EternalBlue

EternalBlue[6] is a cyberattack exploit developed by the U.S. National Security Agency (NSA).[7] It was leaked by the Shadow Brokers hacker group on April 14, 2017, one month after Microsoft released patches for the vulnerability.

Eternal Exploit
Common nameEternal
Technical name
  • Blue Variant
  • Rocks Variant
  • Synergy Variant
    • Win32/Exploit.Equation.EternalSynergy (ESET) [5]
TypeExploit
Author(s)Equation Group
Operating system(s) affectedWindows 95, Windows 98, Windows Me, Windows NT, Windows 2000, Windows XP

On May 12, 2017, the worldwide WannaCry ransomware used this exploit to attack unpatched computers.[6][8][9][10][11][12]:1 On June 27, 2017, the exploit was again used to help carry out the 2017 NotPetya cyberattack on more unpatched computers.[13]

The exploit was also reported to have been used since March 2016 by the Chinese hacking group Buckeye (APT3), after they likely found and re-purposed the tool,[12]:1 as well as reported to have been used as part of the Retefe banking trojan since at least September 5, 2017.[14]

EternalBlue was among the several exploits used, in conjunction with the DoublePulsar backdoor implant tool.[15]

Details

EternalBlue exploits a vulnerability in Microsoft's implementation of the Server Message Block (SMB) protocol. This vulnerability is denoted by entry CVE-2017-0144[16][17] in the Common Vulnerabilities and Exposures (CVE) catalog. The vulnerability exists because the SMB version 1 (SMBv1) server in various versions of Microsoft Windows mishandles specially crafted packets from remote attackers, allowing them to execute arbitrary code on the target computer.[18]

The NSA did not alert Microsoft about the vulnerabilities, and held on to it for more than five years before the breach forced its hand. The agency then warned Microsoft after learning about EternalBlue's possible theft, allowing the company to prepare a software patch issued in March 2017,[19] after delaying its regular release of security patches in February 2017.[20] On Tuesday, March 14, 2017, Microsoft issued security bulletin MS17-010,[21] which detailed the flaw and announced that patches had been released for all Windows versions that were currently supported at that time, these being Windows Vista, Windows 7, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2012, and Windows Server 2016.[22][23]

Many Windows users had not installed the patches when, two months later on May 12, 2017, the WannaCry ransomware attack used the EternalBlue vulnerability to spread itself.[24][25] The next day (May 13, 2017), Microsoft released emergency security patches for the unsupported Windows XP, Windows 8, and Windows Server 2003.[26][27]

In February 2018, EternalBlue was ported to all Windows operating systems since Windows 2000 by RiskSense security researcher Sean Dillon. EternalChampion and EternalRomance, two other exploits originally developed by the NSA and leaked by The Shadow Brokers, were also ported at the same event. They were made available as open sourced Metasploit modules.[28]

At the end of 2018, millions of systems were still vulnerable to EternalBlue. This has led to millions of dollars in damages due primarily to ransomware worms. Following the massive impact of WannaCry, both NotPetya and BadRabbit caused over $1 billion worth of damages in over 65 countries, using EternalBlue as either an initial compromise vector or as a method of lateral movement.[29]

In May 2019, the city of Baltimore struggled with a cyberattack by digital extortionists using EternalBlue. The attack froze thousands of computers, shut down email and disrupted real estate sales, water bills, health alerts and many other services.[30] Since 2012, four Baltimore City chief information officers have been fired or have resigned; two left while under investigation.[31] Some security researchers said that the responsibility for the Baltimore breach lay with the city for not updating their computers. Security consultant Rob Graham wrote in a tweet: "If an organization has substantial numbers of Windows machines that have gone 2 years without patches, then that’s squarely the fault of the organization, not EternalBlue."[32]

Responsibility

According to Microsoft, it was the United States's NSA that was responsible because of its controversial strategy of not disclosing but stockpiling vulnerabilities. The strategy prevented Microsoft from knowing of (and subsequently patching) this bug, and presumably other hidden bugs.[33][34]

EternalRocks

EternalRocks or MicroBotMassiveNet is a computer worm that infects Microsoft Windows. It uses seven exploits developed by the NSA.[35] Comparatively, the WannaCry ransomware program that infected 230,000 computers in May 2017 only uses two NSA exploits, making researchers believe EternalRocks to be significantly more dangerous.[36] The worm was discovered via honeypot.[37]

Infection

EternalRocks first installs Tor, a private network that conceals Internet activity, to access its hidden servers. After a brief 24 hour "incubation period",[35] the server then responds to the malware request by downloading and self-replicating on the "host" machine.

