Slashdot Mirror
'Accidental Hero' Finds Kill Switch To Stop Wana Decrypt0r Ransomware (theguardian.com)
"An 'accidental hero' has halted the global spread of the WannaCry ransomware that has wreaked havoc on organizations..." writes The Guardian. An anonymous reader quotes their report:
A cybersecurity researcher tweeting as @malwaretechblog, with the help of Darien Huss from security firm Proofpoint, found and implemented a "kill switch" in the malicious software that was based on a cyber-weapon stolen from the NSA. The kill switch was hardcoded into the malware in case the creator wanted to stop it from spreading. This involved a very long nonsensical domain name that the malware makes a request to -- just as if it was looking up any website -- and if the request comes back and shows that the domain is live, the kill switch takes effect and the malware stops spreading. Of course, this relies on the creator of the malware registering the specific domain. In this case, the creator failed to do this. And @malwaretechblog did early Friday morning (Pacific Time), stopping the rapid proliferation of the ransomware.
You can read their first-person account of the discovery here, which insists that registering the domain "was not a whim. My job is to look for ways we can track and potentially stop botnets..." Friday they also tweeted a map from the New York Times showing that registering that domain provided more time for U.S. sites to patch their systems. And Friday night they added "IP addresses from our [DNS] sinkhole have been sent to FBI and ShadowServer so affected organizations should get a notification soon. Patch ASAP."
UPDATE: Slashdot reader Lauren Weinstein says some antivirus services (and firewalls incorporating their rules) are mistakenly blocking that site as a 'bad domain', which allows the malware to continue spreading. "Your systems MUST be able to access the domain above if this malware blocking trigger is to be effective, according to the current reports that I'm receiving!"
You can read their first-person account of the discovery here, which insists that registering the domain "was not a whim. My job is to look for ways we can track and potentially stop botnets..." Friday they also tweeted a map from the New York Times showing that registering that domain provided more time for U.S. sites to patch their systems. And Friday night they added "IP addresses from our [DNS] sinkhole have been sent to FBI and ShadowServer so affected organizations should get a notification soon. Patch ASAP."
UPDATE: Slashdot reader Lauren Weinstein says some antivirus services (and firewalls incorporating their rules) are mistakenly blocking that site as a 'bad domain', which allows the malware to continue spreading. "Your systems MUST be able to access the domain above if this malware blocking trigger is to be effective, according to the current reports that I'm receiving!"
I suppose pre-registering the domain would effectively be adding a signature admitting liability
Here is a factsheet: https://gist.github.com/slider23/bd617d0d376047c05d18980fde306840
The domain in question is "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com".
They are not as safe as people think..
For my education please - I mean step-by-step. I can see it's a phishing thing. I can see it could copy itself to SMB 1 shares. But...err...then what? How did it spread, or did it not spread and the impact is 'only' to the files visible on the original machine?
Reminds me an awful lot of the old I Love You virus, which was a vbs script and which copied itself to shares as well. This new one is more sophisticated obviously, but I was around for that particular piece of 'fun'.
We needed this to spread further, we needed a shock to the system so we change our security practices... all this "hero" did was ensure the next time this happens it will be even more devastating.
On the Oregon Cost born and raised, On the beach is where I spent most of my days
There's a good sumamry over at github.
Essentially, the malware looks for port 445 (SMB) on local computers and the internet. If you have this port open on the internet, and have older than Win10, and haven't updated with the Mar 2 patch, then you're vulnerable.
Note that WinXP has about 8% market share and cannot be patched. You can get infected from another machine on the local subnet as well.
Here is a good detailed description of how it works and what it does.
Note that the propagation has halted for now, however the virus also installs a rootkit on the user's machine. If the virus writer realizes that the domain has been taken, he could remotely change the hard-coded domain name on every currently-infected machine, thus restarting the propagation process.
And the malware author can easily take out the "kill switch" and spread the new "improved" version of the malware.
Block these TOR domains in your hosts file to paralyze WannaCry (can't talk to them for orders in the 1st place):
0.0.0.0 gx7ekbenv2riucmf.onion
0.0.0.0 57g7spgrzlojinas.onion
0.0.0.0 Xxlvbrloxvriy2c5.onion
0.0.0.0 76jdd2ir2embyv47.onion
0.0.0.0 cwwnhwhlz52maqm7.onion
0.0.0.0 sqjolphimrr7jqw6.onion
* Per https://securelist.com/blog/incidents/78351/wannacry-ransomware-used-in-widespread-attacks-all-over-the-world/
APK
P.S.=> For the best custom hosts file creator bar-none? APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ for protection vs. other threats online + for more speed, security, reliability & anonymity FOR LESS (yet doing more than ANY other SINGLE "so-called 'solution'" that's "Bolt on 'MoAr'" illogic-logic vs. using what you already have natively in hosts files)... apk
I beg to disagree, totally, despite of what she says.
