Postmortem: WannaCry Ransomware Explained

WannaCry is a ransomware worm that spread rapidly through across a number of computer networks in May of 2017.

After infecting Windows computer, it encrypts files on the PC's hard drive, making them impossible for users to access, then demands a ransom payment in bitcoin in order to decrypt them.

A number of factors made the initial spread of WannaCry particularly noteworthy: it struck a number of important and high-profile systems, including many in Britain's National Health Service.

It also exploited a Windows vulnerability that was suspected to have been first discovered by the United States National Security Agency; and it was tentatively linked by Symantec and other security researchers to the Lazarus Group, a cybercrime organisation that may be connected to the North Korean government.

What is WannaCry Ransomware?

The WannaCry ransomware consists of multiple components. It arrives on the infected computer in the form of a dropper, a self-contained program that extracts the other application components embedded within itself.

Those components include:

  • An application that encrypts and decrypts data
  • Files containing encryption keys
  • A copy of Tor

The program code is not obfuscated and was relatively easy for security pros to analyze. Once launched, WannaCry tries to access a hard-coded URL (the so-called kill switch); if it can't, it proceeds to search for and encrypt files in a slew of important formats, ranging from Microsoft Office files to MP3s and MKVs, leaving them inaccessible to the user. It then displays a ransom notice, demanding $300 in Bitcoin to decrypt the files.

How does WannaCry infect PCs?

The attack vector for WannaCry is more interesting than the ransomware itself. The vulnerability WannaCry exploits lies in the Windows implementation of the Server Message Block (SMB) protocol. The SMB protocol helps various nodes on a network communicate, and Microsoft's implementation could be tricked by specially crafted packets into executing arbitrary code.

It is believed that the US National Security Agency discovered this vulnerability and, rather than reporting it to the infosec community, developed code to exploit it, called EternalBlue.

This exploit was in turn stolen by a hacking group known as the Shadow Brokers, who released it obfuscated in a seemingly political Medium post on April 8, 2017.

Microsoft itself had discovered the vulnerability a month prior and had released a patch, but many systems remained vulnerable, and WannaCry, which used EternalBlue to infect computers, began spreading rapidly on May 12. In the wake of the outbreak, Microsoft slammed the US government for not having shared its knowledge of the vulnerability sooner.

Even if a PC has been successfully infected, WannaCry won't necessarily begin encrypting files. That's because, as noted above, it first tries to access a very long, gibberish URL before going to work. If it can access that domain, WannaCry shuts itself down.

It's not entirely clear what the purpose of this functionality is. Some researchers believed this was supposed to be a means for the malware's creators to pull the plug on the attack. However, Marcus Hutchins, the British security researcher who discovered that WannaCry was attempting to contact this URL, believes it was meant to make analysis of the code more difficult.

Many researchers will run malware in a "sandbox" environment, from within which any URL or IP address will appear reachable; by hard-coding into WannaCry an attempt to contact a nonsense URL that wasn't actually expected to exist, its creators hoped to ensure that the malware wouldn't go through its paces for researchers to watch.

Hutchins not only discovered the hard-coded URL but paid $10.96 to register the domain and set up a site there, thus helping blunt, though not stop, the spread of the malware. Shortly after being hailed as a hero for this, Hutchins was arrested for supposedly developing different malware in 2014. He has proclaimed his innocence.

WannaCry Patch

Ironically, the patch needed to prevent WannaCry infections was actually available before the attack began: Microsoft Security Bulletin MS17-010, released on March 14, 2017, updated the Windows implementation of the SMB protocol to prevent infection via EternalBlue.

However, despite the fact that Microsoft had flagged the patch as critical, many systems were still unpatched as of May of 2017 when WannaCry began its rapid spread.

For those unpatched systems that are infected, there is little remedy beyond restoring files from a safe backup, so let that be a lesson that you should always back up your files. While those monitoring the bitcoin wallets identified in the extortion message say that some people are paying the ransom, there's little evidence that they're regaining access to their files.

WannaCry and Windows 10

As noted, Microsoft released a patch for the SMB vulnerability that WannaCry exploits two months before the attack began. While unpatched Windows 10 systems were vulnerable, the automatic update feature built into the OS meant that almost all Windows 10 systems were protected by May of 2017.

The Microsoft SMB patch was initially only available for currently supported versions of Windows, which notably excluded Windows XP.

