EXHIBIT 0005 — ETERNALBLUE

Somebody at Microsoft spent a year asking people to turn it off.

SMBv1 is how Windows machines shared files with each other, and it was designed at IBM in the early 1980s, for offices where every computer on the network was assumed to be friendly. By 2016 the protocol was about thirty years old and still switched on by default almost everywhere.

In September 2016 a Microsoft engineer published a post titled, with no particular subtlety, "Stop using SMB1." He owned the protocol. Enterprises did what enterprises do with advice that involves touching a working file server.

What nobody outside a government agency knew was that a weaponised exploit for it already existed. EternalBlue reaches a Windows machine over port 445, sends a deliberately malformed file-sharing request, and takes control of the kernel. No credentials. No user. Nobody clicks anything.

On 14 March 2017, Microsoft patched it as MS17-010. A month later, on 14 April, a group called the Shadow Brokers published the exploit on the open internet — meaning the patch existed before the public did. Somebody had been warned.

Eight weeks after that came WannaCry. Six weeks after that, NotPetya. Same door, different visitors.

The details

EternalBlue is an exploit, not malware. It encrypts nothing, demands nothing, and destroys nothing on its own. It opens a door and stands aside — and what walked through it changed month to month: cryptocurrency miners in April, ransomware in May, a wiper in June. This is the distinction most write-ups get wrong.

MS17-010 covered six vulnerabilities, CVE-2017-0143 through CVE-2017-0148. EternalBlue is usually pinned to 0144. It shipped alongside a backdoor implant called DoublePulsar, which is what actually stayed behind.

Microsoft's president wrote it up two days after WannaCry: "An equivalent scenario with conventional weapons would be the U.S. military having some of its Tomahawk missiles stolen."

Windows finally stopped shipping SMBv1 by default in autumn 2017. Thirteen months after the blog post asking nicely, and after both outbreaks.

Fit & print

- Gildan Softstyle® 64000, 100% ring-spun cotton in solid colors

- 4.5 oz/yd² (153 g/m²)

- Classic fit, crew neck, ribbed-knit collar

- Twill-tape reinforced shoulders, no side seams

- Pearlized tear-away label

- OEKO-TEX® STANDARD 100 certified (Certificate No. 168252, OETI)

- Cotton sourced under the US Cotton Trust Protocol

Heather colors are 35% cotton / 65% polyester. Sport Grey and Antique are 90% cotton / 10% polyester. Graphite Heather is 50/50. The White variant reads off-white rather than bright white — a property of the fabric, not the print.

Read the full technical breakdown in the archive.