So that was a fun weekend. Not "fun" in the good sense, fun in the sense of eating cold pizza at 11pm on a Saturday while trying to remember the domain controller password for a law office I haven't touched since 2015.
If you spent Friday through Sunday anywhere near a Windows machine that wasn't patched, you already know what I'm talking about. WannaCry hit Friday afternoon and by Saturday morning it had chewed through hospitals in the UK, a telecom in Spain, and apparently a decent chunk of Renault's factory floor in France. I'm not going to walk through the whole timeline because if you're reading a tech blog you've had it explained to you four times already this week by four different outlets, all with the same diagram of a worm crawling through SMB. What I want to talk about is Saturday, which I spent at Frank's law office fixing three machines that should have been retired around the time Obama was inaugurated.
Frank (not his real name, but he reads this so hi Frank) runs a small practice and still has a receptionist desktop running XP because the scanner software it's tied to never got a Windows 7 driver and nobody wants to pay for a new scanner. I've been telling him for two years this was going to bite him eventually. It didn't get hit — small mercy, his firewall rules were tighter than I remembered setting them, which honestly surprised me — but I wasn't taking chances, so I spent four hours pulling that box off the network, imaging it, and manually applying the emergency patch Microsoft pushed out of band on Friday night. Microsoft patching XP in 2017 is its own small piece of news. They stopped supporting XP in 2014. They only broke that rule because the situation was bad enough that a security hole in a thirteen-year-old OS became everyone's problem again, not just the people still running it.
The other detail from this weekend that stuck with me: the guy who accidentally slowed the whole thing down is 22 and does security research under the handle MalwareTech. He registered some garbled domain name he found in the malware's code, mostly just to track infections the way researchers do, and it turned out the malware was checking whether that domain resolved before it detonated. Domain wasn't registered, so it ran. He registered it for about eight bucks and functionally flipped a kill switch for a huge chunk of the outbreak. I love that story a little too much, not because it's some clean hacker-movie moment, though it kind of is, but because it's such a good reminder that the difference between catastrophe and "well that was a rough Friday" sometimes comes down to one person poking around out of curiosity at exactly the right hour. He apparently didn't even realize what he'd done until later that night.
Microsoft's president put out a blog post on Sunday that's worth reading if you haven't, mostly because it's rare to see a company that size say something this pointed. The gist: this exploit didn't come out of nowhere, it came out of a leaked NSA tool, and Smith basically said governments stockpiling vulnerabilities instead of disclosing them is a bad trade when those tools inevitably leak. He compared it to the military losing missiles. I think that's a fair comparison and I don't think it's controversial to say so, but I also think it's a little rich coming from the company whose patching cadence and support-cutoff policies are exactly why so many machines were exposed in the first place. Both things can be true. The NSA sitting on EternalBlue for years is bad. XP still running in hospitals and law offices because upgrading is expensive and disruptive is also bad, and that one's not the NSA's fault.
Anyway. If you run anything with a Windows box in it, patch it now if you haven't, turn off SMBv1 if you don't need it (you probably don't), and if you've got some ancient machine running some ancient piece of software because replacing it is a hassle, you already know the hassle is coming eventually. This was just the weekend it showed up early.
I'm going to go sleep for approximately eleven hours.