The US National Security Agency (NSA) has warned Microsoft Windows users to make sure they are using updated systems to guard against the flaw known as “BlueKeep“, as it exists in past editions of Microsoft Windows. Microsoft has warned that this flaw is potentially “wormable,” meaning it could spread without user interaction across the internet.
Gavin Millard, VP of Intelligence at Tenable:
“The news of a BlueKeep proof of concept that doesn’t crash targets isn’t a surprise. Whilst there’s a few sources that have to be confirmed and unfounded rumour to be ignored, organisations should still be proactively patching this issue. Remote code execution on a ubiquitous service like remote desktop services aren’t that common, and when a working exploit is found in them they are almost always leveraged in an attack in some form or another.
“In 30 days’ time, we don’t want to be looking back – as many did with the MS17-010 vulnerability that led to WannaCry – and wondering why patches hadn’t been proactively deployed to mitigate the significant threat this vulnerability could quickly pose.
“However, a straw poll of 255 IT security professionals visiting Infosecurity Europe this week found that 79% were unaware of the vulnerability almost a month after it was first announced. This is a pretty stunning number considering the headlines already written about the bug in the last two weeks.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.