- WannaCry (or WannaCrypt, WanaCrypt0r 2.0, Wanna Decryptor) is a ransomware program targeting the Microsoft Windows operating system. On Friday, 12 May 2017 ...
- The Wanna Cry ransomware attack - one of the largest ever cyber attacks - appeared to be slowing around 24 hours after it wrecked havoc and shut down tens of ...
WannaCry ransomware attackFrom Wikipedia, the free encyclopedia
It has been requested that the title of this article be changed. Please see the relevant discussion on the discussion page. Do not move the page until the discussion has reached consensus for the change and is closed. This article documents a current event. Information may change rapidly as the event progresses, and initial news reports may be unreliable. The last updates to this article may not reflect the most current information. (May 2017) (Learn how and when to remove this template message) WannaCry ransomware attackScreenshot of the ransom note left on an infected system Date 12 May 2017–present Location Worldwide Also known as WannaCrypt, WanaCrypt0r. WCRY Type Cyber-attack Theme Ransomware encrypting hard disk with $300 – $1200 demand Cause EternalBlue exploit Outcome Over 200,000 victims and more than 230,000 computers infected
The attack affected Telefónica and several other large companies in Spain, as well as parts of Britain's National Health Service (NHS), FedEx, Deutsche Bahn, and LATAM Airlines. Other targets in at least 99 countries were also reported to have been attacked around the same time.
Like previous ransomware, the attack spreads by phishing emails, but also uses the EternalBlue exploit developed by the U.S. National Security Agency (NSA) to spread through a network which has not installed recent security updates to directly infect any exposed systems. A "critical" patch had been issued by Microsoft on 14 March 2017 to remove the underlying vulnerability for supported systems, but many organizations had not yet applied it.
Those still running exposed older, unsupported operating systems were initially at particular risk, such as Windows XP and Windows Server 2003, but Microsoft has now taken the unusual step of releasing updates for these.
Shortly after the attack began, a web security researcher known by his Twitter account MalwareTech, found an effective kill switch which slowed the spread of infection, but new versions have now been detected that lack the kill switch.
BackgroundThe purported infection vector, EternalBlue, was released by the hacker group The Shadow Brokers on 14 April 2017, along with other tools apparently leaked from Equation Group, believed to be part of the United States National Security Agency.
EternalBlue exploits vulnerability MS17-010 in Microsoft's implementation of the Server Message Block (SMB) protocol. Microsoft had released a "Critical" advisory, along with an update patch to plug the vulnerability a month before, on 14 March 2017. This patch fixed several client versions of the Microsoft Windows operating system, including Windows Vista onwards (with the exception of Windows 8), as well as server and embedded versions such as Windows Server 2008 onwards and Windows Embedded POSReady 2009 respectively, but not the older Windows XP, according to Microsoft. According to Dona Sarkar, head of the Windows Insider Program at Microsoft, Windows 10 was not affected; however, IT writer Woody Leonhard questioned if this is the case with all Windows 10 systems, or just builds 14393.953 and later.
Starting from 21 April 2017, security researchers started reporting that computers with the DoublePulsar backdoor installed were in the tens of thousands. By 25 April, reports estimated the number of infected computers to be up to several hundred thousands, with numbers increasing exponentially every day. Apparently DoublePulsar was used alongside EternalBlue in the attack.
The Windows vulnerability is not a zero-day flaw, but one for which Microsoft had made available a security patch on 14 March 2017, nearly two months before the attack. The patch was to the Server Message Block (SMB) protocol used by Windows. Organizations that lacked this security patch were affected for this reason, although there is so far no evidence that any were specifically targeted by the ransomware developers. Initially, any organization still running the older Windows XP was at particularly high risk because no security patches had been released since April 2014. However, after the outbreak, Microsoft released a security patch for Windows XP on 13 May 2017, the day after the attack launched.
According to Wired, affected systems will also have had the DoublePulsar backdoor installed; this will also need to be removed when systems are decrypted.
Ken Collins of Quartz wrote on May 12 that three or more hardcoded bitcoin addresses, or "wallets", are used to receive the payments of victims. As with all such wallets, their transactions and balances are publicly accessible even though the wallet owners remain unknown. To track the ransom payments in real time, a Twitterbot that watches each of the three wallets has been set up. As of 15 May 2017 at 11 AM, a total of 214 payments totaling nearly $56,000 had been transferred.
VariantOn May 14, two additional variants were released by the malware authors. One of these variants had a new kill switch which was quickly registered, while the other had no kill switch but had a corrupted payload preventing encryption of files.
ImpactThe ransomware campaign was unprecedented in scale according to Europol. The attack affected many National Health Service hospitals in England and Scotland, and up to 70,000 devices – including computers, MRI scanners, blood-storage refrigerators and theatre equipment – may have been affected. On 12 May, some NHS services had to turn away non-critical emergencies, and some ambulances were diverted. In 2016, thousands of computers in 42 separate NHS trusts in England were reported to be still running Windows XP. NHS hospitals in Wales and Northern Ireland were unaffected by the attack.
Nissan Motor Manufacturing UK in Tyne and Wear, England halted production after the ransomware infected some of their systems. Renault also stopped production at several sites in an attempt to stop the spread of the ransomware.
The attack's impact could have been much worse had an anonymous security expert, who was independently researching the malware, not discovered that a kill-switch had been built in by its creators.
Cybersecurity expert Ori Eisen from AdTruth said that the attack appears to be "low-level" stuff, given the ransom demands of $300 and states that the same thing could be done to crucial infrastructure, like nuclear power plants, dams or railway systems.
