WannaCry proves govts must stop hoarding exploits: MS
The weekend’s WannaCry ransomware outbreak should act as a “wake-up call” for governments to stop hoarding known vulnerabilities for espionage purposes, and instead report them to vendors, according to Microsoft.
In a blog post, Microsoft President and Chief Legal Officer Brad Smith said leaks of vulnerabilities collected and used by government agencies has become an emerging pattern in 2017.
“We have seen vulnerabilities stored by the CIA show up on WikiLeaks, and now this vulnerability stolen from the NSA has affected customers around the world,” he said. “Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage.”
He likened the scenario to the US military having some of its missiles stolen, and said governments should be applying the same rules involving securing weapons in the physical world to protecting civilians against the damage that can be inflicted on them with such exploits.
“This most recent attack represents a completely unintended but disconcerting link between the two most serious forms of cybersecurity threats in the world today — nation-state action and organised criminal action,” he said.
“We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits.”
In February, Microsoft called for a new ‘Digital Geneva Convention’ to govern issues associated with government exploitation of known vulnerabilities, including a new requirement for governments to report vulnerabilities to vendors rather than stockpile or exploit them.
The WannaCry ransomware campaign claimed at least 200,000 victims in 150 countries and caused widespread disruption to organisations such as the UK’s National Health Service. It involved exploiting a known vulnerability in Microsoft’s implementation of the Server Message Block (SMB), an exploit discovered by the US NSA and leaked by the group known as The Shadow Brokers in April.
Harnessing observability to secure Australia's critical infrastructure
Observability will play a strategic role in fostering digital resilience and innovation in...
Securing major events takes over a decade of strategising
Eight years out from Brisbane 2032, there are two remaining 'live' opportunities for...
The need to cap the ATO's access to personal data
It's time the ATO leveraged technology for a fairer tax ecosystem.