The malware even names itself WannaCry to avoid detection from security researchers. Unlike WannaCry, EternalRocks does not possess a kill switch and is not ransomware.[35]

See also

References
  1. "Trojan:Win32/EternalBlue threat description - Microsoft Security Intelligence". www.microsoft.com.
  2. "TrojanDownloader:Win32/Eterock.A threat description - Microsoft Security Intelligence". www.microsoft.com.
  3. "Risk Detected". www.broadcom.com.
  4. "TROJ_ETEROCK.A - Threat Encyclopedia - Trend Micro USA". www.trendmicro.com.
  5. "Win32/Exploit.Equation.EternalSynergy.A | ESET Virusradar". www.virusradar.com.
  6. Goodin, Dan (April 14, 2017). "NSA-leaking Shadow Brokers just dumped its most damaging release yet". Ars Technica. p. 1. Retrieved May 13, 2017.
  7. Nakashima, Ellen; Timberg, Craig (May 16, 2017). "NSA officials worried about the day its potent hacking tool would get loose. Then it did". Washington Post. ISSN 0190-8286. Retrieved December 19, 2017.
  8. Fox-Brewster, Thomas (May 12, 2017). "An NSA Cyber Weapon Might Be Behind A Massive Global Ransomware Outbreak". Forbes. p. 1. Retrieved May 13, 2017.
  9. Goodin, Dan (May 12, 2017). "An NSA-derived ransomware worm is shutting down computers worldwide". Ars Technica. p. 1. Retrieved May 13, 2017.
  10. Ghosh, Agamoni (April 9, 2017). "'President Trump what the f**k are you doing' say Shadow Brokers and dump more NSA hacking tools". International Business Times UK. Retrieved April 10, 2017.
  11. "'NSA malware' released by Shadow Brokers hacker group". BBC News. April 10, 2017. Retrieved April 10, 2017.
  12. Greenberg, Andy (May 7, 2019). "The Strange Journey of an NSA Zero-Day—Into Multiple Enemies' Hands". Wired. Archived from the original on May 12, 2019. Retrieved August 19, 2019.
  13. Perlroth, Nicole; Scott, Mark; Frenkel, Sheera (June 27, 2017). "Cyberattack Hits Ukraine Then Spreads Internationally". The New York Times. p. 1. Retrieved June 27, 2017.
  14. "EternalBlue Exploit Used in Retefe Banking Trojan Campaign". Threatpost. Retrieved September 26, 2017.
  15. "stamparm/EternalRocks". GitHub. Retrieved May 25, 2017.
  16. "CVE-2017-0144". CVE - Common Vulnerabilities and Exposures. The MITRE Corporation. September 9, 2016. p. 1. Retrieved June 28, 2017.
  17. "Microsoft Windows SMB Server CVE-2017-0144 Remote Code Execution Vulnerability". SecurityFocus. Symantec. March 14, 2017. p. 1. Retrieved June 28, 2017.
  18. "Vulnerability CVE-2017-0144 in SMB exploited by WannaCryptor ransomware to spread over LAN". ESET North America. Archived from the original on May 16, 2017. Retrieved May 16, 2017.
  19. "NSA officials worried about the day its potent hacking tool would get loose. Then it did". Retrieved September 25, 2017.
  20. Warren, Tom (April 15, 2017). "Microsoft has already patched the NSA's leaked Windows hacks". The Verge. Vox Media. p. 1. Retrieved April 25, 2019.
  21. "Microsoft Security Bulletin MS17-010 – Critical". technet.microsoft.com. Retrieved May 13, 2017.
  22. Cimpanu, Catalin (May 13, 2017). "Microsoft Releases Patch for Older Windows Versions to Protect Against Wana Decrypt0r". Bleeping Computer. Retrieved May 13, 2017.
  23. "Windows Vista Lifecycle Policy". Microsoft. Retrieved May 13, 2017.
  24. Newman, Lily Hay (March 12, 2017). "The Ransomware Meltdown Experts Warned About Is Here". wired.com. p. 1. Retrieved May 13, 2017.
  25. Goodin, Dan (May 15, 2017). "Wanna Decryptor: The NSA-derived ransomware worm shutting down computers worldwide". Ars Technica UK. p. 1. Retrieved May 15, 2017.
  26. Surur (May 13, 2017). "Microsoft release Wannacrypt patch for unsupported Windows XP, Windows 8 and Windows Server 2003". Retrieved May 13, 2017.
  27. MSRC Team. "Customer Guidance for WannaCrypt attacks". microsoft.com. Retrieved May 13, 2017.
  28. "NSA Exploits Ported to Work on All Windows Versions Released Since Windows 2000". www.bleepingcomputer.com. Retrieved February 5, 2018.
  29. "One Year After WannaCry, EternalBlue Exploit Is Bigger Than Ever". www.bleepingcomputer.com. Retrieved February 20, 2019.
  30. Perlroth, Nicole; Shane, Scott (May 25, 2019). "In Baltimore and Beyond, a Stolen N.S.A. Tool Wreaks Havoc" – via NYTimes.com.
  31. Gallagher, Sean (May 28, 2019). "Eternally Blue: Baltimore City leaders blame NSA for ransomware attack". Ars Technica.
  32. Rector, Ian Duncan, Kevin. "Baltimore political leaders seek briefings after report that NSA tool was used in ransomware attack". baltimoresun.com.
  33. "The need for urgent collective action to keep people safe online: Lessons from last week's cyberattack - Microsoft on the Issues". Microsoft on the Issues. May 14, 2017. Retrieved June 28, 2017.
  34. Titcomb, James (May 15, 2017). "Microsoft slams US government over global cyber attack". The Telegraph. p. 1. Retrieved June 28, 2017.
  35. "New SMB Worm Uses Seven NSA Hacking Tools. WannaCry Used Just Two".
  36. "Newly identified ransomware 'EternalRocks' is more dangerous than 'WannaCry' - Tech2". Tech2. May 22, 2017. Retrieved May 25, 2017.
  37. "Miroslav Stampar on Twitter". Twitter. Retrieved May 30, 2017.

Further reading
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.