CyberGlossary

Vulnerabilities

EternalBlue (CVE-2017-0144)

Also known as: MS17-010, CVE-2017-0144

Definition

An NSA-developed exploit for a 2017 Microsoft SMBv1 remote code execution vulnerability, leaked by the Shadow Brokers and used by WannaCry and NotPetya.

EternalBlue (CVE-2017-0144) is a remote code execution vulnerability in Microsoft's SMBv1 implementation that allowed an unauthenticated attacker on the network to execute kernel-level code on most then-supported Windows systems. The exploit was originally an NSA capability and was leaked publicly by the Shadow Brokers in April 2017. It became the propagation engine of WannaCry (May 2017) and NotPetya (June 2017), causing billions of dollars of damage worldwide. Microsoft released MS17-010 in March 2017, even backporting it to Windows XP after WannaCry. Defences: apply MS17-010, disable SMBv1, segment networks, and block SMB at perimeters.

Examples

  • WannaCry ransomware worming through corporate Windows networks via EternalBlue.
  • NotPetya wiping data after using EternalBlue to spread inside organisations.

Related terms