[palmer]

Phishing and spear-phishing represent the majority of malicious exploit distributions around the world today. Despite being "shouted down" by other FReepers calling me a Microsoft fanboi, which I freely admit I am, Microsoft isn't the problem here. This is a user education issue.

No, that's not correct. The attacking software probes for SNMP v1 on listening computers and exploits the bug. There is no user involvement at all.

[palmer]

Sorry, that should say SMB v.1 not SNMP.

[rarestia]

SMB (over TCP 445) is not something most businesses have wide open to the Internet. There’s no evidence that the infection is spread through direct injection via SMB exposed to the Internet. The infection has to be introduced into an environment and can spread from there. If SMBv1 is available (and MS17-010 is not distributed), it makes lateral movement all that much easier.

There are 2 compromises here: SMBv1, addressed by MS17-010, and WannaCry(pt). WannaCry(pt) is your typical run-of-the-mill ransomware with logic built into it to look for SMBv1 to compromise. That’s new. Otherwise, the infection has to start by someone stupid enough to let it loose in an environment, and I stand by my original post.