On 12th May 2017, the biggest cyber attack of recent times has happened and the threat is still present. Started from Europe and within a couple of hours has grown into a worldwide virus. The crisis has been caused by the WannaCry ransomware and its variants. The virus locks the infected computer and informs the users with a message onscreen. They can only continue to use the PC after paying $300 or $600 in BitCoins. According to the experts, the device used during the attack was developed by the renown Shadow Brokers hacker group.
The ransomware might have been combined with the Eternal Blue, which was developed by the NSA and later was stolen, as a result, the WannaCry is able to spread independently. It is able to initiate remote code execution in Windows.
According to the experts of Avast Security, Russia, Ukraine, and Taiwan were the main targets of the massive attack, although the biggest IT systems affected were in the property of the English and Scottish National Health Service. Concrete data was not shared by the NHS Digital, who is responsible for the IT systems, they only hinted that ”several” institutes are affected.
Moreover, there is no evidence of data loss. However, due to the attack the Medical Institutes, the program has been modified, they had to interrupt their normal workflow, for instance, they postponed operations and stopped tests. Where it was necessary and in the case of urgent tasks, they analyzed and processed data manually.
The attack affected the Spanish Telefónica, the machines of the German Deutsche Bahn Railway company, the Hungarian Telenor among others. Fortunately, they noticed the attack just in time, so stopped their systems and no serious damage was caused.
A 22-year-old Brit IT specialist accidentally found out how to stop the ransomware. He realized that for the further expantion of the virus along domain address has to stay inactive. According to The Register, this is the: iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com domain.
So he registered it and the pace of the expantion started to gradually decrease. Darien Huss, a security specialist from Proofpoint, argued it is possible that this option was built into the virus intentionally, so when the creators feel like it, they can stop the event anytime.
You can track the spreading of the WannaCry.
The vulnerability has been discovered by the American National Security Agency aka The Big Brother and other than discovering it, they wanted to exploit it too for their own purposes. After this came the previously mentioned Shadow Brokers group who stole it from the NSA. They wanted to sell it at the Black Market on an online auction. However, later they decided to make it available to everyone free of charge. On the 8th of April, as a protest against Donald Trump, the newly elected president of the USA, they revealed the password needed for the decryption. Many cyber security experts said that the virus is outdated, thus it is not harmful.
“An exploit for MS17-010 written in Python with example shellcode. This is based on the Eternal Blue tool stolen from the NSA, and was developed by infosec biz RiskSense. It reveals that the SMB server bug is the result of a buffer overflow in Microsoft’s code. A 32-bit length is subtracted into a 16-bit length, allowing an attacker to inject more data than they should into the networking service and ultimately hijacking the system. Disabling SMBv1 disables the bug, and is recommended in any case. You should also firewall off SMB ports 139 and 445 from the outside world, and restrict access to the service where possible on internal networks.” via TBG Security.
(The picture by arstechnica.com)
Security experts, – in order to follow-up on the ransoms -, created a Twitter account called „actual_ransom”. Here – thanks to a bot- you can watch live as the money flows into the WannCry’s bitcoin purse. Until Tuesday, there have been, 229 successful payments which is around 61,881,24 USD. Paying in BitCoin is not as easy as for example paying on AliExpress, this could be one of the reasons, why there have been these few payments so far.
What do you think of this global problem? Do you have your own theory? Share with us. 🙂
Start the 7-day free trial with full functionality without spending a cent.
After the “Hello, Peppa!” zero-day botnet, our Attack Vector Miner detected another zero-day...
At the end of the last year, we made...