Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×
Windows Bug Microsoft Security

Penetration Testing Toolkit Includes Exploit For 'Incredibly Dangerous' Bluekeep Vulnerability (vice.com) 67

An anonymous reader quotes Vice: In May, Microsoft released a patch for a bug in several versions of Windows that is so bad that the company felt it even had to release a fix for Windows XP, an operating system that (has been unsupported) for five years. That vulnerability is known as BlueKeep, and it has kept a lot of security researchers up at night. They are worried that someone could write an exploit for it and make a worm that could wreak havoc the way WannaCry or NotPetya -- two viruses that spread almost uncontrollably all over the world locking thousands of computers -- did.... Researchers were so worried about this vulnerability that for months, no one has published the code for a proof-of-concept exploit. In other words, no one wanted to be the guy to even prove that this type of malware was even possible to write.

Until now.

On Tuesday, Immunity, a long time US government contractor, announced that it had developed an exploit for BlueKeep and included it into its penetration testing toolkit Canvas, which is available only to paying subscribers. Canvas customers, can now exploit this bug using Immunity's own code.

ZDNet notes that Canvas licenses "cost between thousands and tens of thousands of US dollars," but also adds that "hackers have been known to pirate or legitimately buy penetration testing tools."
This discussion has been archived. No new comments can be posted.

Penetration Testing Toolkit Includes Exploit For 'Incredibly Dangerous' Bluekeep Vulnerability

Comments Filter:
  • "That vulnerability is known as BlueKeep, and it has kept a lot of security researchers up at night"

    If security vulnerabilities somehow keep you up at night, there's something about Windows you should never find out.....

  • "In May, Microsoft released a patch for a bug in several versions of Windows that is so bad that the company felt it even had to release a fix for Windows XP"

    What about us Linux users, how do we get in on the fun?

    Honestly, I feel kind of snubbed that my system isn't vulnerable to these ancient bugs and flaws.

    • You could always start a new hobby searching for a Windows bug that also exists in WINE.

      Good luck!

    • by jmccue ( 834797 )

      Honestly, I feel kind of snubbed that my system isn't vulnerable to these ancient bugs and flaws.

      Spectre/meltdown ought to be fun enough for you :) But to be fair that impacts all OSs

      But Windows seems to get all the good ones.

  • by Dutch Gun ( 899105 ) on Saturday July 27, 2019 @11:55AM (#58997322)

    It's not completely clear from the summary, but inside the article we find out that Windows 8 and Windows 10 are NOT vulnerable. Windows XP -> Windows 7 (along with equivalent Server variations) are vulnerable, and must be patched.

    • Oh noes! A vulnerability in an OS that is well past its end of life? Surprised Pikachu meme.
      • Windows 7 is not past end of life, which occurs Jan 2020. And a LOT of machines are still running it. The latest Steam hardware survey shows it at a bit over 20%, although it's dropping off fairly rapidly at this point. I'd bet it's still used in a lot of businesses as well.

        MS will probably still patch critical OS vulnerabilities like this one for the next decade, though, like they've done for XP.

    • by qubezz ( 520511 )
      Or just don't use the remote desktop connection server.
  • by phreakngeek ( 1250360 ) on Saturday July 27, 2019 @01:14PM (#58997534)
    Sorry to disrupt the commercial for Immunity Canvas but you can download a Bluekeep POC from github here: https://github.com/Ekultek/Blu... [github.com]
  • Assuming you actually have RDP enabled.

    • Assuming you actually have RDP enabled.

      Windows 7 seems to come with RDP enabled by default, which is even more concerning than the bug in the service.

MS-DOS must die!

Working...