reminds me of the skipped Feb patches. I quickly figured out that Veeam reported their bug only a week before Patch Tuesday. (see https://forums.veeam.com/veeam-backup-replication-f2/after-t...) This is a good example of how MS's build process works. According to https://blogs.technet.microsoft.com/filecab/2017/01/30/windo... they did go so far as to assign a KB number to the fixed patches, but there was a "build issue" according to Mary Jo Foley. I wonder what the dates would be if it was actually released.

hexadecimated8• 9 years ago

Nice to see that these weren't zero day exploits after all, despite the claims being spread over Twitter.

Looks like some amateur security researchers forgot to patch their test VMs.

celticninja• 9 years ago

Do you have a source for that? Looks like MS have released a number of patches for these exploits and so have other software vendors so I'm not sure what your claim is based on.

hexadecimated8• 9 years ago

The exploits were released yesterday and the linked article says they have all been patched.

sangnoir• 9 years ago

According to ArsTechnica, the Shadow Brokers' exploits were patched (silently) back in March. This suggests that no fully patched system should be vulnerable, which doesn't jibe with what some security researchers were claiming.

mrb• 9 years ago

MS17-010 was a 0-day.

hexadecimated8• 9 years ago

It was patched last month, so how is it a zero day when these exploits were released yesterday?

grandol• 9 years ago

Yes, as usual, WikiLeaks and Julian are sensationalizing the heck out of something they've been sitting on for a while. How convenient.

trendia• 9 years ago

Mucrosoft patched a lot of the vulnerabilities within the last several months. That doesn't mean that they weren't serious vulnerabilities (i.e. the scope of the exploit) or that they weren't actively used (since the exploits could have been used from the time they were found by hackers to the time they were patched).

Also, I see a lot of green accounts in this thread...

strictnein2• 9 years ago

I follow one of the people who was first to test these exploits out. They're not actually an amateur, but they did forget to patch their test VMs. Just like a lot of the other people who replicated the results.

technion• 9 years ago

The thing to be fair about there is that you can install Windows 2012 R2 in a VM in about 15 minutes, but if you want to apply all updates, you could be sitting there for hours.

I built and updated two servers on spinning rust last week and it took six separate reboot cycles and nine total hours.

It probably isn't about "forgetting", as much as considering that there was indication patches were relevant and you wanted to start this research today.

Edit: It's easy to call people "amateurs" in hindsight, and not necessarily fair.

partycoder4• 9 years ago

One thing is collaborating with law enforcement, another thing is collaborating on mass surveillance. Microsoft collaborated setting up mass surveillance (PRISM).

One thing is a bug, another one is a backdoor. Are these good faith bugs or willful backdoors? Most likely they're bugs, but it is hard to know.

If I was Microsoft and I wanted to willfully plant a backdoor, I would take precautions to be able to get away with it if caught. Because security researchers can analyze them, and foreign governments have Windows source code, leaving intentional bugs as the only choice.

Now, the reasons I am suspicious of Microsoft:

- PRISM. Which is unequivocally mass surveillance.

- The Flame malware was able to install itself via Windows Update: http://www.computerworld.com/article/2503916/malware-vulnera... . The means by which the Flame authors achieved this are easier to explain if they received help from Microsoft.

- When Windows NT SP5 was released, the build accidentally came with debugging symbols (i.e: variable names were visible in binaries). A researcher found a variable called "_NSAKEY" containing a key which could be used to forge signatures. https://en.wikipedia.org/wiki/NSAKEY. Microsoft's explanation was that it wasn't related to the NSA, and that NSA in that context meant something else.

hexadecimated8• 9 years ago

This idea that Microsoft is deliberately introducing bugs into its software so nation states can exploit them is so absurd, it really is tinfoil hat conspiracy theory ludicrousness.

kuschku2• 9 years ago

It doesn't have to be known by Microsoft management.

It's enough if the NSA has people working at MS on their payroll.

partycoder4• 9 years ago

This is why I said:

Are these good faith bugs or willful backdoors? Most likely they're bugs, but it is hard to know.

My suspicion on Microsoft has more to do with the latter facts I mentioned.

Then, you need to understand this happens within the framework of espionage, which is by nature concealed and discrete, and not necessarily with consent (e.g: infiltration).

hl52• 9 years ago

How absurd was Room 641A? Congress had to step in and grant retroactive immunity.

https://en.wikipedia.org/wiki/Room_641A

glasz• 9 years ago

everything snowden put out was tinfoil stuff before him. echelon was tinfoil. room 641a was tinfoil.

give us a fucking break from such dangerous naivety.

1ris• 9 years ago

I just don't believe shadowbrokers just burned all their 0days. I assume they only release the cheapest exploits and either sell or keep the rest. E.g. russia now has several NSA exploits.

amq• 9 years ago

Those '0days' are not worth much after they were patched by MS in March.

nthcolumn4• 9 years ago

Yes, saving the best 'til last you'd think or keeping some insurance (lol they are already dead). But then NSA should know what 0days TSB have left though right? Do MS? Also - you are assuming TSB have sold some to russia (and that russia would want them)? What Snowden helpfiles do we not have matching warez for? Do the two non-reproduceables require another undisclosed component?

kikigaki• 9 years ago

so they are now patched, shadowbrokers have found plenty of new vulns since then. loads of linux vulns too, makes up a big part of the internet, which makes it potentially even more scary.

Shadow Brokers exploits are patched or inactive on supported Windows platforms

Related Stories