For months, security researchers have been warning about the public release of the code for BlueKeep, a worm that exploits vulnerabilities in older versions of Windows. The worm can spread from computer to computer, much like the WannaCry two years ago.
Last Friday, the Metasploit framework – an open-source tool used by white and black hat hackers – added a module containing the exploit, so it is now out there, ready for attacks.
The new module, published for development on Github, does not yet have the reliability of the EternalBlue exploit developed by the NSA and later used in WannaCry.
For example, if users using the new module specify the wrong version of Windows they want to attack, they are likely to see a BSOD on their computer.
For the exploit to work on servers, it requires some changes to the default settings in the form of a registry modification that enables audio sharing.
In contrast, the EternalBlue exploit – released by the Shadow Brokers group in April 2017 – cannot work seamlessly across a wide range of Windows versions and their default settings.
A month after the leak, EternalBlue was released as Wannacry ransomware and was hitting computers globally.
As we mentioned earlier, the Metasploit developers added this exploit to their penetration testing tool, but it doesn't seem to be as flexible as the EternalBlue exploit. However, it's still quite effective.
Microsoft has already warned several times about a Windows bug that could lead to another WannaCry.
The flaw, which has been registered as CVE-2019-0708 and is known as BlueKeep, is found in previous versions of Remote Desktop services and affects Windows 2003, XP, Vista 7, Server 2008 R2 and Server 2008 systems.
If you have any of the above systems, update your computers immediately.
