Microsoft slams governments for "stockpiling" software vulnerabilities
Microsoft is criticizing government agencies for hoarding software flaws and keeping them secret, calling a massive, new ransomware attack a "wake-up call" to this problem.
Brad Smith, Microsoft's chief counsel, said Sunday in a company blog post that by keeping software vulnerabilities secret from vendors, governments open up users to attacks like Friday's WannaCry — or WannaCrypt/WanaCrypt — hack in which malware locked down computers worldwide while demanding hefty sums for freedom.
He also compared both WikiLeaks' release of CIA hacking tools in March and the stealing of a Microsoft Windows vulnerability from the National Security Agency last month to the theft of weapons from the U.S. military. The Windows vulnerability theft from the NSA is directly tied to WannaCry.
"An equivalent scenario with conventional weapons would be the U.S. military having some of its Tomahawk missiles stolen. And this most recent attack represents a completely unintended but disconcerting link between the two most serious forms of cybersecurity threats in the world today — nation-state action and organized criminal action," Smith said.
"The governments of the world should treat this attack as a wake-up call. We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits."
This isn't the first time U.S. spy agencies have been accused of knowing about vulnerabilities and keeping them secret. The NSA reportedly knew of the Heartbleed bug for at least two years in order to exploit it for intelligence gathering before the security vulnerability was revealed in 2014.
The WannaCry attack has hit thousands of computers across around the world, but hospitals in the U.K. have attracted the most attention because lives are at risk when hospital systems get locked down. As of Sunday morning, more than 100,000 organizations in at least 150 countries had been affected, according to Europol, the European Union's police agency.
Ransomware is malware that encrypts important files, essentially locking people out of their computers unless they pay up to prevent their entire system from being deleted. Attacks of this kind have spiked in the last year, jumping from 340,665 in 2015 to 463,841 in 2016, according to online security company Symantec. The health care industry has become a major target, with ransomware making up more than 70 percent of malware attacks against hospitals, pharmacies and insurance agencies.
Virtual reality 101: CNET tells you everything you need to know about VR.
Tech Enabled: CNET chronicles tech's role in providing new kinds of accessibility.
