On Friday, the hacker group known as The Shadow Brokers released a trove of Windows exploits. But Microsoft says it has already issued patches for the majority of attacks, and the most recent fix came last month.

"Most of the exploits that were disclosed fall into vulnerabilities that are already patched in our supported products," a blog post published Friday night by Microsoft reads.

Broadly, the exploits could have allowed a hacker to compromise affected computers on a variety of Windows versions.

For example, the ERRATICGOPHER attack was addressed prior to the release of Windows Vista, and ETERNALCHAMPION was fixed with two other previously disclosed vulnerabilities, according to the blog post.

ETERNALBLUE, ETERNALROMANCE, and ETERNALSYNERGY were all patched on March 14, according to a Microsoft Security Bulletin.

Microsoft did not patch three other exploits, ENGLISHMANDENTIST, ESTEEMAUDIT, and EXPLODINGCAN, ostensibly because the attacks could not be reproduced on supported systems—that is, modern versions of Windows that Microsoft still issues updates for. Microsoft says customers using Windows 7 or above are not at risk.

"Customers still running prior versions of these products are encouraged to upgrade to a supported offering," the Microsoft blog post added.

Interestingly before the March 14 patch, vulnerabilities related to several ETERNAL exploits also affected Windows 10, according to the Microsoft Security Bulletin. But, again, a fully up to date copy of Windows 10 will not be vulnerable.

Originally, it was believed that many of these exploits were so-called zero-days; exploits that took advantage of vulnerabilities that Microsoft was not aware of. Security researchers verified that many of the exploits did work against Windows systems.

However, it turns out that at least one of the researchers did not test the exploits against a fully up to date Windows machine, and crucially, not on one that included the March 14 patch.

Matthew Hickey, otherwise known as Hacker Fantastic and the co-founder of British cybersecurity firm Hacker House, told Motherboard on Saturday he had used a "clean install" of Windows to test the attacks. Meaning that the machine didn't include the latest security fixes, and led to erroneous results.

It's pretty much always a good idea to keep your computer's operating system fully up to date, especially when news of critical security issues comes to light. </s> Microsoft said it has already patched vulnerabilities revealed in Friday’s high-profile leak of suspected U.S. National Security Agency spying tools, meaning customers should be protected if they’ve kept their software up-to-date.

Friday’s leak caused concern in the security community. The spying tools include about 20 exploits designed to hack into old versions of Windows, such as Windows XP and Windows Server 2008.

However, Microsoft said several patches -- one of which was made only last month -- address the vulnerabilities.

“Our engineers have investigated the disclosed exploits, and most of the exploits are already patched,” the company said in a blog post late on Friday.

Three of the exploits found in the leak have not been patched but do not work on platforms that Microsoft currently supports, such as Window 7 or later and Exchange 2010 or later.

“Customers still running prior versions of these products are encouraged to upgrade to a supported offering,” the company said.

Matthew Hickey, director of security firm Hacker House, has looked over the leaks and agrees with Microsoft’s assessment.

He advises that businesses, which often delay patches for operational purposes, move quickly to install the Microsoft fixes to mission critical servers. Hickey demonstrated in a video that one of the exploits in the leak can easily trigger remote code execution in a machine running Windows Server 2008 R2 SP1.

The patch, MS17-010, addresses the exploit. Microsoft issued the fix last month, but it’s unclear how the company learned of the security issue.

“Microsoft doesn't credit anyone for the report behind the March patch,” tweeted former NSA contractor Edward Snowden. He wonders whether the NSA tipped off Microsoft.

Friday’s high-profile leak was the latest disclosure from a mysterious group known as the Shadow Brokers. The group has been posting files suspected to originate from the NSA since last August.

Security experts say Friday's disclosure is probably another blow to the U.S. spy agency. The Shadow Brokers have also warned they have more files to release. </s> Microsoft researchers were working late into the hours the Friday before this holiday weekend looking to address yesterday’s Shadow Brokers dump of Windows exploits. In a message sent to TechCrunch overnight, the company said it has addressed the issue for systems running Windows 7 and later.

