People Aren’t Patching for the BlueKeep Windows Exploit, and Even the NSA Is Worried
Microsoft has tried to leave Windows XP in the dust, but it just can’t get away. The company recently discovered a bug in older versions of Windows so severe that it decided to go back and patch XP, along with several other ancient versions of the OS. People aren’t updating fast enough, though. Now even the NSA is getting worried that the so-called BlueKeep flaw could result in a dangerous worm that spreads across the globe, wreaking havoc on unprotected computers.
Before it was dubbed BlueKeep, Microsoft talked about the bug in a security bulletin on its blog. At the time, Microsoft chose not to disclose too much about the vulnerability, which exists in the remote desktop module of Windows. Essentially, the operating system doesn’t correctly authenticate RDP (remote desktop protocol) requests. As a result, an attacker can run arbitrary code, steal data, and spy on users.
There’s some good news, though. Windows 8 and newer platforms don’t have the vulnerability, and Microsoft can push updates to Windows Vista, Windows 7, and Server 2008 via Windows Update. The problem is Windows XP and Serve 2003. These systems are no longer supported, so the only way to get the patch is to install it manually. People aren’t doing that, so the National Security Agency is getting involved.
According to the NSA advisory, millions of machines are potentially vulnerable. These are mostly XP and Server 2003 boxes running essential functions in businesses and industrial facilities where newer versions of Windows simply won’t work. The vulnerability is “wormable,” meaning it could spread between vulnerable systems like the WannaCry malware. The NSA is concerned that online criminals could use BlueKeep to distribute ransomware or conduct denial of service (DoS) attacks on critical infrastructure.
Just a reminder. Go patch your systems. We're not out of the woods yet. The likelihood of a worm is still high — we're only 15 days after Update Tuesday. There's still plenty of time for it to surface. I hope I'm wrong but the consequences could be devastating if it happens. https://t.co/JaQHcEkhZS
— Simon Pope (@skjpope) May 30, 2019
Microsoft’s Simon Pope, who authored the original advisory, also notes that systems are not being patched quickly enough. According to Pope, the likelihood of a worm is still high because of all the vulnerable systems. Malware based on BlueKeep is probably inevitable, but we have to hope that enough old systems either break down or get patched before that happens to contain the fallout.
Anyone in charge of old systems connected to the internet should head over to Microsoft’s security center to get the updates. The patches are tiny and will be easy to deploy — people just have to care enough to do it.
Let us know: How likely are you to recommend wfoojjaec?
Continue reading
Elon Musk: SpaceX Will Send People to Mars in 4 to 6 Years
SpaceX and Tesla CEO Elon Musk likes to make bold claims. Sometimes he comes through, and we end up with a reusable Falcon 9 rocket, but Musk also has a tendency to get carried away, particularly when it comes to Mars. The SpaceX CEO has long promised a Mars colony on an aggressive, and some…
190,000 Ceiling Fans Recalled After Blades Fly Off, Hitting People
King of Fans is recalling some 190,000 ceiling fans sold through Home Depot after the blades began detaching during operation.
Signia Active Hearing Aids Review: For People Who Love Earbuds
For many people, the idea of wearing hearing aids comes with a stigma, even if it would benefit them. So hearing aid companies have been working on new form factors to try and make that less of an issue. We review one of the latest, the earbud-shaped Active Pro model from Signia.
Newegg Forced People to Buy Gigabyte Power Supplies With Catastrophic Failure Rates
An investigation into Gigabyte power supplies has found that an unacceptable number of units suffer failures, many of them explosively. What makes all of this worse is that the same two model numbers known to be affected were part of Newegg's forced bundling program earlier this year.