Microsoft warns users to patch as exploits for ‘wormable’ BlueKeep bug appear

Microsoft has issued its second advisory this month urging users to update their systems to prevent a re-run of attacks similar to WannaCry.

The software giant said Thursday that the recently discovered “wormable” vulnerability in Remote Desktop Services for Windows can allow attackers to remotely run code on a vulnerable computer — such as malware or ransomware. Worse, the vulnerability allows it to spread to other computers on the same network “in a similar way as the WannaCry malware,” which spread across the globe in 2017 causing billions of dollars in damage.

A patch was released earlier this month on Microsoft’s usual patch release day — its so-called Patch Tuesday. And though there’s no signs of an active attack yet, “this does not mean that we’re out of the woods,” the company said.

Microsoft said it’s “confident” that an exploit exists for the vulnerability, putting close to one million computers directly connected to the internet are at risk.

But that figure could be far higher if servers at the enterprise firewall level are hit — with the potential of every other computer connecting to it facing a similar fate.

“Our recommendation remains the same. We strongly advise that all affected systems should be updated as soon as possible,” said Microsoft.

The bug, CVE-2019-0708 — better known as BlueKeep — is a “critical” vulnerability that affects computers running Windows XP and later, including its server operating systems. The vulnerability can be used to run code at the system level, allowing full access to the computer — including tis data. Worse, it is remotely exploitable, allowing anyone to attack a computer connected to the internet.

Microsoft said only Windows 8 and Windows 10 are not vulnerable to the bug. But the bug is so dangerous that Microsoft took the rare step of issuing patches to its long outdated and unsupported operating systems, including Windows XP.

So far, several security firms — including McAfee and Check Point — have claimed to have developed working proof-of-concept code that can at very least create a denial-of-service condition, such as shutting down a computer. But fear remains that hackers are close to creating code that could spark another major ransomware attack.

Independent malware researcher Marcus Hutchins said in a tweet it took him “an hour” to develop code to exploit the vulnerability, but declined to post the code because the bug is “dangerous.”

The universal message seems clear: patch your systems before it’s too late.