# MA-654.042017: MyCERT Alert - Microsoft Addresses Shadow Brokers Exploits

**Date:** 19 Apr 2017  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-654.042017  
**Advisory ID:** MA-654.042017

---

**1.0 Introduction**
Recently, an attacker group known as The Shadow Brokers, publicly released a large number of exploit tools targeting Microsoft Windows.
The Microsoft Security Response Center (MSRC) has published information on several recently publicised exploit tools, which affected various Microsoft products.
**2.0 Impact**
Exploitation of these vulnerabilities could potentially allow a remote attacker to take control of the affected system. Users and administrators are reminded that software no longer supported by Microsoft (also known as end-of-life (EOL) software) is particularly at risk for exploitation. Most of the exploits are already patched in Microsoft’s supported products.
For more information on EOL Microsoft products, kindly refer to below URL:
• Microsoft Ending Support for Windows XP and Office 2003, <https://www.us-cert.gov/ncas/alerts/TA14-069A-0>
• Microsoft Ending Support for Windows Server 2003, <https://www.us-cert.gov/ncas/alerts/TA14-310A>
• Microsoft Ending Support for Windows Vista, <https://www.mycert.org.my/portal/advisory?id=MA-651.032017>
**3.0 Affected Products**
• Microsoft End-of-Life (EOL) products
• Microsoft Windows 7, 2008, 8 and 2012
**4.0 Recommendation**
MyCERT recommends retiring all the EOL products. Users and administrators may any necessary updates by reviewing the information published by Microsoft Security Response Center (MSRC) are per below URL:
• <https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#3f5c465d5a4d0606067f5c465d5a4d4c5a5c4a4d564b46115246) or [[email protected]](/cdn-cgi/l/email-protection#c9a4b0aaacbbbd89a4b0aaacbbbde7a6bbaee7a4b0) â€¨
Phone: 1-300-88-2999 (monitored during business hours)â€¨
Fax : +603 89453442 â€¨
Mobile: +60 19 2665850 (24x7 call incident reporting)
â€¨SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888â€¨
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYTâ€¨
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
• <https://www.us-cert.gov/ncas/current-activity/2017/04/15/Microsoft-Addresses-Shadow-Brokers-Exploits-0>
• <https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/>
• <https://threatpost.com/shadowbrokers-windows-zero-days-already-patched/125009/>
• <https://blog.comae.io/the-nsa-compromised-swift-network-50ec3000b195>
• <https://blog.qualys.com/securitylabs/2017/04/15/the-shadow-brokers-release-zero-day-exploit-tools>