“We’ve investigated and confirmed that the exploits disclosed by the Shadow Brokers have already been addressed by previous updates to our supported products,” the company wrote. “Customers with up-to-date software are already protected.”

Microsoft also issued a blog post on the subject, noting that, as the company worked to verify the exploits, it discovered that nine were already been addressed by previously issued patches. Microsoft Security Response Center, naturally, recommends that users keep their machines up to date to ensure that they’re protected.

There are three additional exploits not addressed by the aforementioned patches, though MS notes that they’re not capable of reproducing on machines running Windows 7 and above or recent versions of Exchange. Of course, that leave potential vulnerability for users still clinging to older versions of the operating system, as they’re no longer supported.

Once again, Microsoft’s response would no doubt be: upgrade to ensure you’re protected.

The dump was the first from Shadow Brokers in several months. The exploits were believe to have originated from the National Security Agency as part of its work to monitor money flow in the SWIFT interbank messaging system. The NSA has been roundly criticized for not warning companies sooner that the tools had leaked, though it has yet to address any potential connection to the leak.

And indeed, in a separate statement Microsoft confirmed the Agency hadn’t revealed potential vulnerabilities prior to yesterday’s mad dash to address the leaked exploits. “At this time,” said the spokesperson, “other than reporters, no individual or organization has contacted us in relation to the materials released by Shadow Brokers.” </s> FRANKFURT/SAN FRANCISCO (Reuters) - Security researchers on Wednesday disclosed a set of security flaws that they said could let hackers steal sensitive information from nearly every modern computing device containing chips from Intel Corp, Advanced Micro Devices Inc and ARM Holdings.

One of the bugs is specific to Intel but another affects laptops, desktop computers, smartphones, tablets and internet servers alike. Intel and ARM insisted that the issue was not a design flaw, but it will require users to download a patch and update their operating system to fix.

“Phones, PCs, everything are going to have some impact, but it’ll vary from product to product,” Intel CEO Brian Krzanich said in an interview with CNBC Wednesday afternoon.

Researchers with Alphabet Inc’s Google Project Zero, in conjunction with academic and industry researchers from several countries, discovered two flaws.

The first, called Meltdown, affects Intel chips and lets hackers bypass the hardware barrier between applications run by users and the computer’s memory, potentially letting hackers read a computer’s memory and steal passwords. The second, called Spectre, affects chips from Intel, AMD and ARM and lets hackers potentially trick otherwise error-free applications into giving up secret information.

The researchers said Apple Inc and Microsoft Corp had patches ready for users for desktop computers affected by Meltdown. Microsoft declined to comment and Apple did not immediately return requests for comment.

Daniel Gruss, one of the researchers at Graz University of Technology who discovered Meltdown, called it “probably one of the worst CPU bugs ever found” in an interview with Reuters.

Gruss said Meltdown was the more serious problem in the short term but could be decisively stopped with software patches. Spectre, the broader bug that applies to nearly all computing devices, is harder for hackers to take advantage of but less easily patched and will be a bigger problem in the long term, he said.

Speaking on CNBC, Intel’s Krzanich said Google researchers told Intel of the flaws “a while ago” and that Intel had been testing fixes that device makers who use its chips will push out next week. Before the problems became public, Google on its blog said Intel and others planned to disclose the issues on Jan. 9. Google said it informed the affected companies about the “Spectre” flaw on June 1, 2017 and reported the “Meltdown” flaw after the first flaw but before July 28, 2017.

The flaws were first reported by tech publication The Register. It also reported that the updates to fix the problems could causes Intel chips to operate 5 percent to 30 percent more slowly. (bit.ly/2CsRxkj)

Related Coverage Factbox: What you need to do about newly discovered computer chip flaws

Intel denied that the patches would bog down computers based on Intel chips.

