WannaCry cyber attack

Screenshot of the ransom note left on an infected system
Date	12 May 2017 (2017-05-12) (ongoing)
Location	Worldwide
Also known as	WannaCrypt, WanaCrypt0r
Type	Cyber-attack
Theme	Ransomware encrypting hard disk with $300 demand
Cause	EternalBlue exploit
Participants	Unknown
Outcome	More than 230,000 computers infected[1]
Status	Mostly under control[citation needed]

WannaCry^[2][a] is a ransomware program targeting Microsoft Windows. On Friday, 12 May 2017, a large cyber-attack using it was launched, infecting over 230,000 computers in 99 countries, demanding ransom payments in bitcoin in 28 languages.^[7] The attack spreads by multiple methods include phishing emails and on unpatched systems as a computer worm. The attack has been described by Europol as unprecedented in scale.^[8]

The attack affected Telefónica and several other large companies in Spain, as well as parts of Britain's National Health Service (NHS),^[9] FedEx and Deutsche Bahn.^[10][11][12] Other targets in at least 99 countries were also reported to have been attacked around the same time.^[13][14]

WannaCry is believed to use the EternalBlue exploit, which was developed by the U.S. National Security Agency (NSA)^[15][16] to attack computers running Microsoft Windows operating systems.^[5][17] Although a patch to remove the underlying vulnerability for supported systems had been issued on 14 March 2017,^[18] delays in applying security updates and lack of support by Microsoft of legacy versions of Windows left many users vulnerable.^[19] Due to the scale of the attack, to deal with the unsupported Windows systems, Microsoft has taken the unusual step of releasing updates for all older unsupported operating systems from Windows XP onwards.^[3][20]

Shortly after the attack began a researcher found an effective kill switch, which prevented many new infections. This greatly slowed the spread. However, it has been reported that subsequently new versions of the attack have been detected which lack the kill switch, thus able to spread to systems in which the vulnerability has not been patched.^[21]

Background

The purported infection vector, EternalBlue, was released by the hacker group The Shadow Brokers on 14 April 2017,^[22][23] along with other tools apparently leaked from Equation Group, which is believed to be part of the United States National Security Agency.^[24][25]

EternalBlue exploits vulnerability MS17-010^[18] in Microsoft's implementation of the Server Message Block (SMB) protocol. Microsoft had released a "Critical" advisory, along with an update patch to plug the vulnerability a month before, on 14 March 2017.^[18] This patch only fixed Windows Vista and later operating systems but not the older Windows XP.

Attack

On 12 May 2017, WannaCry began affecting computers worldwide.^[27] The initial infection is via an emailed web link or attachment.^{[citation needed]} If the recipient clicks this, the malware first checks the "kill switch" website. If it is not found, then the ransomware encrypts the computer's hard disk drive,^[28][29] then attempts to exploit the SMB vulnerability to spread out to random computers on the Internet,^[30] and "laterally" to computers on the same Local Area Network (LAN).^[31] As with other modern ransomware, the payload displays a message informing the user that files have been encrypted, and demands a payment of $300 in bitcoin within three days.

The Windows vulnerability is not a zero-day flaw, but one for which Microsoft had made available a security patch on 14 March 2017,^[18] nearly two months before the attack. The patch was to the Server Message Block (SMB) protocol used by Windows.^[32] Organizations that lacked this security patch were affected for this reason, although there is so far no evidence that any were specifically targeted by the ransomware developers.^[32] Any organization still running the older Windows XP^[33] were at particularly high risk because until 13 May,^[3] no security patches had been released since April 2014.^[34] Following the attack, Microsoft released a security patch for Windows XP.^[3]

According to Wired, affected systems will also have had the DOUBLEPULSAR backdoor installed; this will also need to be removed when systems are decrypted.^[35]

Impact

The ransomware campaign was unprecedented in scale according to Europol.^[8] The attack affected many National Health Service hospitals in the UK.^[36] On 12 May, some NHS services had to turn away non-critical emergencies, and some ambulances were diverted.^[10][37] In 2016, thousands of computers in 42 separate NHS trusts in England were reported to be still running Windows XP.^[33] Nissan Motor Manufacturing UK in Tyne and Wear, one of Europe's most productive car manufacturing plants, halted production after the ransomware infected some of their systems. Renault also stopped production at several sites in an attempt to stop the spread of the ransomware.^[38][39]

List of affected organizations

Defensive response

Antivirus companies have updated their software to prevent phishing attacks.

Several hours after the initial release of the ransomware on 12 May 2017, while trying to establish the size of the attack, a researcher accidentally discovered what amounted to be a "kill switch" hardcoded in the malware. Registering a domain name for a DNS sinkhole stopped the attack spreading as a worm. While this didn't help already infected systems, nor the spread by email, it slowed the spread of the initial infection and gave time for defensive measures to be deployed worldwide, particularly in the United States and Asia which hadn't been attacked much yet. Analysis of the kill switch suggested that it may in fact be a bug in the malware whose code was originally intended to make the attack harder to analyse. However, whatever the purpose of the switch, variants without the kill switch were detected the next day.^{[62][63][64][65][66]}

In an unusual move, Microsoft created security patches for several now-unsupported versions of Windows, including Windows XP, Windows 8 and Windows Server 2003.^[67]

Reactions

Upon learning about the impact on the NHS, Edward Snowden said that had the NSA "privately disclosed the flaw used to attack hospitals when they found it, not when they lost it, [the attack] may not have happened".^[68]

British Prime Minister Theresa May said of the ransomware, "This is not targeted at the NHS. It is an international attack. A number of countries and organizations have been affected."^[69] However, opposition^{[clarification needed]} and tech experts have said that the effects of the hack were exacerbated by Conservative underfunding of the NHS as part of the government's austerity measures, in particular the Department of Health's refusal to pay extra to Microsoft in order to keep protecting outdated Windows XP systems from such attacks.^[70] Home secretary Amber Rudd refused to say whether patient data had been backed up, and shadow health secretary Jonathan Ashworth accused health secretary Jeremy Hunt of refusing to act on a critical note from Microsoft two months previously, as other warnings from the National Cyber Security Centre and National Crime Agency.^[71]

See also

• Proactive cyber defence
• Security engineering
• Timeline of computer viruses and worms

Notes

References