![](\"https:\/\/media.wired.com\/photos\/5e698296cbb66f00092ca337\/master\/pass\/windows_worm-feature-976644990-152886023.jpg\"\/)
<\/p>\n<\/p>\n
Credit to Author: Dan Goodin, Ars Technica| Date: Thu, 12 Mar 2020 12:00:00 +0000<\/strong><\/p>\n Dan Goodin, Ars Technica<\/span><\/a><\/span> <\/span><\/p>\n Word leaked out on Tuesday of a new vulnerability in recent versions of Windows that has the potential to unleash the kind of self-replicating attacks that allowed the WannaCry<\/a> and NotPetya<\/a> worms to cripple business networks around the world.<\/p>\n This story originally appeared on Ars Technica<\/a>, a trusted source for technology news, tech policy analysis, reviews, and more. Ars is owned by WIRED's parent company, Cond\u00e9 Nast.<\/p>\n The vulnerability exists in version 3.1.1 of the Server Message Block 3.1.1 that\u2019s used to share files, printers, and other resources on local networks and over the internet. Attackers who successfully exploit the flaw can execute code of their choice on both servers and end-user computers that use the vulnerable protocol, Microsoft said in this bare-bones advisory<\/a>.<\/p>\n The flaw, which is tracked as CVE-2020-0796, affects Windows 10 and Windows Server 2019, which are relatively new releases that Microsoft has invested huge amounts of resources hardening against precisely these types of attacks. Patches aren\u2019t available, and Tuesday\u2019s advisory gave no timeline for one being released. Asked if there was a timeline for releasing a fix, a Microsoft representative said: \u201cBeyond the advisory you linked, nothing else to share from Microsoft at this time.\u201d<\/p>\n In the meantime, Microsoft said vulnerable servers can be protected by disabling compression to block unauthenticated attackers from exploiting the vulnerability against an SMBv3 server. Users can use the following PowerShell command to turn off compression without needing to reboot the machine:<\/p>\n Set-ItemProperty -Path "HKLM:SYSTEMCurrentControlSetServicesLanmanServerParameters" DisableCompression -Type DWORD -Value 1 -Force<\/p>\n That fix won\u2019t protect vulnerable client computers from attack. Microsoft also recommended users block port 445, which is used to send SMB traffic between machines.<\/p>\n An advisory published\u2014and then removed\u2014by security firm Fortinet described the vulnerability as \u201cMS.SMB.Server.Compression.Transform.Header.Memory.Corruption.\u201d The pulled advisory said the flaw is the result of a buffer overflow<\/a> in vulnerable Microsoft SMB servers.<\/p>\n \u201cThe vulnerability is due to an error when the vulnerable software handles a maliciously crafted compressed data packet,\u201d Fortinet researchers wrote. \u201cA remote, unauthenticated attacker can exploit this to execute arbitrary code within the context of the application.\u201d<\/p>\n Cisco\u2019s Talos security team also published\u2014and later pulled\u2014its own advisory. It called the vulnerability \u201cwormable,\u201d meaning a single exploit could touch off a chain reaction that allows attacks to spread from vulnerable machine to vulnerable machine without requiring any interaction from admins or users.<\/p>\n \u201cAn attacker could exploit this bug by sending a specially crafted packet to the target SMBv3 server, which the victim needs to be connected to,\u201d the removed Talos post said. \u201cUsers are encouraged to disable SMBv3 compression and block TCP port 445 on firewalls and client computers. The exploitation of this vulnerability opens systems up to a \u2018wormable\u2019 attack, which means it would be easy to move from victim to victim.\u201d<\/p>\n Microsoft\u2019s implementation of SMBv3 introduces a variety of measures designed to make the protocol more secure on Windows computers. The update became more widely used after WannaCry<\/a> and NotPetya<\/a> used an exploit developed by\u2014and later stolen from\u2014the National Security agency. Known as EternalBlue, the attack exploited SMBv1 to gain remote code execution and move from machine to machine. Microsoft has similarly hardened Windows 10 and Server 2019 to better withstand exploits, especially those that would otherwise be wormable.<\/p>\n It\u2019s not clear why Microsoft released the sparse details or why both Fortinet and Talos released and then pulled their advisories. The event came on Update Tuesday, which occurs on the second Tuesday of each month, when Microsoft releases a crop of patches to fix various security vulnerabilities.<\/p>\n While CVE-2020-0796 is potentially serious, not everyone said it poses the kind of threat mounted by the SMBv1 flaw that was exploited by WannaCry and NotPetya. Those worms were fueled by the public release of EternalBlue<\/a>, an exploit that was so reliable it made exploitation a copy-and-paste exercise. Another major contribution to the worms\u2019 success was the near-ubiquity of the SMBv1 at the time. SMBv3, by contrast, is much less used.<\/p>\n SMB is also protected by kernel address space layout<\/a> randomization, a protection that randomizes the memory locations where attacker code gets loaded in the event a vulnerability is successfully exploited. The protection requires attackers to devise two highly reliable exploits, one that abuses a buffer overflow or other code-execution vulnerability and another that reveals the memory locations of the malicious payload. The protection required Buckeye, an advanced hacker group that exploited the SMBv1 flaw<\/a> 14 months before the mysterious leak of EternalBlue, to use a separate information disclosure flaw as well.<\/p>\n Jake Williams, a former NSA hacker and the founder of security firm Rendition Security, said in a Twitter thread<\/a> that both those factors would likely buy vulnerable networks time.<\/p>\n \u201cThe TL;DR here is that this IS serious, but it isn't WannaCry 2.0,\u201d he wrote. \u201cFewer systems are impacted and there's no readily available exploit code. I'm not thrilled about another SMB vuln, but we all knew this would come (and this won't be the last). Hysteria is unwarranted though.\u201d<\/p>\n It\u2019s also worth remembering that BlueKeep, the name of another wormable vulnerability Microsoft patched last May<\/a>, has yet to be exploited widely\u2014if at all\u2014despite dire warnings it posed a serious risk<\/a> to networks around the world.<\/p>\n The cause of the advisories being published and then pulled touched off a fair amount of speculation on Twitter. Microsoft commonly provides details about soon-to-be-released patches with makers of antivirus products and intrusion prevention systems. It\u2019s possible Microsoft delayed release of the SMBv3 patch at the last minute, and these partners didn\u2019t get word of it.<\/p>\n Whatever the cause, the cat is out of the bag now. Windows users who have SMBv3 exposed on the Internet would do well to heed Microsoft\u2019s security advice as soon as possible.<\/p>\n This story originally appeared on Ars Technica<\/a>.<\/em><\/p>\n