“Intel has begun providing software and firmware updates to mitigate these exploits,” Intel said in a statement. “Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.”

ARM spokesman Phil Hughes said that patches had already been shared with the companies’ partners, which include many smartphone manufacturers.

“This method only works if a certain type of malicious code is already running on a device and could at worst result in small pieces of data being accessed from privileged memory,” Hughes said in an email.

AMD chips are also affected by at least one variant of a set of security flaws but that it can be patched with a software update. The company said it believes there “is near zero risk to AMD products at this time.”

Google said in a blog post that Android phones running the latest security updates are protected, as are its own Nexus and Pixel phones with the latest security updates. Gmail users do not need to take any additional action to protect themselves, but users of its Chromebooks, Chrome web browser and many of its Google Cloud services will need to install updates.

Amazon Web Services, a cloud computing service used by businesses, said that most of its internet servers were already patched and the rest were in the process of being patched.

The defect affects the so-called kernel memory on Intel x86 processor chips manufactured over the past decade, The Register reported citing unnamed programmers, allowing users of normal applications to discern the layout or content of protected areas on the chips.

That could make it possible for hackers to exploit other security bugs or, worse, expose secure information such as passwords, thus compromising individual computers or even entire server networks.

Dan Guido, chief executive of cyber security consulting firm Trail of Bits, said that businesses should quickly move to update vulnerable systems, saying he expects hackers to quickly develop code they can use to launch attacks that exploit the vulnerabilities. “Exploits for these bugs will be added to hacker’s standard toolkits,” said Guido.

FILE PHOTO: Intel's logo is pictured during preparations at the CeBit computer fair, which will open its doors to the public on March 20, at the fairground in Hanover, Germany, March 19, 2017. REUTERS/Fabian Bimmer/File Photo

Shares in Intel were down by 3.4 percent following the report but nudged back up 1.2 percent to $44.70 in after-hours trading while shares in AMD were up 1 percent to $11.77, shedding many of the gains they had made earlier in the day when reports suggested its chips were not affected.

It was not immediately clear whether Intel would face any significant financial liability arising from the reported flaw.

“The current Intel problem, if true, would likely not require CPU replacement in our opinion. However the situation is fluid,” Hans Mosesmann of Rosenblatt Securities in New York said in a note, adding it could hurt the company’s reputation. </s> Big tech is stepping in to patch newly disclosed security flaws affecting almost every Intel chip since 2011.

Researchers on Tuesday released details of the vulnerability, known as ZombieLoad — or microarchitectural data sampling (MDS) as its technical name — which can leak sensitive data stored in the processor, such as passwords, secret keys and account tokens and private messages.

You can read our coverage here. In short, don’t panic — but you should patch your systems. Here’s how.

Apple released macOS fixes

Apple has fixes out for every Mac and MacBook released during and after 2011.

The tech giant said in an advisory that any system running macOS Mojave 10.14.5, released Monday, is patched. This will prevent an attack from being run through Safari and other apps. Most users won’t experience any decline in performance. But some Macs could face up to a 40% performance hit for those who opt-in to the full set of mitigations.

The security update will also be pushed to Sierra and High Sierra versions. iPhones, iPads and Apple Watch devices aren’t affected by the bugs.

Google patches Android, will update Chrome

The search and browser maker also confirmed it has released patches to mitigate against ZombieLoad.

Google said the “vast majority” of Android devices aren’t affected but Intel-only devices will need to be patched once device makers make updates available.

Chrome OS devices, such as Chromebooks, are already protected in the latest version, and permanent mitigations will be pushed to devices in the next version.

And, the company’s Chrome team has a technical advisory out, but said users should rely on patches for their computer. “Operating system vendors may release updates to improve isolation, so users should ensure they install any updates and follow any additional guidance from their operating system vendor,” said Google. In other words, make sure your Windows PC or your Mac is patched.

