In a rare occurrence, the National Security Agency (NSA) has published a statement urging people to update their older Windows systems to protect against the BlueKeep vulnerability.
The NSA does not typically comment on cybersecurity vulnerabilities in commercial products, but the potential danger of the recently detailed exploit has lead it to make a statement.
“The National Security Agency is urging Microsoft Windows administrators and users to ensure they are using a patched and updated system in the face of growing threats,” the statement read. “We have seen devastating computer worms inflict damage on unpatched systems with wide-ranging impact, and are seeking to motivate increased protections against this flaw.”
The concern over this particular exploit is that it is “wormable,” meaning that it can spread itself from one infected computer to others on the same network. This is a big threat to older machines on a shared network, such as a typical enterprise system, as well as older machines which are connected to the internet.
Although there has not been a worm using this exploit detected yet, both Microsoft and the NSA believe it is only a matter of time until one appears. “NSA is concerned that malicious cyber actors will use the vulnerability in ransomware and exploit kits containing other known exploits, increasing capabilities against other unpatched systems,” the statement said.
The NSA also published an advisory on what steps system administrators should take to protect their networks against this vulnerability.
This is somewhat ironic given the NSA’s role in the creation of the very similar EternalBlue exploit which was recently used to hold the city of Baltimore’s computer systems for ransom. The NSA developed the EternalBlue attack software for its own use, but lost control of it when it was stolen by hackers in 2017. It then caused chaos around the world with the WannaCry and NotPetya cyber attacks. BlueKeep is similar enough to EternalBlue that Microsoft compared the two of them in its warning to users about the vulnerability.
The NSA has never formally acknowledged its role in the creation of malware, even though Microsoft itself pointed the finger at the NSA for the problems caused by “the stockpiling of vulnerabilities” and condemned it for allowing the malware to be stolen. “An equivalent scenario with conventional weapons would be the U.S. military having some of its Tomahawk missiles stolen,” Microsoft said.