List of affected organizations
- São Paulo Court of Justice
- Lakeridge Health
- Public Security Bureau
- Sun Yat-sen University
- Instituto Nacional de Salud
- Deutsche Bahn
- Telenor Hungary
- Andhra Pradesh Police
- Dharmais Hospital
- Harapan Kita Hospital
- University of Milano-Bicocca
- Portugal Telecom
- Automobile Dacia
- Ministry of Foreign Affairs
- Ministry of Internal Affairs of the Russian Federation
- Russian Railways
- LATAM Airlines Group
- Faculty Hospital, Nitra
- Banco Bilbao Vizcaya Argentaria
- Timrå kommun
- Garena Blade and Soul
- National Health Service
- NHS Scotland
- Nissan Motor Manufacturing UK
- Saudi Telecom Company
- CJ CGV
- Government of Kerala
- Government of West Bengal
Defensive responseSeveral hours after the initial release of the ransomware on 12 May 2017, a researcher who blogs under the name MalwareTech discovered what amounted to be a "kill switch" hardcoded in the malware while trying to establish the size of the attack. Registering a domain name for a DNS sinkhole stopped the attack spreading as a worm. While this did not help already infected systems, it severely slowed the spread of the initial infection and gave time for defensive measures to be deployed worldwide, particularly in North America and Asia, which had not been attacked to the same extent as elsewhere. Analysis of the kill switch suggested that it may in fact be a bug in the malware whose code was originally intended to make the attack harder to analyse. However, the kill switch domain needs to be available locally, and the response must be able to reach the malware to effectively work. Some network configurations may prevent the kill switch from working.
Microsoft released a statement recommending users install update MS17-010 to protect themselves against the attack. The update was originally released in March 2017. In an unusual move, the company also created security patches for several now-unsupported versions of Windows, including Windows XP, Windows 8 and Windows Server 2003.
ReactionsSeveral experts highlighted the NSA's non-disclosure of the underlying vulnerability, and their loss of control over the EternalBlue attack tool that exploited it. Edward Snowden said that if the NSA had "privately disclosed the flaw used to attack hospitals when they found it, not when they lost it, [the attack] may not have happened". British cybersecurity expert Graham Cluley also sees "some culpability on the part of the U.S. intelligence services". According to him and others "they could have done something ages ago to get this problem fixed, and they didn't do it". He also said that despite obvious uses for such tools to spy on people of interest, they have a duty to protect their countries' citizens.
Others commented that this attack shows that the practice of intelligence agencies to stockpile exploits for offensive purposes rather than disclosing them for defensive purposes may be problematic. Microsoft president Brad Smith wrote, "Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage. An equivalent scenario with conventional weapons would be the U.S. military having some of its Tomahawk missiles stolen."
Richard Jameson from IT Security firm InfoTech Legal confirms that this is not a targeted attack on the NHS, all organisations are at risk, the NHS is just an ill prepared high profile victim.
Arne Schönbohm, President of Germany's Federal Office for Information Security (BSI) stated that "the current attacks show how vulnerable our digital society is. It's a wake up call for companies to finally take IT-security [seriously]".
Adam Segal, director of the digital and cyberspace policy program at the Council on Foreign Relations stated that "the patching and updating systems are broken, basically, in the private sector and in government agencies" and noted that "there's no assurance that even if the government reveals a vulnerability people are going to move quickly enough to make and apply the patch". In addition, Segal said that governments' apparent inability to secure vulnerabilities "opens a lot of questions about backdoors and access to encryption that the government argues it needs from the private sector for security".
According to James Scott from the Institute of Critical Infrastructure Technology, ransomware emerged "as an epidemic" in 2016, with the healthcare sector being particularly vulnerable. He stated that "the staff have no cyber-hygiene training, they click on phishing links all the time. The sad thing is they weren't backing up their data properly either, so that's a big problem. They should be doing that all the time." He also noted that "you're only as strong as your weakest link within your organisation from a cyber-perspective". To the contrary, healthcare insiders contend Microsoft is viewed upon, internally, as just another a sick patient insensitive to anyone's needs but their own, and because healthcare is ETL intensive, that software updates infrequently neuter their macros and interfere with their applications, causing system tools and complex overlapping algorithms malfunction, that their reluctance to software updates is well founded, and they are quite correct in admonishing their IT professionals to adopt a conservative approach, leaving well enough alone, foregoing updates when their automation seems to function just right.
British Prime Minister Theresa May said of the ransomware, "This is not targeted at the NHS. It is an international attack. A number of countries and organizations have been affected." However, writing in The Guardian, technology expert Charles Arthur said that the effects of the hack were exacerbated by Conservative Party under-funding of the NHS as part of the government's austerity measures, in particular the Department of Health's refusal to pay extra to Microsoft to keep protecting outdated Windows XP systems from such attacks. Home secretary Amber Rudd refused to say whether patient data had been backed up, and shadow health secretary Jon Ashworth accused health secretary Jeremy Hunt of refusing to act on a critical note from Microsoft two months previously, as other warnings from the National Cyber Security Centre (NCSC) and National Crime Agency. On 14 May 2017 the NCSC updated its latest guidance on dealing with ransomware attacks.
In the attack some see a dramatic demonstration of the value of having good, secure backups and good cyber-security including having the latest security patches installed.
- "Ransomware attack still looms in Australia as Government warns WannaCry threat not over". Australian Broadcasting Corporation. Retrieved 15 May 2017.
- Coughlin, Tom. "WannaCry Ransomware Demonstrations The Value of Better Security and Backups". Forbes. Retrieved 14 May 2017.
One NHS worker, who asked to remain anonymous, said the attack began at about 12.30 pm and appeared to have been the result of phishing. 'The computers were affected after someone opened an email attachment.'