> series: anatomy_of_a_breach —— part: 100 —— exploit: eternalblue —— cve: 2017-0144 —— patch: ms17-010 —— countdown: 28_days_to_wannacry<span class="cursor-blink">_</span>_
On 14 April 2017, the Shadow Brokers released their most consequential dump: a collection of NSA exploitation tools including EternalBlue — an exploit targeting a critical vulnerability (CVE-2017-0144) in Microsoft's Server Message Block (SMB) protocol, present in every version of Windows from XP to Server 2008 R2. EternalBlue enabled unauthenticated remote code execution on any vulnerable Windows system accessible via SMB — effectively a skeleton key for Windows networks.
Crucially, Microsoft had released security bulletin MS17-010 on 14 March 2017 — exactly one month before the Shadow Brokers release — patching the EternalBlue vulnerability. The timing strongly suggested that the NSA had warned Microsoft of the impending leak, giving the company time to develop and release a patch. But one month was not enough: millions of Windows systems worldwide — including vast numbers of NHS computers running Windows XP and Windows 7 — had not applied the patch. The fuse was lit. WannaCry would detonate it in 28 days.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallMS17-010 was available for 59 days before WannaCry struck — nearly two months. Yet millions of systems remained unpatched, including thousands within the NHS. The reasons were familiar: legacy systems running unsupported Windows XP, organisations with slow patching cycles, and the persistent gap between 'patch available' and 'patch applied' that has defined every patching-related breach in this series.
EternalBlue is the single most important case study for why patching matters. The vulnerability was known. The patch was available. The exploit was public. And 59 days later, organisations that had not patched were devastated. Cyber Essentials Danzell's 14-day patching mandate, MFA auto-fail criterion, and requirement to remove unsupported software exist because of moments exactly like this one.
Our vulnerability scanning identifies missing patches. Infrastructure testing verifies that critical services are not exposed. SOC in a Box monitors for exploitation attempts. And UK Cyber Defence provides the incident response capability for when an exploit arrives before the patch.
<a href="/cyber-essentials">Cyber Essentials</a> mandates 14-day patching. <a href="/vulnerability-scanning">Vulnerability scanning</a> identifies what needs patching. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors for exploitation. Because the next EternalBlue is not a question of if — it is a question of when.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call