Pierluigi Paganini July 01, 2017

The security researcher Elad Erez developed Eternal Blues, a free EternalBlue vulnerability scanner that could be used to assess networks.

Now systems administrators and hackers have a new free tool, dubbed Eternal Blues, to scan networks looking at computers vulnerable to the NSA EternalBlue exploit.

EternalBlue is one of the hacking tools that the ShadowBrokers hacker group stolen to the NSA-linked Equation Group. The ShadowBrokers group leaked online the EternalBlue tool in April this year, a few weeks later Microsoft released security updates to fix the flaw exploited by the NSA exploit.

In May, the security expert Miroslav Stampar, a member of the Croatian Government CERT, discovered a new worm, dubbed EternalRocks, that exploits the EternalBlue flaw in the SMB protocol to spread itself like the popular WannaCry ransomware.

Security experts discovered later another hacking tool dubbed EternalRocks, a malware that uses 7 NSA exploits and that leverages the EternalBlue flaw to spread itself like WannaCry ransomware.

The Eternal Blues tool was developed by the researcher Elad Erez, of course, it designed for testing purposes and not to identify networks to hack.

“Eternal Blues is a free EternalBlue vulnerability scanner. It helps finding the blind spots in your network, these endpoints that are still vulnerable to EternalBlue.” explained Elad Erez.

“Just hit the SCAN button and you will immediately start to get which of your computers are vulnerable and which aren’t. That’s it.”

Companies and organizations can scan their networks for computers vulnerable to the EternalBlue exploit.

The tool was developed spread awareness and allow not technical organizations to assess their networks.

“The majority of latest WannaCry, NoPetya (Petya, GoldenEye or whatever) victims, are not technical organizations and sometimes just small business who don’t have a security team, or even just an IT team to help them mitigate this. Running NMap, Metasploit (not to mention more commercial products) is something they will never do. I aimed to create a simple ‘one-button’ tool that tells you one thing and one thing only – which systems are vulnerable in your network.” added Erez.

Erez also published the following tips to the admins who will use the tool.

• If you’re about to run it in your working environment, please update the IT/Security team in advance. You don’t want to cause (IDS/IPS/AV) false alarms
• If vulnerable systems were found – please take a Windows update asap
• For god sake, please disable SMBv1 already. Whether your systems are patched or not. This protocol was written over 3 decades ago…!
• If you would like to enjoy the tool but disallow sending anonymous statistics (which is so uncool), disable access to my website

The developer informed users that his tool sends back to him anonymous usage statistics through Google Analytics.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Eternal Blues tool , EternalBlue)

[adrotate banner=”13″]