Episode
21 January 2020 Official episode · Official transcript
incident response
The episode covers Microsoft’s discovery and emergency patching of the MS08-067 Windows vulnerability, its later exploitation by Conficker, and the role of crash telemetry, patching, and coordinated incident response.
Topics: Windows vulnerability discovery through crash telemetry, MS08-067 emergency patching and out-of-band disclosure, Remote code execution, Wormable vulnerabilities and internet propagation, Egg-hunt shellcode technique, Windows Error Reporting and crash-bucket analysis, Patch Tuesday and Windows Update at scale, Conficker propagation and global worm response, Patch reverse engineering and copycat exploit development, Metasploit exploitation of MS08-067, Coordinated vulnerability disclosure and vendor response
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Trustworthy Computing Group PART_OF Microsoft
The Trustworthy Computing Group was a Microsoft team created to improve the security, privacy, and reliability of Microsoft products.
Explicit Confidence 95% · John Lambert EP 57 Details
“I work at Microsoft.”
“a team called the Trustworthy Computing Group”
John Lambert MEMBER_OF Trustworthy Computing Group
John Lambert worked for ten years on Microsoft's Trustworthy Computing Group.
Explicit Confidence 98% · Jack Rhysider EP 57 Details
“he spent ten years working on a team called the Trustworthy Computing Group”
Microsoft Security Response Center PART_OF Microsoft
The Microsoft Security Response Center is described as a team within Microsoft responsible for making Windows secure and fixing bugs.
Explicit Confidence 98% · Jack Rhysider EP 57 Details
“MSRC is the Microsoft Security Response Center. This is the team of security professionals within Microsoft”
MS07-029 AFFECTS Windows DNS
MS07-029 corrected a vulnerability in Windows DNS.
Explicit Confidence 99% · Jack Rhysider EP 57 Details
“MS07-029 was a bulletin that corrected a vulnerability with Windows DNS”
MS08-067 was a vulnerability in Windows and affected every version of Windows available at that point.
Explicit Confidence 99% · John Lambert EP 57 Details
“it affected every version of Windows up until we had at that point”
MS08-067 AFFECTS Windows XP
The vulnerability was found in Windows XP and was present in fully updated Windows systems.
Explicit Confidence 98% · Jack Rhysider EP 57 Details
“While they found this in Windows XP, the vulnerability existed in more than just XP”
The MS08-067 exploit was used to exploit the MS08-067 vulnerability.
Explicit Confidence 99% · Jack Rhysider EP 57 Details
“run this exploit against it”
The exploit observed in the crash report used an egg-hunt technique to split the exploit into two parts.
Explicit Confidence 99% · John Lambert EP 57 Details
“It had a difference in it, what I call an egg hunt”
MS08-067 ASSOCIATED_WITH Remote Code Execution
The vulnerability allowed remote code execution: an attacker could execute commands on the victim's Windows computer.
Explicit Confidence 98% · Jack Rhysider EP 57 Details
“In the security world we call this kind of vulnerability an RCE which means you can do Remote Code Execution”
MS08-067 ASSOCIATED_WITH wormable
The vulnerability was wormable, meaning an exploit could propagate across the internet and repeat the attack on additional systems.
Explicit Confidence 99% · John Lambert EP 57 Details
“Wormable means that you have a vulnerability that an attacker can write an exploit for and it can propagate across the internet”
Andrew identified the previously unknown vulnerability after analyzing the crash report and related code.
Explicit Confidence 98% · John Lambert EP 57 Details
“He said I found a vulnerability”
MS08-067 DISCOVERED_BY John Lambert
John Lambert identified evidence of a new attack and unknown vulnerability in Windows through Windows Error Reporting crash data.
Explicit Confidence 93% · John Lambert EP 57 Details
“I clearly had enough evidence to say this was a new attack, a new vulnerability that we did not know about”
Conficker adopted the MS08-067 vulnerability as a spreading mechanism and used it against unpatched systems worldwide.
Explicit Confidence 99% · John Lambert EP 57 Details
“a Conficker worm that had been this sort of small-scale thing for a time, adopted this vulnerability as a spreading mechanism”
The Conficker outbreak involved the Conficker worm infecting millions of computers worldwide.
Explicit Confidence 99% · Jack Rhysider EP 57 Details
“Conficker spread rapidly worldwide, ultimately infecting computers in over 190 countries worldwide”
Conficker INVOLVES Microsoft Cabal
The Microsoft Cabal was formed to investigate and stop the Conficker outbreak.
Explicit Confidence 99% · Jack Rhysider EP 57 Details
“In February 2009, something called the Microsoft Cabal was formed”
Conficker INVOLVES Federal Bureau of Investigation
The FBI became involved in the hunt for the people running Conficker and received information from the organizations investigating it.
Explicit Confidence 99% · Jack Rhysider EP 57 Details
“The FBI started getting involved and the hunt began to look for whoever was running this worm”
Some Conficker variants were capable of running scareware, and the episode says it might have been preparing for such a campaign; this relationship is presented as uncertain.
Uncertain Confidence 82% · Jack Rhysider EP 57 Details
“there was evidence in some of the variants of Conficker that it was capable of running scareware, so it might have been getting ready to launch a big campaign”
Mark Bowden AUTHORED Worm
Mark Bowden authored the book Worm, which contains research about Conficker.
Explicit Confidence 99% · Jack Rhysider EP 57 Details
“The author Mark Bowden did some extraordinary research into this worm in his book which is just titled Worm”
Jack Rhysider REFERENCES Worm
Jack recommends the book Worm for more information about Conficker.
Explicit Confidence 99% · Jack Rhysider EP 57 Details
“if you want to know more about Conficker, check out the book Worm by Mark Bowden”
Metasploit USES MS08-067
Metasploit includes a pre-programmed MS08-067 exploit that can be run against a vulnerable Windows XP machine.
Explicit Confidence 99% · Jack Rhysider EP 57 Details
“You pick the MS08-067 exploit, then point at your Windows XP machine, type run, and boom. You’re in”
EternalBlue EXPLOITS MS17-010
EternalBlue was associated with a patch identified as MS17-010; the episode describes MS17-010 as the patch produced for EternalBlue.
Explicit Confidence 98% · John Lambert EP 57 Details
“A patch was produced for it; that was MS17-010”
WannaCry USES EternalBlue
WannaCry used EternalBlue in a similar worm-like spreading pattern against systems that had not patched.
Explicit Confidence 95% · John Lambert EP 57 Details
“A couple months later, the WannaCry worm was unleashed and spread in a very similar way”
EternalBlue ASSOCIATED_WITH Shadow Brokers
The Shadow Brokers group leaked the EternalBlue exploit onto the internet.
Explicit Confidence 99% · John Lambert EP 57 Details
“This is one of these NSA tools that the Shadow Brokers group leaked onto the internet”
EternalBlue ASSOCIATED_WITH National Security Agency
EternalBlue is described as an NSA tool; the episode attributes that characterization to John Lambert's account.
Attributed Confidence 94% · John Lambert EP 57 Details
“This is one of these NSA tools”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:15:01.732829+00:00