Microsoft Updates Security in Windows Exploited By NSA

Due to the widespread of the dangerous virus WannaCry Ransomware that crashed a lot of computers of organizations. Microsoft is forced to release security updates against EternalBlue SMB exploit for unsupported versions of Windows, but Microsoft left three of the Windows everyday exploits unpatched.
However, EternalBlue is a Windows SMB flaw that was leaked by the Shadow Brokers in April and then abused by the WannaCry ransomware to infect nearly 300,000 computers in more than 150 countries within just 72 hours on 12th of May 2017.Meanwhile, immediately after the WannaCry outbreak, The hacker news reported that three unpatched Windows exploits tools, codenamed “EsteemAudit,” “ExplodingCan,” and “EnglishmanDentist,” were also being exploited by individuals and state-sponsored hackers in the world.
The EsteemAudit, one of the dangerous Windows hacking tool that targets remote desktop protocol (RDP) service on Microsoft Windows Server 2003 and Windows XP machines, while ExplodingCan exploits bugs in IIS 6.0 and EnglishmanDentist exploits Microsoft Exchange servers.
But now Microsoft has released free security updates for unsupported versions of its products, including Windows XP and Server 2003, to patch all the three cyber-weapons and block next wave of “destructive cyberattacks” which is going to be similar to WannaCry.According to the recent Microsoft blog post, the critical down-level patches for three Windows exploits were prompted by an elevated risk of destructive cyberattacksby government organizations, referred to asnation-state actors or other copycat organizations.

The security patches for Windows XP, Vista, and Server 2003 contain fixes or mitigations for three alleged NSA-developed exploit tools known as the EsteemAudit, ExplodingCan, and EnglishmanDentist, though none of these exploits works on supported Windows platform.

However, unlike other regular Patches, this recent releases that delivered automatically through the Windows Update mechanism to your devices, these down-level patches must be downloaded and installed manually.

These updates are available in the Microsoft Download Center or, in the Update Catalog, or you can find download links at the bottom of Security Advisory 4025685.

No doubt, this move by Microsoft to protect its customers by releasing security updates for end-of-support products is commendable, but this could also motivate users to stick to 14-years-old unsupported and risky versions of Windows OS that are exposed to all manner of potential threats.

However, organizations and businesses should move on to the new updates and patches released by Microsoft in order to be secured that getting infected by ransomware.

And since Microsoft is fixing known vulnerabilities in Windows XP and Server 2003 that weren’t fixed before, the job of migrating away from unsupported versions just got a whole lot harder than before.

However, Eric Doerr, general manager of the company’s Security Response Center, said in a separate blog post that the move was only meant to fix flaws that are at heightened risk of exploitation due to past nation-state activity and disclosures.
“Our decision today to release these security updates for platforms not in extended support should not be viewed as a departure from our standard servicing policies,” Doerr said.
“Based on an assessment of the current threat landscape by our security engineers, we made the decision to make updates available more broadly,”  he added.

However, Doerr urged users to adopt new, supported versions of Microsoft products, which are significantly more secured and resistant to exploits, and warned them not to expect regular security updates for out-of-date platforms in the future.

Meanwhile as part of its regular Patch Tuesday, Microsoft has released security updates to patch nearly a hundred flaws in its various Windows operating systems and software, two of which have actively been exploited in the wild.

All the regular releases are delivered automatically through the Windows Update mechanism to users running supported versions of Windows OS, including Windows 10, 8.1, 7, and post-2008 Windows Server releases, on their devices.

The well known notorious hacking group, Shadow Brokers, who claimed to have stolen a bunch of hacking tools from the NSA’s elite hacking team Equation Group, had also promised to leak more zero-days and exploits starting this month.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.