EternalBlue
Computer security exploit
From Wikipedia, the free encyclopedia
EternalBlue[5] is a computer exploit software developed by the U.S. National Security Agency (NSA).[6] It is based on a zero-day vulnerability in Microsoft Windows software that allowed attackers to gain access to any number of computers connected to a network. The NSA was aware of this vulnerability but did not disclose it to Microsoft for several years, as it intended to use the exploit as part of its offensive cyber operations. In 2017, the NSA discovered that the software had been stolen by a group of hackers known as The Shadow Brokers. Microsoft was subsequently informed of this and released security updates in March 2017 patching the vulnerability. While this was happening, the hacker group attempted to auction off the software, but did not succeed in finding a buyer. EternalBlue was then released publicly on April 14, 2017.[5]
| Eternal - Anonymous | |
|---|---|
| Malware details | |
| Technical name | |
| Type | Exploit |
| Author | Equation Group |
| Technical details | |
| Platforms | Windows 95, Windows 98, Windows Me, Windows NT 3.x, Windows NT 4.0, Windows 2000, Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows NT 3.1–2000 Server Editions, Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016 |
On May 12, 2017, a computer worm in the form of ransomware, nicknamed WannaCry, used the EternalBlue exploit to attack computers using Windows that had not received the latest system updates removing the vulnerability.[5][7][8][9][10][11] On June 27, 2017, the exploit was again used to help carry out the 2017 NotPetya cyberattack on more vulnerable computers.[12]
The exploit was also reported to have been used since March 2016 by the Chinese hacking group Buckeye (APT3), after they likely found and re-purposed the software,[11] as well as reported to have been used as part of the Retefe banking trojan since at least September 5, 2017.[13]
Details
EternalBlue exploits a vulnerability in Microsoft's implementation of the Server Message Block (SMB) protocol. This vulnerability is denoted by entry CVE-2017-0144[14][15] in the Common Vulnerabilities and Exposures (CVE) catalog. The vulnerability exists because the SMB version 1 (SMBv1) server in various versions of Microsoft Windows mishandles specially crafted packets from remote attackers, allowing them to remotely execute code on the target computer.[16]
The NSA did not alert Microsoft about the vulnerability, holding onto it for more than five years before the breach forced its hand. The agency then warned Microsoft after learning about EternalBlue's possible theft, allowing the company to prepare a software patch issued in March 2017,[6] after delaying its regular release of security patches in February 2017.[17] On Tuesday, March 14, 2017, Microsoft issued security bulletin MS17-010,[18] which detailed the flaw and announced that patches had been released for all Windows versions supported at that time, including Windows Vista, Windows 7, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.[19][20]
The Shadow Brokers publicly released the EternalBlue exploit code on April 14, 2017, along with several other NSA hacking tools.[5]
Many Windows users had not installed the Microsoft patches when, on May 12, 2017, the WannaCry ransomware attack started using the EternalBlue vulnerability to spread.[21][22] The next day (May 13, 2017), Microsoft released emergency security patches for unsupported versions, including Windows XP, Windows 8, and Windows Server 2003.[23][24]
In February 2018, EternalBlue was ported to all Windows operating systems released since Windows 2000 by RiskSense security researcher Sean Dillon. EternalChampion and EternalRomance, two other exploits originally developed by the NSA and leaked by The Shadow Brokers, were also ported during the same event and made available as open-source Metasploit modules.[25]
By late 2018, millions of systems remained vulnerable to EternalBlue, leading to millions of dollars in damages primarily caused by ransomware worms. Following the massive impact of WannaCry, which caused over $8 billion in damages across 150 countries, later outbreaks such as NotPetya and BadRabbit also propagated using EternalBlue as either an initial compromise vector or a method of lateral movement.[26]
City of Baltimore cyberattack
In May 2019, the city of Baltimore struggled with a cyberattack by digital extortionists; the attack froze thousands of computers, shut down email, and disrupted real estate sales, water bills, health alerts, and many other services. Nicole Perlroth, writing for The New York Times, initially attributed this attack to EternalBlue;[27] however, in a February 2021 book on the cyber arms market, Perlroth clarified that EternalBlue was not responsible for the Baltimore cyberattack, while criticizing others for pointing out "the technical detail that in this particular case, the ransomware attack had not spread with EternalBlue".[28]
As a result of the cyberattack, four Baltimore City chief information officers were fired or resigned; two left while under investigation.[29] Some security researchers argued that responsibility for the breach lay with the city for failing to update its computers. Security consultant Rob Graham noted: "If an organization has substantial numbers of Windows machines that have gone 2 years without patches, then that’s squarely the fault of the organization, not EternalBlue."[30]
Russian computers hacked
First appearing in February 2017, an updated version of EternalBlue emerged in May 2017, according to a Kaspersky forum report. It affected internal systems at the Ministry of Internal Affairs of Russia and computers across several regions, including Tatarstan. The WannaCry ransomware (also known as WCry or WannaCryptor) encrypted user files, appended the '.WNCRY' extension, and demanded payment in bitcoins for a decryption tool under threat of permanent file deletion. Worldwide, over 36,000 computers were infected, with the majority located in Russia, Ukraine, and Taiwan, according to cybersecurity firm Avast.[31][32]
Responsibility
Following the WannaCry attack, Microsoft took primary responsibility for addressing the vulnerability, but criticized U.S. intelligence agencies like the NSA and CIA for stockpiling vulnerabilities rather than disclosing them. Microsoft stated that "an equivalent scenario with conventional weapons would be the U.S. military having some of its Tomahawk missiles stolen".[33] This stockpiling strategy prevented Microsoft from identifying and patching the exploit earlier.[33][34] However, commentators including Alex Abdo of Columbia University's Knight First Amendment Institute criticized Microsoft for shifting blame to the NSA, arguing the company should remain accountable for releasing a vulnerable product.[35] The company was also faulted for initially limiting the patch to actively supported Windows versions and paying Extended Support customers, leaving entities like the UK's NHS vulnerable. A month later, Microsoft took the unusual step of releasing free patches for legacy systems back to Windows XP.[36]
EternalRocks
EternalRocks (also known as MicroBotMassiveNet) is a computer worm that infects Microsoft Windows systems using seven NSA-developed exploits.[37] In comparison, WannaCry utilized only two, leading researchers to consider EternalRocks potentially more dangerous.[38] The worm was first identified using a honeypot.[39]
Infection
EternalRocks initially installs Tor to communicate with command-and-control servers covertly. After a 24-hour incubation period,[37] it downloads executable payloads and replicates across host machines.
To avoid early detection, the malware claims to be WannaCry in its file properties. However, unlike WannaCry, EternalRocks does not contain a kill switch or deliver a ransomware payload.[37]
See also
- BlueKeep (security vulnerability) – A similar vulnerability
- List of NSA controversies
- Petya (malware)