The WannaCry Ransomware Attack: A Comprehensive Study Guide

Overview of the WannaCry Ransomware Attack

  • In May of 2017, a global cyber attack known as "WannaCry" (short for WannaCrypter) impacted over 150150 countries.
  • The attack affected approximately 230,000230,000 computers globally, making it one of the most widespread and significant ransomware attacks in history.
  • Security experts described WannaCry as one of the worst pieces of malware ever seen due to its speed and propagating capabilities.
  • The attack did not discriminate, hitting small to medium-sized businesses, large enterprises, railways, healthcare, banks, malls, police, energy companies, and Internet Service Providers (ISPs).

Detailed Attack Timeline (May 12, 2017)

  • 7:44 AM UTC: The first identified case originated from a Southeast Asian ISP.
  • Next Hour: Cases were detected in Latin America, followed by Continental Europe and the United Kingdom.
  • Subsequent Hours: Infections spread to Brazil and Argentinian ISPs.
  • 12:39 PM UTC: 74%74\% of all ISPs in Asia were affected.
  • 3:28 PM UTC: The ransomware had taken hold of 65%65\% of Latin American ISPs.
  • By the end of the first day, the ransomware was encountered in 7474 countries across thousands of organizations.

Technical Fundamentals of Ransomware

  • Definition: Ransomware is a type of malware that runs an encryption process on a victim's computer, typically in less than a minute.
  • Phishing: While often spread through phishing (emails tricking users into clicking links or downloading attachments containing malicious code), WannaCry did not originate from a phishing attack.
  • Encryption Process: The malware converts "Plain Text" into "Ciphertext."   - Plain Text: Readable or comprehensible data.   - Ciphertext: Unintelligible gibberish produced by encryption.
  • Decryption Key: A unique key needed to turn ciphertext back into plain text. Attackers promise to provide this key upon payment of a ransom.
  • RSA Algorithm: Common encryption algorithms like RSA are so robust that breaking them with current technology would take millions to trillions of years.

The WannaCry User Experience and Ransom Demands

  • Victims were presented with an intimidating wallpaper and a program called "Wana Decryptor 2.0."
  • Everyday productivity and multimedia files (documents, spreadsheets, images, videos, music) were encrypted and held "hostage."
  • Instructional Set: Included instructions in 2828 different languages.
  • Payment Terms:   - Initial demand: 300300 USD worth of Bitcoin.   - After 33 days: The ransom increased to 600600 USD.   - Seven days post-infection: Files would theoretically become unrecoverable.   - Attackers claimed they would return files for free to "users who are so poor that they couldn't pay" after six months.
  • Method of Payment: Bitcoin was chosen because it is a private cryptocurrency. While money can be traced to a cryptocurrency wallet (a digital storage for the currency), finding the owner is exponentially difficult without extensive forensic analysis.

Origins: The Equation Group and Shadow Brokers

  • August 2016: A group called "Shadow Brokers" claimed to have hacked the "Equation Group," a sophisticated cyber attack group suspected of having ties to the National Security Agency (NSA) Tailored Access Operations unit.
  • Stolen Assets: Use of "Nation-State Attacks," which are exploits or hacking tools developed by a country to be used as weapons against other states.
  • NSA Involvement: The NSA reportedly discovered vulnerabilities in the Windows Operating System as early as 20132013 but stockpiled them for weaponization rather than reporting them to Microsoft.
  • The Leak: On April 14, 2017, the Shadow Brokers posted a tweet linking to a Steem blockchain post titled "Lost in Translation." This was their fifth and most damaging leak, containing tools from a previous failed auction released for free.

The Weapon: EternalBlue and DoublePulsar

  • Server Message Block Version 1 (SMB v1): A network communication protocol developed in 19831983 allowing Windows computers to share files and printers. It utilized Port 445445.
  • EternalBlue: An infamous exploit that took advantage of a critical vulnerability in SMB v1, allowing for "Remote Arbitrary Code Execution."
  • DoublePulsar: A tool leaked by the NSA that installs a "Backdoor," an entry point into a system or network that allows hackers easy access later.
  • CVE-2017-0144: The official log ID in the National Vulnerability Database for the vulnerability EternalBlue exploited.
  • MS17-010: The critical security patch released by Microsoft on March 14, 2017, two months before the attack, to fix the SMB v1 vulnerability.

