Gtr masthead v5

WannaCry proves govts must stop hoarding exploits: MS

By Dylan Bushell-Embling
Tuesday, 16 May, 2017

Is252 002 carousel

The weekend’s WannaCry ransomware outbreak should act as a “wake-up call” for governments to stop hoarding known vulnerabilities for espionage purposes, and instead report them to vendors, according to Microsoft.

In a blog post, Microsoft President and Chief Legal Officer Brad Smith said leaks of vulnerabilities collected and used by government agencies has become an emerging pattern in 2017.

“We have seen vulnerabilities stored by the CIA show up on WikiLeaks, and now this vulnerability stolen from the NSA has affected customers around the world,” he said. “Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage.”

He likened the scenario to the US military having some of its missiles stolen, and said governments should be applying the same rules involving securing weapons in the physical world to protecting civilians against the damage that can be inflicted on them with such exploits.

“This most recent attack represents a completely unintended but disconcerting link between the two most serious forms of cybersecurity threats in the world today — nation-state action and organised criminal action,” he said.

“We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits.”

In February, Microsoft called for a new ‘Digital Geneva Convention’ to govern issues associated with government exploitation of known vulnerabilities, including a new requirement for governments to report vulnerabilities to vendors rather than stockpile or exploit them.

The WannaCry ransomware campaign claimed at least 200,000 victims in 150 countries and caused widespread disruption to organisations such as the UK’s National Health Service. It involved exploiting a known vulnerability in Microsoft’s implementation of the Server Message Block (SMB), an exploit discovered by the US NSA and leaked by the group known as The Shadow Brokers in April.

Follow us on Twitter and Facebook

Related Articles

Ipswich launches waste-to-energy program

The City of Ipswich will no longer recycle yellow bin waste, but has launched one of...

21st-century government for 21st-century citizens

Smart city implementation works best in cities that develop and adopt a tailored, winnable approach.

ACT releases zero emission vehicle action plan

The ACT Government has unveiled a new plan designed to drive adoption of zero emission electric...

  • All content Copyright © 2018 Westwick-Farrow Pty Ltd