The ‘Eternal Darkness’ flaw in Windows 10, also known as SMBGhost, is now on the radar of the United States Department of Homeland Security. The serious flaw is assigned CVE-2020-0796, and if exploited, it could create a way for malware to infect all Windows 10 computers in its path.
Eternal Darkness aka SMBGhost rings a warning bell
As scary as it sounds, the SMBGhost vulnerability has caught the attention of the US Homeland Security, and Windows 10 users are now advised to download and install the relevant patch in order to mitigate its impact.
Microsoft issued a patch to fix the ‘SMBGhost’ vulnerability in March this year. If exploited, its impact could be highly severe for PC users, particularly those running the Windows 10 OS.
Learning from past mistakes
Although Microsoft disclosed and provided updates for this vulnerability in March 2020, malicious cyber actors are targeting unpatched systems with the new PoC, according to recent open-source reports. CISA strongly recommends using a firewall to block SMB ports from the internet and to apply patches to critical- and high-severity vulnerabilities as soon as possible.
Security researchers call it a wormable exploit. If gone unpatched today, this dangerous vulnerability can cause even bigger trouble in the days to come, and for US federal agencies, this possibility is no less than a nightmare. Even though Microsoft issued a patch in March, it doesn’t mean the danger has passed.
This is why security researchers still skeptical
Well, Microsoft issued a patch to fix the ‘EternalDarkness’ flaw at a time when there was no known exploit for the vulnerability. However, the situation is no longer the same.
Since then, multiple teams claim to have developed a method to exploit the SMBGhost bug, which essentially what prompted the US government’s Cybersecurity & Infrastructure Security Agency (CISA) to issue a warning about this vulnerability. This is also the reason why you must update your Windows 10 today!
In related news, Microsoft has issued a patch for more than 125 security vulnerabilities affecting its products.
