Technical Information
Microsoft has released a technical blog outlining the known information around the exploits that were made publicly available by Shadow Brokers:
https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/
According to the article, most of the exploits that were made publicly available have already been patched in Microsoft's currently supported platforms for customers that have applied the most recent security patches.
In addition, Microsoft reports that their security team has not been able to successfully reproduce the three (3) remaining exploits on their currently supported platforms - specifically called out as Windows 7 and above, as well as Exchange 2010 and above.
Trend Micro has also released a blog with more background information: Shadow Brokers Leaks Hacking Tools: What it Means for Enterprises.
Trend Micro Products and Protection
Since these are specific exploits to Microsoft products and platforms, customers are always strongly advised to have current and officially supported versions of Microsoft products and platforms deployed with the latest security patches installed.
However, we recognize that many enterprise and business customers have legacy platforms still in production for various reasons. Fortunately, Trend Micro already has some solutions available that provide some level of protection.
- Offical Pattern Release: Trend Micro added detections for known threats associated with this release into our Official Pattern Release (OPR), and will continue to add any new ones that are discovered accordingly. Specifically the following detections are included as of Smart Scan Pattern 13.345.00 (April 17th):
The table below lists available solutions for the following products:
- Trend Micro Deep Security and Trend Micro Vulnerability Protection (formerly the IDF plug-in for OfficeScan) customers with the latest rules have an updated layer of protection.
- Trend Micro TippingPoint customers with the following filters have updated protection.
| Exploit | MS Bulletin | TippingPoint Filter(s) | Deep Security & Vulnerability Protection IPS Rule(s) |
|---|---|---|---|
| "EternalBlue" | MS17-010 | 27433, 27711, 27928 |
|
| "EmeraldThread" | MS10-061 | 10458, 27939 |
|
| "EternalChampion" | MS17-010 | 27433, 27711, 27929 |
|
| "ErraticGopher" | Prior to Vista | 27932 |
|
| "EskimoRoll" | MS14-068 | 27940 |
|
| "EternalRomance" | MS17-010 |
| |
| "EducatedScholar" | MS09-050 | 8465 |
|
| "EternalSynergy" | MS17-010 | 27937 |
|
| "EclipsedWing" | MS08-067 | 6515 |
|
| "EnglishmanDentist" | * | Under Investigation | Under Investigation |
| Emphasismine-3.4.0.exe |
| ||
| Esteemaudit-2.1.0.exe | 27933 |
| |
| Ewokfrenzy | 4033 |
| |
| Explodingcan-2.0.2.exe | * | 27643 |
|
| ECWI.exe |
| ||
| ELV.EXE | MS06-040 | 9317 |
|
| EarlyShovel | 27938 |
| |
| EbbisLand | 621, 622, 3512, 3791 |
| |
| EchoWrecker | 1676 |
| |
| EVFR | 1612 |
| |
| DoublePulsar (Payload) | 27935 |
|
* Microsoft has stated that these vulnerabilities cannot be reproduced on currently supported platforms, so the status of a Microsoft patch for older operating systems is uncertain at this time.
The next table addresses the following product:
- Trend Micro Deep Discovery Inspector customers with the latest rules have protection against specific exploits listed below.
| Exploit | Deep Discovery Inspector Rule |
|---|---|
| Eclipsedwing-1.5.2.exe | DDI Rule ID 0: OPS_MS08-067_Server_Service_Path_Canonicalization_Exploit |
| Educatedscholar-1.0.0.exe | DDI Rule ID 0: MS09-050_SMB2_DENIAL_OF_SERVICE and OCS_CVE-2009 |
| Explodingcan-2.0.2.exe | DDI Rule ID 2357: CVE-2017-7269 - WebDAV Buffer Overflow - HTTP (Request) |
| Eskimoroll-1.1.1.exe | DDI Rule ID 1791: Possible MS14-068_KERBEROS Checksum Vulnerability |
| Emphasisismine-3.4.0.exe | DDI Rule ID 2378: EXAMINE Buffer Overflow - IMAP4 (Response) |
| Ewokfrenzy-2.0.0.exe | DDI Rule ID 2379: CRAM-MD5 Authentication Buffer Overflow - IMAP4 (Response) |
| Esteemaudit-2.1.0.exe | DDI Rule ID 2377: RDP RCE Vulnerability |
| Emeraldthread-3.0.0.exe | DDI Rule ID 0: MS10-061 - Print Spooler Service Impersonation Exploit |
| Eternalromance-1.3.0.exe | DDI Rule ID 2380: CVE-2017-0147 - Information Disclosure Exploit - SMB (Request) |
| Eternalromance-1.4.0.exe | DDI Rule ID 2382: CVE-2017-0145 - RCE - SMB (Request) |
| Eternalsynergy-1.0.1.exe | DDI Rule ID 2380: CVE-2017-0147 - Information Disclosure Exploit - SMB (Request) |
| Eternalchampion-2.0.0.exe | DDI Rule ID 2380: CVE-2017-0147 - Information Disclosure Exploit - SMB (Request) |
| Eternalblue-2.2.0.exe | DDI Rule ID 2383: CVE-2017-0144 - RCE - SMB (Request) |
| Erraticgopher-1.0.1.exe | DDI Rule ID 2384: Possible EQUATED - RCE - SMB (Request) |
| Easybee-1.0.1.exe | DDI Rule ID 2389: EASYBEE - Email Server Exploit - HTTP (Request) |
Please note that Trend Micro is still investigating the recently released information for other exploits and will provides updates if/as necessary.
Trend Micro always highly recommends that vendor critical patches are applied as soon as possible upon release. Customers and partners who may need some additional information or have questions are encouraged to contact their authorized Trend Micro technical support representative for further assistance.