Slashdot, fix the reply notifications... You won't get away with it...
A new version of WannaCry ransomware is on the loose!
This is a game of cat and mouse, so don't assume you have won.
Anons need not reply. Questions end with a question mark.
Will they ever contemplate the idea of rewriting completely that OS? It's about time.
Slashdot, fix the reply notifications... You won't get away with it...
IMO it has bought them some time until the attackers figure out another way to continue the attack. Even when the Wikileaks announced that it will work with the tech giants to fix the vulnerabilities but it does not seem to be the case, but it falls on the hands of organizations and people alike to keep their systems updated all the time. NHS has now been hit by ransomware twice in a row.
In the next malware it might be "delete everything" switch.
... does any network expose SMB to the outside world?
Can the EU and UK sue the US NSA for damages caused by the exploitation of their dangerous creation?
The "S" in NSA stands for "Security" -- but what happened here is the exact opposite of security, undoubtedly costing many actual lives (as people cannot go to particular hospitals, or have surgeries disrupted) and a huge amount of money, which could have been avoided if the NSA had instead helped SECURE the affected operating systems rather than developing a dangerous and effective software weapon which could be easily leaked and used by anyone on the planet to wreak havoc.
Simply put the time served should be no less than the time they cost the rest of the world. Your virus costs 10 million man hours to clean up, have fun with a 10 million man hour sentence.
Damn script kiddies, get off my LAN!
I am on Windows 7 Home Premium and have all the patches Windows Update offers me (including "Security Monthly Quality Rollup for Windows 7 for x64-based Systems" dated for May, April, March, January, December, November and October), am I patched?
Also, given how many exploits target these Microsoft networking protocols (NetBIOS, SMB etc) and given that I dont actually need to use these protocols for anything, is there a way to turn them off so they aren't exposed to the outside world?
Spread it evenly among all Microsoft employees and we should be set.
FTFY
The NSA might be morally obligated to clean up the mess others made, but only Microsoft is legally obligated to clean up their own mess. Heck, they won't even permit transfer of liability: you are licensing use of the software, not buying it.
No, IANAL
Damn script kiddies, get off my LAN!
That's appropriate. Younger people do not know what's a LAN!
Slashdot, fix the reply notifications... You won't get away with it...
I am also in two minds about this. Having it spread further could make more people realize that computer security is important, but due to the affected hospitals, people can die. This would probably be the first time that people die from a computer virus.
This infection via e-mail is a bit old now, no?
We just moved all e-mail traffic to the users' smartphone (or company phone if desired)
So if a phone is ever infected, we just replace it.
What is the url of the kill switch?
That sounds pejorative to me. Most discoveries involve accidents - just ask Alexander Fleming, Christopher Colombus, or Doctor Spencer Silver (post it notes).
Like all of these men, this HERO, was investigating something not fully understood, stumbled by accident on something interesting, REALIZED that it was interesting and worked hard to understand exactly what it was. The realization and hard work are not common, they make the difference between a real discovery and a random day.
This is no more accidental than 90% of scientific discoveries.
excitingthingstodo.blogspot.com
I see what you did there O.o
This brings up an interesting philosophical / moral issue. The release of this kind of source code, by Wikileaks and others, is literally giving military grade weapons to anyone with the modicum of technical knowledge required to wield it. Fortunately, in this case, the person setting it loose didn't have the technical aptitude (or couldn't even be bothered with) looking at the code and disabling or properly securing the "kill switch".
It makes me wonder if those responsible for releasing and distributing this tool to the public could be held responsible (at least in civil courts) for the damage caused by it.
Better known as 318230.
Have gnu, will travel.
