Hello, welcome to the Monday, April 17th, 2017 edition of the Science and the Storm Centers

Stormcast. My name is Johannes Orrich and the damn recording from Jackstable, Florida.

On Friday, Shadowbroker released yet another set of exploits that it claimed to have stolen from the NSA.

Friday's release focused on Windows with some of the exploits targeting recent and still in support versions of Windows.

One exploit that initially looked particularly dangerous was Eternal Plu because it claimed to affect modern versions of Windows

up to version 8 and enabled a remote compromise via SMB.

Luckily Microsoft did release a patch for the underlying vulnerability in March, so if you applied March updates, then you should be okay.

All other vulnerabilities released also had received patches from Microsoft, some of them also fairly

recently. Now, I'm guessing here a little bit more than I usually like to on this podcast, but my

assumption is that after it became obvious that these exploits had been leaked, that the NSA

did notify Microsoft about the potentially leaked exploits, and that way Microsoft had a chance to fix them. As part of Microsoft's

March Bulletin, however, it did not indicate that these vulnerabilities were already being

exploited in the wild or that exploit code had been released for these issues.

There was actually no attribution at all in this case where Microsoft learned about these vulnerabilities.

Now, not every researcher that reports vulnerabilities to Microsoft does want to get

acknowledged, but this also very much reaffirms the theory that Microsoft

did get a heads up about these vulnerabilities from the NSA.

Now, we had a lengthy discussion internally about whether or not to raise the Infocon level

over this particular release. In the end, we decided against it, even though we were

going forth and back a couple times on that, so it wasn't really a very straightforward decision

in any way. What made a difference for me is that first of all, there's a patch available for a month now, and secondly, in order

to be vulnerable, you have to have SMB exposed. Also, you have to have SMB version 1 enabled.

...