Google also rolled out patches to its data centers, so cloud customers are already patched, but should be aware of the company’s guidance.

Mozilla plans long-term Firefox fix

Firefox browser maker Mozilla said it’s got a long-term fix on the way.

“Firefox has applied the mitigation recommended by Apple on macOS,” said a Mozilla spokesperson. “The macOS mitigation will be part of our upcoming Firefox release (67) and Extended Support Release update (60.7), both scheduled for May 21.”

“Firefox Beta and Firefox Nightly already include the change,” the spokesperson said, adding that no action was recommended for browsers on Windows and Linux.

Microsoft rolls out Windows updates

Microsoft has released patches for its operating system and cloud.

Jeff Jones, a senior director at Microsoft, said the software and cloud giant has been “working closely with affected chip manufacturers to develop and test mitigations” for its customers. “We are working to deploy mitigations to cloud services and release security updates to protect Windows customers against vulnerabilities affecting supported hardware chips,” he said.

In a TechNet article, the company said customers may need to obtain directly from their device maker microcode updates for their processor. Microsoft is pushing many of the microcode updates itself through Windows Update, but they are also available from its website.

Software updates will be released Tuesday also through Windows Update. Microsoft also has a page with guidance for how to protect against the new attacks.

Microsoft Azure customers are already protected, the company said.

Amazon patches AWS

A spokesperson for Amazon has confirmed its cloud service Amazon Web Services has been updated to prevent attacks.

“AWS has designed and implemented its infrastructure with protections against these types of bugs, and has also deployed additional protections for MDS,” said an advisory posted on Amazon’s website. “All EC2 host infrastructure has been updated with these new protections, and no customer action is required at the infrastructure level.”

Updated article and headline to include remarks from Amazon and Mozilla.

Read more: </s> Microsoft has started blocking Windows 7 and Windows 8.1 updates for computers running certain new chipsets.

The company announced plans last January to block next-generation Intel, AMD and Qualcomm processors from system updates on older versions of Windows, but didn't reveal when support would be cut.

The process appears to have just kicked off.

Social media users are reporting that Microsoft is now blocking access to Windows 7 and 8.1 updates on devices running Intel's Kaby Lake processor.

Instead of the normal download screen, users attempting to update their systems are facing an error message reading, “Your PC uses a processor that is designed for the latest version of Windows.

"Because the processor is not supported together with the Windows version that you are currently using, your system will miss important security updates."

Microsoft has tried to justify the move by saying that the processors offer new capabilities that makes compatibility with older systems difficult, but it's also being seen as yet another aggressive technique designed to migrate more customers to Windows 10.

Changes to Microsoft's policy have also created plenty of confusion.

Skylake processors were included in the original policy announcement, but Microsoft has back-pedalled now says that some devices running the chipset will continue to receive Windows 7 and 8.1 updates, while others won't.

Machines running Ryzen, Kaby Lake and other new processors will have to upgrade to Windows 10.

Microsoft has released a Windows lifecycle fact sheet to clarify the situation.

“Without Microsoft support, you will no longer receive security updates that can help protect your PC from harmful viruses, spyware, and other malicious software that can steal your personal information,” it reads.

In other words, users need to upgrade to Windows 10 or knowingly expose themselves to cybercriminals.

According to NetMarketShare, almost half of all computer users are still on Windows 7, which came out in 2009.

Earlier this month, Microsoft cut support for Window Vista, widely considered the worst version of the operating system ever made. </s> With the release of latest firmware update, Microsoft officially ended the software support for the company's 2006 series Vista OS from this month.

This does not surprise many, as Mozilla Firefox and Google, last year had actually announced to end support for their respective apps -- browser and Gmail -- running on Microsoft's decade-old Vista OS, in late 2017.

Also read: All you need to know about Microsoft Windows 10 Creators Update

What will happen when Microsoft ends support for Windows Vista OS?

End of support means Microsoft is no longer obligated to provide automatic fixes, updates, or online technical assistance.

