x
A U.K.-based cyber researcher known as MalwareTech stopped the WannaCry ransomware that gained control of thousands of computers worldwide, forcing victims to pay $300 in bitcoin to restore their files.
WannaCry was able to exploit a Windows vulnerability leaked in April and use a hacking tool believed to be stolen from the National Security Agency (NSA).
The ransomware spread across 75,000 PCs, including 48 hospitals in the U.K.
Accidental Fix
MalwareTech discovered an unregistered domain name in WannaCry and purchased it for $10.69. Armed with the tool, the researcher pointed the domain to a sinkhole (a server that finds and analyzes malware traffic). The domain turned out to be a kill switch that enables someone to gain control of the ransomware.
The domain was intended to be unregistered, the MalwareTech noted. By registering it, subsequent actions were prevented.
The domain is a “sandbox” feature where security tools test code in a secluded environment on a PC. The address where MalwareTech registered his or her domain was pinged to all infected PCs, not just the sandboxed PCs.
The domain was meant as an “anti-sandbox” measure they didn’t think through sufficiently, MalwareTech said.
Cisco Talos and other security firms confirmed the malware attack ended thanks to MalwareTech’s actions. Computers already infected, however, could still be at risk.
Shadow Brokers Behind The Hack?
Talos said the malware was leaked by the Shadow Brokers, a hacking group believed to have dumped NSA hacking tools.
Talos said the hackers will try to install WannaCry by means of a backdoor called DoublePulsar leaked by Shadow Brokers. If the backdoor was not embedded on a target Windows PC, it would try to exploit a flaw in the Microsoft OS Server Message Block, which is a network file sharing protocol.
Victims have been told not to pay the $300 ransom.
Microsoft and anti-virus providers have introduced WannaCry detections.
Microsoft issued an advisory that it is releasing a patch for Windows XPs that are out of support and its recommending companies disable the SMBv1 protocol.
Up-to-date Windows machines are safe from the ransomware.
Rob Wainwright, head of Europol, Europe’s chief law enforcement official, told the media he is concerned the numbers of victims could grow when people turn on their machines Monday morning.
A researcher at Proofpoint, Darien Huss, first discovered MalwareTech’s sinkhole was stopping the spread of the malware.
Huss agreed that the actors involved are amateurs based on the kill switch deployment. He said it is likely another attack will be coming soon.
Nearly $53k in bitcoin ransoms paid with WannaCry
Other Ransomware Versions Can Pose Risks
MalwareTech noted on Twitter that Version 1 was stoppable but Version 2 will likely remove the flaw.
The researcher claimed on Twitter to be providing the National Cyber Security Centre in the U.K. data to notify infected companies.
On Monday, MalwareTech advised people via Twitter they are at risk if they turn on a system without the MS 17-010 patch and TCP port 445 open.
MalwareTech, who did not reveal their gender, did not wish to be celebrated as a hero for stemming the spread of the malware. MalWareTech noted on Twitter that he or she wanted anonymity in order not to have to deal with journalists.
David Ogden
Entrepreneur
By Lester Coleman
