Microsoft fixed critical vulnerabilities in uncredited update released in March.
A measure of relief
The revelation that none of the highly advanced exploits work against supported Microsoft products brings a measure of relief to some of the more dire warnings sounded 24 hours earlier. It means that most home and small-office users are likely to be safe, since their systems are likely to have automatically installed the critical updates weeks ago. Computers in larger organizations, however, can often remain two or more months behind Microsoft’s patch schedule, as administrators test the updates to ensure they’re compatible with intranets and other internal systems. That means that some of the most sensitive and mission-critical networks may still be vulnerable to the four exploits, which are known as EternalBlue, EternalChampion, EternalSynergy, and EternalRomance.
Microsoft’s silence over unprecedented patch delay doesn’t smell rightSecurity researchers have taken to social media sites to speculate on the circumstances that led to Microsoft killing all four of would-be zero-days one month before they were published on the Internet. As mentioned above, one theory is that someone from the NSA privately gave Microsoft warning that the leaks were imminent. As reported Friday by Emptywheel, a Shadow Brokers release from early January gave NSA officials notice of some of the exploit names obtained by the mysterious person or group and later included in Friday’s release. The extra time Microsoft needed to patch the bugs might possibly have something to do with February’s unprecedented canceling of Patch Tuesday.
A second possibility is that Microsoft paid Shadow Brokers for the vulnerabilities and didn’t make that purchase public. In any event, and as noted by security commentator Ryan Naraine on Twitter, Microsoft’s March Patch Tuesday bulletins explicitly said none of the Shadow affected vulnerabilities were being actively exploited, a claim company officials surely knew was false had the flaws been disclosed either by the NSA or the leakers.
Another plausible possibility is that Microsoft patched the vulnerabilities by chance and without advanced warning of the NSA. When the Shadow Brokers recognized that the exploits were no longer valuable zero-days, they published them in a campaign designed to sow confusion. That theory is consistent with Friday’s release of other exploits that remained unpatched in unsupported Microsoft products including Windows XP, Windows Server 2003, Exchange 2007, and IIS 6.0. Under this theory, none of the exploits published Friday worked on supported Microsoft products, so the Shadow Brokers decided to use them in a propaganda campaign. The problem with this theory, however, is the coincidental timing of the patch and leak seem highly unlikely.
Aside from the mystery surrounding the patching of these vulnerabilities one month ahead of the exploits, the other major question is how multiple security researchers and news outlets all incorrectly reported the exploits targeted fully updated products that remained supported by Microsoft. The answer is that researchers didn’t test the exploits against fully updated versions of Windows 7 and other Supported Microsoft products.
The zero-day assessment “was based on best information at the time and early testing, which turned out to be incorrect,” the security commentator and researcher who goes by the moniker SwiftOnSecurity wrote on Twitter. “Because there was no indication Microsoft patched these bugs, researcher systems did not include last month’s patches, so they [the exploits] still worked.”
Other researchers, including Kevin Beaumont and Matthew Hickey, said they made the same critical mistake. Ars and dozens of other publications then reported those mistaken findings. Ars regrets the error.