EternalBlue, an NSA hacking tool that was leaked to the public not quite a year ago, has joined a long line of reliable hacker favorites. It has been used by an elite Russian hacking team, a historic ransomware attack and an espionage group in the Middle East, as well as countless small-time cryptojackers, according to Wired. Back in 2008, there was the Windows worm that infected millions of computers, and before that, there was the Welchia remote code execution worm that wrecked havoc in 2003. EternalBlue is just continuing the tradition, which does not seem to be going anywhere. EternalBlue is the name of both a software vulnerability in Microsoft’s Windows operating system and an exploit the National Security Agency developed to weaponize the bug, reports Wired. It was leaked to the public in April 2017 during the fifth release of alleged NSA tools by the still mysterious group known as the Shadow Brokers. According to Wired, the tool “exploits a vulnerability in the Windows Server Message Block, a transport protocol that allows Windows machines to communicate with each other and other devices for things like remote services and file and printer sharing.” Attackers can figure out how to remotely execute any code they want.
Thanks for reading InsideHook. Sign up for our daily newsletter and be in the know.