Propagation and the "Kill Switch"

  • Mechanism: Once a computer was infected via the backdoor and the WannaCry payload delivered, the malware would scan the network for Port 445445. If open, it used the worm-like component to spread to vulnerable devices without any user interaction (no clicking or downloading required).
  • The Domain Check: When WannaCry infected a system, it attempted to connect to an unregistered, hard-coded domain consisting of a random string of numbers and letters.
  • The Kill Switch Logic:   - If the infection cannot connect to the domain: Proceed with encryption.   - If the infection can connect to the domain: Stop the attack (kill itself).
  • Marcus Hutchins (MalwareTech): A 2323-year-old British security researcher at Kryptos Logic. While reverse-engineering a sample of the malware, he discovered the domain and registered it for $10.69\$10.69.
  • Accidental Hero: Registration of the domain caused a worldwide pause in the infection. Hutchins later stated this was unintended; he registered it to track and analyze the malware's spread.
  • Kill Switch Theories: It may have been a way for attackers to stop the attack if it got out of hand, or more likely, it was meant to detect a "Sandbox" (a contained virtual environment used by researchers). If the malware detected a sandbox (which often simulates successful connections to any domain), it would terminate to prevent analysis.

Aftermath and the DDoS Attack

  • Within an hour of the domain activation, attackers launched a Distributed Denial of Service (DDoS) attack using the "Mirai botnet" to shut down the domain.
  • Mirai Botnet: A group of hundreds of thousands of hijacked devices used to flood a domain with junk traffic.
  • Resolution: Hutchins and his team prevented the domain from going offline by using a cached version of the site capable of handling much higher traffic loads.
  • Result: Data showed that the kill switch halted over 2,000,0002,000,000 potential infections.

Marcus Hutchins' Legal Ordeal

  • In August 2017, Hutchins was arrested by the FBI at an airport after attending the DEF CON hacker convention in Las Vegas.
  • Charges: He was accused of creating and selling a banking malware called "Kronos" in his teenage years.
  • Plea Deal: In April 2019, he pleaded guilty to two counts: conspiracy to defraud the United States and actively marketing the Kronos malware.
  • Sentencing: Despite a potential 1010-year sentence, the judge cited his contribution to stopping WannaCry and his defensive work. He was released with zero jail time.

Global Impact and Statistics

  • Severely Affected Countries: Russia (most infected, with over half of affected computers), India, Ukraine, and Taiwan.
  • National Health Service (NHS) Impact:   - Over 70,00070,000 devices affected (computers, MRI scanners, blood testing devices, theater equipment).   - Cost to the NHS: Over 92 million92\,million Euros.
  • Global Financial Cost: Estimated between $4 billion\$4\,billion and $8 billion\$8\,billion USD.
  • Ransom Profits: Despite the massive scale, attackers only made approximately $130,634.77\$130,634.77 USD as of June 14, 2017.
  • Victim Data: Less than 50%50\% of those who paid received their data back. Most victims were running unpatched versions of Windows 77 (98%98\%), while less than 0.1%0.1\% were on Windows XP.

Future Outlook and Cybersecurity Strategy

  • Variants: Variants like "UIWix" surfaced without a kill switch and with improved payment tracking, though they lacked the automatic worm functionality.
  • Ongoing Threats: EternalBlue remains active; a large number of organizations still have not patched against the SMB v1 vulnerability.
  • Attribution: No confirmed identity of the creators exists, though some suspect the "Lazarus Group" (linked to North Korea).
  • Projections:   - In 2021, a company was hit by ransomware every 1111 seconds.   - Ransomware costs were expected to top $20 billion\$20\,billion by late 2021.   - By 2025, cybercrime is estimated to cost businesses $10.5 trillion\$10.5\,trillion annually.
  • Defense Recommendations:   - Maintain a consistent update schedule for all devices.   - Avoid outdated operating systems at "end of support."   - Perform frequent data backups (the most crucial defense against ransomware).   - Do not pay the ransom, as it does not guarantee data return and encourages further crime.