That's not all. Without Microsoft support, you will no longer receive security updates that can help protect your PC from harmful viruses, spyware, and other malicious software that can steal your personal information.

If you are still using Windows Vista on your PC, it is advisable to move on to the next version Windows 7 (Service Pack 1) or leap jump to the latest Windows 10 to avoid disruption in PC operation.

Will you upgrade to Windows 7 or go for Windows 10?

To help you make the decision easy, we have grouped all the information related to Microsoft Windows OS versions' mainstream and extended support timeline.

Windows 7*: Support for Windows 7 RTM (without service packs) ended on April 9, 2013. You have to upgrade to Service Pack 1.

For those unaware, 'end of mainstream support' means that users are no longer eligible to claim any warranty and Microsoft will no longer accept any request for change in UI design and new features. It will also not provide any non-security fixes unless the OS version has extended support.

As far as the 'end of extended support' is concerned, Microsoft will completely end all the assistance to the software. Be it a glitch or emergence security loophole, you cannot claim for fix from Microsoft, similar to what just happened to the Windows Vista.

Considering the fact that Windows 7's end of support is less than three years away and Windows 8 series has an unappealing user-interface, we recommend Windows Vista users to swiftly move to the latest Windows 10 series, as Microsoft guarantees technical assistance, including security patches till 2025. On top of that, it also supports all the latest Xbox compatible games as well.

Also read: Microsoft Windows 10: The 10 things you need to know about Microsofts new operating system </s> Users of old Windows systems can now download a patch to protect them from this week’s massive ransomware attack.

In a rare step, Microsoft published a patch for Windows XP, Windows Server 2003 and Windows 8 -- all of them operating systems for which it no longer provides mainstream support.

Users can download and find more information about the patches in Microsoft’s blog post about Friday’s attack from the WannaCry ransomware.

The ransomware, which has spread globally, has been infecting computers by exploiting a Windows vulnerability involving the Server Message Block protocol, a file-sharing feature.

Computers infected with WannaCry will have their data encrypted, and display a ransom note demanding $300 or $600 in bitcoin to free the files.

Fortunately, Windows 10 customers were not targeted in Friday’s attack. In March, Microsoft patched the vulnerability that the ransomware exploits -- but only for newer Windows systems. That’s left older Windows machines, or those users who failed to patch newer machines, vulnerable to Friday’s attack.

The ransomware was initially found spreading through attachments in email phishing campaigns. In certain cases, the scam emails pretended to represent a bank alert about a money transfer, according to Cisco’s Talos security group.

Users can protect themselves by being careful about such emails, Microsoft said. The company’s free antivirus software Windows Defender, along with other third-party security products from those including Kaspersky Lab and Avast, will also detect and remove the threat.

Once a vulnerable PC becomes infected, the computer will attempt to spread to other machines over the local network as well as over the internet. The ransomware will specifically scan for unpatched machines that have the Server Message Block vulnerability exposed.

Businesses can prevent this by disabling the Server Message Block protocol in vulnerable PCs. They can also use a firewall to block unrecognized internet traffic from accessing the networking ports the Server Message Block uses.

Fortunately, Friday’s ransomware attack may have been contained. A security researcher who goes by the name MalwareTech has activated a sort of kill-switch in WannaCry that stops it from spreading.

As a result, over 100,000 new infections were prevented, according to U.K.’s National Cyber Security Centre. But experts also warn that WannaCry’s developers may be working on other versions that won’t be easy to disable.

“It's very important everyone understands that all they (the hackers) need to do is change some code and start again. Patch your systems now!” MalwareTech tweeted.

Unfortunately, the kill-switch’s activation will provide no relief to existing victims. The ransomware will persist on systems already infected.

Friday’s ransomware attack appears to have spread mainly in Europe and Asia, with Russia among those nations hardest hit, according to security researchers.