There are still millions of internet-connected Windows XP systems out there, including at Britain's National Health Service, where many WannaCry attacks were reported, and Microsoft eventually made the SMB patch available for older versions of the OS as well.

However, a later analysis found that the vast majority of WannaCry infections struck machines running Windows 7, an operating system Microsoft does still support.

Symantec fingers the Lazarus Group

After the initial dust settled, various security researchers began working to try to figure out the origins of WannaCry. Symantec had a provocative take: they believed that the code might have a North Korean origin. They laid out the evidence in a blog post, where they discussed a little-known fact: that WannaCry had actually been circulating for months before it exploded across the Internet on May 12, 2017.

This earlier version of the malware, dubbed Ransom. Wannacry, used stolen credentials to launch targeted attacks, and there were "substantial commonalities in the tools, techniques and infrastructure used by the attackers” between this version of WannaCry and those used by the Lazarus Group.

The Lazarus Group in turn is a hacking group that has been tied to North Korea. Beginning their run in 2009 with crude DDoS attacks on South Korean government computers, they've become increasingly sophisticated, hacking Sony and pulling off bank heists.

On the other hand, without an explicit claim of responsibility, it's impossible to know for sure that either the initial wave of WannaCry attacks or the later EternalBlue-driven explosion was directed by North Korea, since malware code is copied liberally by various groups.

WannaCry News

While the initial furor of WannaCry developments have subsided as most computers receive the necessary patches, there are still new developments.

CSO

You Mighht Also Read:

WannaCry Drives Cyber Insurance:

Cyber Attacks Demonstrate  Why The Cloud Is Safer:

« Innovation in Cloud-Based Video Analytics
Facial Recognition Works on iPhone X. Sometimes. »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

City Security Magazine

City Security Magazine

City Security magazine helps promote best security practices and keep businesses informed on a wide variety of security-related issues.

Cyber Defense Media Group (CDMG)

Cyber Defense Media Group (CDMG)

CDMG is the leading global media group for all things cyber defense.

Arista Networks

Arista Networks

Arista Networks is an industry leader in data-driven, client to cloud networking for large data center, campus and routing environments.

RiskLens

RiskLens

RiskLens is a software company that specializes in the quantification of cybersecurity risk.

ISC2

ISC2

ISC2 is an international, non-profit membership association for information security leaders. Our information security certifications are recognized as the global standard for excellence.

Qufaro

Qufaro

Qufaro is a new initiative designed to make it simpler for those with career ambitions in cyber security to access the UK’s cyber-specific education and innovation opportunities.

Six Degrees

Six Degrees

Six Degrees is a leading secure, integrated cloud services provider. We protect UK organisations and help them thrive in the cloud by giving them secure platforms to innovate and grow.

Pentest People

Pentest People

Pentest People are a UK-based security consultancy focussing on bringing the benefits of Pentesting as a Service (PTaaS) to all its clients.

Ascend Technologies

Ascend Technologies

Ascend Technologies offers a full suite of managed IT services including: Cloud & Infrastructure Management, Cybersecurity Management, Service Desk Management, Application Management , Data Management

Securd

Securd

Securd takes opportunities away from your cyber adversaries. Cloud-delivered zero-trust DNS firewall and web filtering protection keep your business network and remote employees safe.

Norma Inc.

Norma Inc.

Norma provides the secured wireless environment (WiFi and Bluetooth) with the unauthorized AP detection, and secures your IoT assets from various threats.

Vectra AI

Vectra AI

Vectra threat detection & response - see and stop threats across hybrid and multi-cloud enterprises.

Drumz

Drumz

Drumz plc is an investment company whose investing policy is to invest principally but not exclusively in the technology sector within Europe.

PCI Security Standards Council (PCI SSC)

PCI Security Standards Council (PCI SSC)

The PCI Security Standards Council is a global forum that brings together payments industry stakeholders to develop and drive adoption of data security standards and resources for safe payments.

BreakPoint Labs

BreakPoint Labs

BreakPoint Labs is dedicated to providing the methods and means for sustainable, measurable, and effective cybersecurity operations.

AmiViz

AmiViz

AmiViz is the first B2B enterprise marketplace focussed on Cybersecurity business in the Middle East and Africa, designed specially to serve the interests of enterprise resellers and vendors.