NSA warns Microsoft Windows users of cyber-attack risk

The US National Security Agency (NSA) has warned Microsoft Windows users to make sure they are using updated systems to guard against cyber-attacks.

US officials and Microsoft executives say older versions of the programs may be vulnerable to malware.

In the advisory, NSA officials said a flaw known as “BlueKeep” exists in past editions of Microsoft Windows.

Last week Microsoft warned that “some older versions of Windows” could be vulnerable to cyber-attacks.

“All customers on affected operating systems [Windows 7 and earlier] should update as soon as possible,” said Microsoft.

US officials said the “BlueKeep” flaw could leave computers vulnerable to infection by viruses through automated attacks or by the downloading of malicious attachments.

They said ransomware can often be installed quickly, holding files hostage and demanding payment from individuals.

The vulnerability in the older versions of Microsoft Windows, wrote the International Computer Science Institute’s Nicholas Weaver, means that bad actors could “gain complete control of the remote system”.

Updating systems, as the Microsoft executives explained, helps to protect computer users from these kinds of cyber-attacks.

Recently a ransomware attack on the city of Baltimore disrupted municipal services, knocking city workers offline and making it harder for people to pay their traffic tickets and water bills.

The New York Times has reported that the NSA knew about the system flaw, EternalBlue, but kept it secret for years.

EternalBlue has been implicated in a range of cyber-attacks over the past three years, including the WannaCry assault that disrupted the UK’s NHS.

A senior NSA adviser, Rob Joyce, tweeted on his own account that some computer users could face a “significant risk” because of the vulnerabilities in the older versions of Microsoft Windows, but that they would be protected by updates.

The NSA issues advisories to private companies and to computer administrators on a regular basis.

But their warning about BlueKeep, along with Mr Joyce’s posting on social media and the attention the NSA advisory has received on social media, showed “the likely seriousness of the vulnerability”, says the Atlantic Council’s Christopher Porter.

Microsoft executives emphasised there has been no sign of danger from a new cyber-attack and that updating systems will protect the computer users from any threats.

The company executives also reminded customers that keeping “internal systems updated with the latest fixes” is crucial to keeping people and computers safe from malware.

Defending their reputation

By Tara McKelvey, BBC News

NSA analysts and directors have been in the spotlight lately because of the ransomware attack in Baltimore, and Rob Joyce’s tweet was part of their effort to show they are working hard to protect the US from future cyber-attacks.

He and officials at the NSA are trying to be more aggressive in their effort to inform the public, and in this way they are working to tamp down criticism of their agency.

In a more general sense, NSA officials have been under fire for not sharing important information about their activities with the public, and Mr Joyce is trying to change that image by communicating directly with Microsoft users on social media – and explaining to them the dangers they face.