If you’re running an older version of Windows, it’s vital to update it as soon as possible. Microsoft has warned about a critical security issue called BlueKeep which makes older Windows machines vulnerable to malware.
The vulnerability is technically known as CVE-2019-0708, and is found in Remote Desktop Services. It is a particular concern because the vulnerability is “wormable,” meaning that if a computer is infected through this vulnerability, it can pass on the malware to other computers. This is what allowed the WannaCry malware to spread so quickly and so far in 2017.
The vulnerable systems include those running Windows 7, Windows Server 2008 R2, and Windows Server 2008. If, for some unknown reason, you are running an even older version of Windows, like Windows 2003 or Windows XP, then your system is vulnerable too. (And now is a good time to remind you that you really ought to update to Windows 10.)
If you are running Windows 8 or Windows 10 then you needn’t worry, as the vulnerability won’t affect you.
If you’re wondering how many people are still running these old versions of Windows, you’d be surprised. Microsoft shared a recent report which estimates that nearly one million internet-connected computers are vulnerable, and there could be many more vulnerable computers on corporate networks as well.
“It only takes one vulnerable computer connected to the internet to provide a potential gateway into these corporate networks, where advanced malware could spread, infecting computers across the enterprise,” Simon Pope, Director of Incident Response at Microsoft Security Response Center wrote in a blog post. “This scenario could be even worse for those who have not kept their internal systems updated with the latest fixes, as any future malware may also attempt further exploitation of vulnerabilities that have already been fixed.”
The fix for the vulnerability was released on May 14, so users may not have updated yet. And although Microsoft says they have not yet detected a worm making use of this vulnerability, there is still a considerable risk that one could appear.
To further encourage users to update, Microsoft pointed out that two months passed between the release of a fix for the EternalBlue vulnerability and the time at which WannaCry and other ransomware attacks using it began. That attack caused chaos around the world, so it’s a good reminder of the importance of regularly updating your OS.