Sen. Warner wants action on WannaCry patching from DHS, OMB

Democratic Sen. Mark Warner, of Virginia, has written to federal officials asking for details about how agencies patched their systems to protect them against the fast-spreading WannaCry ransomware.

Democratic Sen. Mark Warner has written to federal officials asking for details about how agencies patched their systems to protect them against the fast-spreading WannaCry ransomware.

White House homeland security adviser Thomas Bossert told reporters during the daily briefing Monday that no federal systems had been infected, but Warner noted in his letter that despite a National Institute of Standards and Technology recommendation that security-related software updates “be installed within a defined timeframe (in many cases seven to 30 days for critical patches),” the Government Accountability Office last year found “numerous instances where agencies failed to comply with those deadlines.”

Microsoft included a fix for the vulnerability in a regularly scheduled patch in mid-March. Over the weekend, the company took the unprecedented step of releasing a patch for several discontinued but still widely used software products, including Windows XP.

In the letter, released Monday afternoon, the Virginia senator asks Homeland Security Secretary John Kelly and Office of Management and Budget Director Mick Mulvaney what steps they took to ensure that the patch Microsoft issued in March was promptly applied to computer networks of federal agencies and their contractors.

A DHS official told CyberScoop that some federal agencies were able to use new capabilities under the government-wide Continuous Diagnostic and Monitoring, or CDM, program to scan their systems and identify any potentially vulnerable machines on their networks.

“A number of agencies are at a level of maturity with already with the CDM tool deployment that they are able to use those tools to look across their [IT] environment to see if they’re vulnerable, if they have the right patch in place,” said CDM Program Manager Kevin Cox.

He declined to specify which agencies, citing security concerns, but said for those that were able to use CDM, it was a huge time-saver.

“Rather than the agencies having to go out and manually determine which of their systems might be affected, they will be able to look out via the CDM tools … and make a determination pretty quickly as to whether they’re impacted and the extent of that impact,” he said.

“Already the value of the program is showing itself,” he concluded.

Warner notes in his letter that last year’s GAO report “also identified instances where agencies were using software no longer supported by its vendors” — like XP — meaning it would generally not be patched against newly discovered vulnerabilities.

Many hospitals in Britain’s National Health Service, for instance, were infected because they continue to use Windows XP. But, as Warner notes, expensive equipment like MRI or CAT scan devices “may have been designed with embedded software that is now end-of-life, meaning that one cannot upgrade component software, or the operating system, without replacing the entire machine.”

The situation appears to be “a major, long-term economic problem when costly, critical systems with double-digit expected lifespans are supported by software only expected to be supported for four or five years,” Warner wrote.

He went on to ask whether out-of-date software still being used by agencies had been patched with the updates made available at the weekend.

Warner concludes: “Has DHS worked with private sector critical infrastructure providers to assess the threat of the WannaCry ransomware (in its current form, and anticipating potential variants) posed to sensitive, life-critical, and/or critical systems?”

The senator asked for a response within two weeks.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure