Shadow Brokers exploits are patched or inactive on supported Windows platforms

Re:Shadow Brokers exploits are patched or inactive on suppor... by nthcolumn on Saturday April 15, 2017 @04:23AM (#14119906)

So NSA knew 90 days ago and gave MS the heads up. They patched hurriedly eg. 14th March for EternalBlue - but didn't say anything to their customers re:patches must go ASAP (many large corporations have to phase them - i.e not at all at once on First Tuesday) so many companies are currently still vulnerable and probably won't hit them until next Tuesday after the Bank Holiday. What a mess.

[ Parent | on HN ]

Re:Shadow Brokers exploits are patched or inactive on suppor... by fulafel on Saturday April 15, 2017 @05:26AM (#14120054)

Corporations don't have to delay critical security patches, they just elect to do so based on some motives that compete with security.

[ Parent | on HN ]

Re:Shadow Brokers exploits are patched or inactive on suppor... by archvile on Saturday April 15, 2017 @10:17AM (#14120789)

"Some motive" I think would equate to fear of breaking mission critical or legacy applications. In a high-stakes environment, I'd imagine functionality would win out initially over security, until everything has time to be tested properly.

[ Parent | on HN ]

Re:Shadow Brokers exploits are patched or inactive on suppor... by scurvy on Saturday April 15, 2017 @10:43AM (#14120907)

I worked at MSN a while ago, and even we didn't patch everything immediately. It had to go through our team's QA first. We found a few bad installers and that reinforced the practice.

[ Parent | on HN ]

Re:Shadow Brokers exploits are patched or inactive on suppor... by hannob on Saturday April 15, 2017 @07:31AM (#14120339)

> So NSA knew 90 days ago and gave MS the heads up.

Where do you get that conclusion from? I don't read any such claim from this advisory. MS seems at least for now to stay silent how they got info about those exploits.

There are various ways this could've happened. NSA could've warned them. Shadowbrokers could've warned them. Someone else with inside knowledge could've given them anonymous tips. From the current available information we don't know that.

[ Parent | on HN ]

Re:Shadow Brokers exploits are patched or inactive on suppor... by strictnein on Saturday April 15, 2017 @01:55PM (#14121866)

The Shadowbrokers were trying to sell these exploits. There's screenshots from ~90 days ago with these all listed for sale with slightly modified names.

This probably explains why MS skipped February's patch day. They were extremely busy fixing all of these and wanted to do them all at once.

[ Parent | on HN ]

Re:Shadow Brokers exploits are patched or inactive on suppor... by nthcolumn on Saturday April 15, 2017 @02:55PM (#14122191)

No you're right I have no idea. For all I know these vulns could have been crafted by MS themselves as convenient backdoors at the behest of the NSA et al with tested patches on ice for the eventuality that they had to go away some day.

[ Parent | on HN ]

Re:Shadow Brokers exploits are patched or inactive on suppor... by hexadecimated on Saturday April 15, 2017 @04:39AM (#14119951)

Once a patch is released, it's generally quite straightforward to compare before and after, reverse engineering it to find the vulnerability. So the general advice is always to patch as soon as possible.

[ Parent | on HN ]

Re:Shadow Brokers exploits are patched or inactive on suppor... by nickpsecurity on Saturday April 15, 2017 @09:39AM (#14120661)

Even automatically... ;)

http://bitblaze.cs.berkeley.edu/papers/apeg.pdf

[ Parent | on HN ]

Re:Shadow Brokers exploits are patched or inactive on suppor... by yuhong on Saturday April 15, 2017 @08:52AM (#14120530)

Which also reminds me of the skipped Feb patches. I quickly figured out that Veeam reported their bug only a week before Patch Tuesday. (see https://forums.veeam.com/veeam-backup-replication-f2/after-t...) This is a good example of how MS's build process works. According to https://blogs.technet.microsoft.com/filecab/2017/01/30/windo... they did go so far as to assign a KB number to the fixed patches, but there was a "build issue" according to Mary Jo Foley. I wonder what the dates would be if it was actually released.

[ Parent | on HN ]