See subject & https://news.slashdot.org/comments.pl?sid=9007355&threshold=-1&commentsort=0&mode=thread&pid=51969075/
APK
P.S.=> Even China realized hosts' value! Imitation = flattery http://www.theregister.co.uk/2017/04/26/boffins_supercharge_the_hosts_file_to_save_users_plagued_by_dns_outages/
See subject & Jaff https://tech.slashdot.org/comments.pl?sid=10604829&cid=54407133/ yesterday too, & methbot https://news.slashdot.org/comments.pl?sid=10020701&cid=53529963/ , Ransonware https://it.slashdot.org/comments.pl?sid=9982895&cid=53468617/ , DDoS malware https://it.slashdot.org/comments.pl?sid=9978265&threshold=-1&commentsort=0&mode=thread&pid=53461435/ , Steganos https://it.slashdot.org/comments.pl?sid=9963399&cid=53442477/ , Mirai botnet https://it.slashdot.org/comments.pl?sid=10009063&threshold=-1&commentsort=0&mode=thread&pid=53507971/ , Zeus Floki Bot https://it.slashdot.org/comments.pl?sid=9974489&cid=53452359/ , DNSChanger style router attacks https://it.slashdot.org/comments.pl?sid=10006549&cid=53505145/ + More router attacking malware for botnets https://it.slashdot.org/comments.pl?sid=9995967&cid=53488427/
APK
P.S\ => Enjoy
See subject: TOR.exe's just another networking exe that rides on the IP stack & hosts is part of that + a resolver (pre remote or local DNS & can be made to be higher still in order of operations).
APK
P.S.=> IF you can show me proof TOR.exe does its OWN resolutions bypassing the local system IP stack? I'll listen... apk
Most radiology scanner manufacturers require that the device be connected to the internet so that they can download system logs and troubleshoot problems. It is usually via a VPN. Some of the scanners that I know of have workstations as part of the device. The system is usually the physical scan device, an acquisition computer and a processing computer. They are configured so the technologist can be post processing one scan while another is being acquired. The national accreditation agencies require that radiology dosage reports be sent via the internet to be summarized and to help develop standard protocols. The data is anonamized before transmission.
In summary no one expects computers to be reliable it's all about cost. Even for the same manufacturer the MRI, CT and IR scanners may not be compatible. Usually the software development is outsourced. The device is FDA approved with a specific configuration. There are required directory exceptions for Anti-virus scans.
Sorry way too much information
Hosts work/do apply & I'll let /.'ers speak for my program: I'm going to continue using the Host File Engine. Your software is well written, functional. The Host File Engine performs exactly as promised by mmell
his hosts program is actually pretty good by xenotransplant
his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg
I've never tried to belittle (APK's) work, I've flat out said it's good by BronsCon
take a look at the APK hosts file engine by SuperKendall
APK is kinda right. I've tried his hosts file generating software. It works by bmo
I like your host file system by Karmashock
I find your hosts file admirable by vel-ex-tech
* My code's liked + recommended & hosted by Malwarebytes' hpHosts!
APK
P.S.=> ... & you'll like this post too (hosts stalls TONS of threats like this one https://it.slashdot.org/comments.pl?sid=10606355&cid=54410677/ ) ...apk
in order to save it?
Block these TOR domains in your hosts file to paralyze WannaCry (can't talk to them for orders in the 1st place):
0.0.0.0 gx7ekbenv2riucmf.onion
0.0.0.0 57g7spgrzlojinas.onion
0.0.0.0 Xxlvbrloxvriy2c5.onion
0.0.0.0 76jdd2ir2embyv47.onion
0.0.0.0 cwwnhwhlz52maqm7.onion
0.0.0.0 sqjolphimrr7jqw6.onion
* Per https://securelist.com/blog/incidents/78351/wannacry-ransomware-used-in-widespread-attacks-all-over-the-world/ [securelist.com]
APK
P.S.=> For the best custom hosts file creator bar-none? APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ for protection vs. other threats online + for more speed, security, reliability & anonymity FOR LESS (yet doing more than ANY other SINGLE "so-called 'solution'" that's "Bolt on 'MoAr'" illogic-logic vs. using what you already have natively in hosts files)... apk
uhh you realize last month this effected 90% of windows systems? new and old? microsoft decided that older versions of windows didnt matter anymore. even know in the 90's they convinced all kinds of Cat Scan and MRI makers to install windows XP or even worse windows SE on their machines for ease of use.. and now they refuse to give updates to people that paid $200,000-$5,000,000 for their computers. sounds like shitty business practice to me. Now i understand microsoft didnt sell the people the machines. but they did a damn good job of making sure their shitty OS was inside of them.
1.) When said CAT/MRI/CNC/'Whatevur' manufacturers decided to use XP for their equipment, they were well aware of the support lifecycle for the OS. If the support lifecycle of the OS was not enough to cover the lifecycle of the rest of the equipment, that's the manufacturer's mistake, not Microsoft's.
2.) Said lifecycle should have ended on 2011, instead, it lasted until 2014. Again, if the lifetime of the equipment connected with that computer exceeded this extended support lifetime of the OS, that's the manufacturer's mistake, not Microsoft's
3.) Many of those manufacturers (if they are still in business) are big enough to be able to negotiate a custom support agreement for said machines and therefore continue to receive patches from Microsoft to this very day (Nokia did this for our OSS and BSS equipment, this was a big deal for us in the early 2000's when WinNT4 went out of support, in my case, that was mostly the NMS10, Traffica Z1 and Performance Reporting Station, I am certain the GEs and Siemens's of this world are big enough to do this too). If the manufacturer went broke, or did not care enough about their customers to negotiate said custom support agreements for that equipment, that's the manufacturer's mistake, not Microsoft's.
