Security Digest (May 2024)

• May 12, 2017 is a day that lives in infamy in the minds of System Administrators across the world. An estimated 300,000 PCs across 150 countries fell victim to WannaCry, a simultaneous ransomware attack that disrupted global health, banking, and food industries. Victims were met with the screen below on their PCs:

• The ransomware targeted vulnerable Windows devices Server Message Block (SMB) file-sharing protocol. In a cruel twist of fate, the exploited vulnerability (MS17-010) had actually been addressed in a Microsoft patch a month earlier.
• The ransom started at $300 if the victim paid within 6 hours, then it doubled to $600 for up to 3 days later. The ransomware threatened to delete the files completely if the ransom was unpaid within a week and included an ominous countdown timer to files being deleted.
• The WannaCry ransomware spread by searching affected networks for devices that accept traffic on TCP port 445, which indicates SMB is configured to run on the system. This is done by performing a port scan. After confirming the presence of SMB, the infected PC initiates an SMBv1 connection to the device. A buffer overflow is then used to take control of the system and install the ransomware.

Encryption Timeline:

• May 12, 7:44 AM UTC: First detections of WannaCry are reported in Asia.
• May 12, 3:03 PM UTC: Reverse engineering of the software found a peculiar ‘kill switch’ embedded in the encryptor software: a callout to an unregistered domain name. When executed, the WannaCry malware first checks the internet for the presence of a specific URL: ( iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com); if it is not found, then the ransomware encrypts the computer’s data. If it is found, the worm will delete itself. A quick-thinking engineer purchased and registered this domain for $10.69. This effectively halted the spread of WannaCry across the globe.
• May 14: A first variant of WannaCry appeared with a new and second kill switch. This kill switch URL was registered and activated by another technician on the same day.
• May 15: A second variant of WannaCry is reported in the wild. This kill switch URL is quickly discovered and registered by Check Point threat intelligence analysts.
• May 19: It is reported that hackers were trying to use a Mirai botnet variant to initiate a distributed denial-of-service (DDoS) attack on WannaCry’s kill switch domain with the intention of knocking it offline, initiating encryption on infected devices.
• May 22: Engineers protect the kill switch domain by implementing a cached version of the site to withstand DDoS attacks.

Damage and Unclear Origins:

• Records of ransomware payments through Bitcoin transactions total roughly $130,000 USD. Estimated damages exceed $8 Billion USD.
• WannaCry used what was originally the National Security Agency 0-day ETERNALBLUE and DOUBLEPULSAR exploits.
• EternalBlue was created by the NSA, which had spent years searching for potential vulnerabilities in Microsoft software. When the organization finally found a weakness in the SMBv1 protocol, the NSA developed EternalBlue to take advantage of that vulnerability.
• Instead of alerting Microsoft to the risks its users faced, the NSA used EternalBlue to aid in antiterrorism and counterintelligence operations for half a decade.
• In the summer of 2017, a malware group calling themselves the ShadowBrokers were able to infiltrate the NSA and steal EternalBlue.
• It is unclear how the ShadowBrokers may have gotten their hands on these NSA tools – conspiracy theories range from a contractor leak to Russian counter-espionage.
• More than half a decade later, WannaCry remains a constant reminder of the importance of patching and the potential dangers of withholding dangerous software exploits