EternalBlue (CVE-2017-0144)

EternalBlue is the name given to an exploit for a critical remote-code-execution vulnerability, catalogued as CVE-2017-0144, in Microsoft’s Server Message Block version 1 (SMBv1) protocol implementation. The flaw let an unauthenticated remote attacker execute arbitrary code on vulnerable Windows systems — from Windows Vista through Windows Server 2016 — by sending specially crafted packets. It was one of several related SMBv1 flaws (including CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148) addressed together by Microsoft, and it carries a CVSS 3.1 score of 8.8 (High).

Origins and the Shadow Brokers leak

According to reporting by outlets such as the Washington Post and leaked tooling, EternalBlue was developed by the U.S. National Security Agency as part of a toolset associated with the so-called “Equation Group.” This NSA attribution is based on journalistic reporting and leaked material rather than any court finding or official U.S. government confirmation, so it is best treated as reported rather than conclusively proven. On April 14, 2017, a group calling itself “the Shadow Brokers” publicly released EternalBlue alongside other exploits and tools — including ETERNALSYNERGY, ETERNALROMANCE, ETERNALCHAMPION, DOUBLEPULSAR, and FUZZBUNCH — reportedly drawn from the Equation Group/NSA toolset. The Shadow Brokers’ own identity remains unconfirmed and disputed; the group had been leaking material since August 2016, and commentators including Edward Snowden have speculated, without confirmation, about a possible Russian connection.

Microsoft’s patch

Microsoft had already addressed the underlying SMBv1 vulnerabilities about a month before the leak, issuing security bulletin MS17-010 on March 14, 2017 for supported Windows versions. Whether Microsoft received advance notice of the flaw before the leak has not been publicly confirmed. After WannaCry struck, Microsoft took the unusual step of releasing emergency, out-of-band patches on May 13, 2017 for out-of-support systems, including Windows XP, Windows 8, and Windows Server 2003.

WannaCry and NotPetya

On May 12, 2017, the WannaCry ransomware worm began spreading using EternalBlue to self-propagate across unpatched systems with no user interaction required. Estimates of the toll vary, but reporting generally cites roughly 200,000–300,000 infected computers across around 150 countries, including major disruption to the UK’s National Health Service. Researcher Marcus Hutchins slowed the outbreak on May 13, 2017 by registering a hardcoded “kill switch” domain found in the malware. In December 2017 the U.S. government formally attributed WannaCry to North Korea, a position publicly supported by the UK, Canada, Japan, and New Zealand; North Korea denied involvement.

On June 27, 2017, a separate destructive outbreak later dubbed “NotPetya” (to distinguish it from earlier Petya ransomware, since it lacked a working decryption mechanism and functioned as a wiper) used EternalBlue for lateral movement after an initial compromise via Ukrainian accounting software. A White House assessment put global damages at over $10 billion, with major losses reported by companies including Maersk and Merck. In February 2018 the U.S., UK, and Australian governments attributed NotPetya to Russia, with U.S. officials pointing to the GRU’s Sandworm unit; Russia denied responsibility.

Legacy

EternalBlue-based exploitation continued for years against unpatched or legacy systems, and the case remains a widely cited example of the risks posed by intelligence agencies stockpiling software vulnerabilities rather than disclosing them to vendors.

Timeline

• 2017-03-14Microsoft releases security bulletin MS17-010, patching CVE-2017-0144 and related SMBv1 vulnerabilities for supported Windows versions.
• 2017-04-14The Shadow Brokers publicly release EternalBlue and other exploit tools reportedly linked to the NSA-associated Equation Group toolset.
• 2017-05-12WannaCry ransomware begins spreading globally, using EternalBlue to self-propagate across unpatched Windows systems.
• 2017-05-13Researcher Marcus Hutchins registers a kill-switch domain that slows WannaCry's spread; Microsoft issues emergency out-of-band patches for unsupported Windows versions (XP, Server 2003, Windows 8).
• 2017-06-27NotPetya wiper malware, using EternalBlue for lateral movement, spreads globally after originating via compromised Ukrainian accounting software.
• 2017-12-18The U.S. government formally attributes the WannaCry attack to North Korea; the UK, Canada, Japan, and New Zealand support the assessment.
• 2018-02-15The U.S., UK, and Australian governments publicly attribute the NotPetya attack to Russia.