Security experts are advising victims to wait before paying the ransom. It's possible that researchers will develop a free solution that can remove the infection. </s> This is really bad, in about an hour or so any attacker can download simple toolkit to hack into Microsoft based computers around the globe. — Hacker Fantastic (@hackerfantastic) April 14, 2017 WINDOWS 10 does not appear impacted by ETERNALBLUE or ETERNAL exploit series in my lab test. — Hacker Fantastic (@hackerfantastic) April 14, 2017

Releasing this information ahead of a holiday weekend may make it harder for Microsoft and IT workers to respond, as anyone with bad intentions now has access to a number of previously unknown exploits. As security researchers like Matthew Hickey (aka @hackerfantastic) scan through tools with names like ETERNALBLUE (a remote exploit for XP and above) and FUZZBUNCH (a framework that helps control use of the other attacks), Marcy Wheeler notes that the NSA has known these tools were out there since January, when The Shadow Brokers listed them for sale.

Lost in Translation — Steemit https://t.co/OH5UexWJsG enjoy! — theshadowbrokers (@shadowbrokerss) April 14, 2017

For now, the response from a Microsoft spokesperson is that "We are reviewing the report and will take the necessary actions to protect our customers."

So what is there to do if you're not a network admin and just use a Windows computer, whether at work or at home? In a quote to Motherboard, one hacker said to have formerly worked for the Department of Defense says plainly that "It's not safe to run an internet-facing Windows box right now."

Of course, your PC is -- or should be -- behind a router/firewall. I spoke to Travis Smith, a Senior Security Research Engineer at Tripwire, and he explained that for the tools released, they largely rely on local network protocols that attackers use to move from one compromised PC to others across a network. As he put it "even if you aren't running the latest greatest operating system and you don't have antivirus, if your Windows laptop isn't plugged directly into the internet, then your risk profile greatly diminishes." If you do have an antivirus, like Microsoft's Windows Defender, or products from McAfee, Kaspersky and the like, they should update quickly to recognize these executables now that they're known.

Contacted via email, Matthew Hickey expressed a similar outlook, saying that "most home users will not be directly impacted by these vulnerabilities as an attacker needs to connect to services on their computer. The risk is much bigger to enterprise and businesses who rely on these services to connect online."

Now that these 0days are public, disabling SMB might work as a workaround security patch on #Windows https://t.co/m13iFZdVTF #EquationGroup — x0rz (@x0rz) April 14, 2017 @GossiTheDog You are people, Kev!



Worth noting that every version of Windows since Vista has SMB server svc blocked inbound by firewall by default also — Ned Pyle (@NerdPyle) April 14, 2017 For folks at home, this isn't a big deal. Install the Windows Updates when Windows Update says "install me!". But you should do that anyway. — Pwn All The Things (@pwnallthethings) April 14, 2017 @JukesSitus No SMB, no remote desktop, and not sure if that's enough. These should not be reachable from Internet, but could rip through institutions. — Nicholas Weaver (@ncweaver) April 14, 2017

Here is a video showing ETERNALBLUE being used to compromise a Windows 2008 R2 SP1 x64 host in under 120 seconds with FUZZBUNCH #0day ;-) pic.twitter.com/I9aUF530fU — Hacker Fantastic (@hackerfantastic) April 14, 2017

No matter what software you're running though, making sure you're up to date with the latest patches will be one of the best things you can do to defend yourself. Also, as Travis explains, it's possible the code could eventually be modified to attack newer systems including Windows 10 and Windows Server 2016, but that will likely take more than a couple of days. Even if remote exploits or a worm don't arise from the use of these tools, now that they're out in the wild they could still be delivered by the web, email or even a USB stick. Matthew closed out his email by noting that "Microsoft will need to release fixes for several of the ETERNAL exploits and customers should ensure they apply them as soon as available."
The release also includes programs targeting Microsoft Windows operating systems. Microsoft announces that it had already fixed most (but not all) of these exploits.