4.) There is a Windows SKU Supported with security patches until 2019 (WindowsXP POS), if the manufacturers did use plain Vanilla XP instead of WinXP POS, that's the manufacturer's fault, not Microsoft's.
5.) If the manufacturer went broke before being able to develop a version of said SW compatible with new versions of the OS, or did not care to develop said version, or developed it, but decided to charge and arm and a leg and a kidney and a king's ransom for said SW, that's the manufacturer's fault, not microsoft's.
6.) If, in your tender when buying said equipment, you requested a lifetime of 15 years, failing during your due diligence to realize that the OS controlling the machine was only supported for 10 years, that mistake is yours, not Microsoft's
7.) If you, as a customer, are running any of this equipment, and even tough your manufacturer negotiated an extended support contract, or used WinXP POS, you delayed applying said patches (or even worse, disabled updates entirely), it is your fault, dear user, not Microsoft's.
8.) If you are running equipment with plain vanilla XP, with no custom support contracts, and failed to mitigate said possible risk according to manufacturer guidance and/or best practices, the fault is with yours dear user, not microsoft's. For instance, many of these systems are supposed to run on a separate network (or even airgaped), and yet I've seen them end up on a shared network with all the office equipment and lot's of shared folders to/from the rest of the network...
So, let's put blame where blame is.
*** Suerte a todos y Feliz dia!
Malwarebytes wrote: “This was probably some kind of kill switch... UPDATE: The second argument to InternetOpenA is 1 (INTERNET_OPEN_TYPE_DIRECT), so the worm will still work on any system that requires a proxy to access the Internet, which is the case on the majority of corporate networks.”
4.) "Windows POS Ready 2009" is the SKU you're referring to. As the name suggests it was intended for Point of sale devices, and was released in 2009.
This Microsoft Lifecycle page shows the lifecycle of embedded products. POS Ready was based on the "Windows Embedded Standard 2009", which is the last revision of XP embedded, with a similar end of life date.
A lot of these "embedded" XP systems were probably released between 2001- 2009 (the original hey day of XP) and didn't include a SKU that would be released in the future with longer support. Even if they included "Windows XP Embedded", "Windows XP Embedded Service Pack 3" support ended in 2016.
I'm going to say that the hero here is also the author of the malware. Perhaps they let it out and hoped to get goodwill or perhaps some extra business helping to clean the malware. He rest is history...
From the link you provided:
Windows Embedded Standard 2009. This product is an updated release of the toolkit and componentized version of Windows XP. It was originally released in 2008, and Extended Support will end on January 8, 2019.
Windows Embedded POSReady 2009. This product for point of sale devices reflects the updates available in Windows Embedded Standard 2009. It was originally released on 2009, and extended support will end on April 9, 2019.
Since these SKU's are still based on XP, It should have been trivial for the manufacturer to certify their product to these versions released 3 and 2 years (respectively) from the planned end of support of vanilla XP (2011), and 6 and 5 years (respectively) from the effective end of support of XP (2014), without charging an arm, a leg, a kidney, and a king's ransom for it...
This "recertification" of sorts would have extended the support 8 years from the planned end of support, and 5 from the actual one. So, still, the manufacturer's fault for not doing it.
Having said that, thank you for the correction and the link, if only slashdot let me edit posts, I'd gladly edit mine, and give you credit about it.
*** Suerte a todos y Feliz dia!
Why is it so difficult to catch the culprit? In order to get the antidote, the victim has to send bitcoins to a given wallet. Given that the ledger is open and public, we can all see all the transactions in and out of this wallet. Presumably, if a lot of bitcoins accumulate in this walltet, it should not be easy to convert all of them into hard cash. The attacker at some point will have to use an exchange or transfer these bitcoins to someone who can use the exchange.
So my question is: Given that we can all trace all the transactions in and out of this wallet and any other subsequent transactions, why is it so difficult to find these criminals?
Pay that researcher a well deserved bonus for saving lots of money and aggravation.
Yet, am I naive, or would the public notification that the "kill switch" has been found and activated - for this version - prompt the culprit to release another mod of this malware?!
Would it make sense to keep this info (publicly) hush for a while?
At least long enough to allow a more permanent solution to be distributed?
Self-importance and self-indulgence is the root of ALL evil.
Wrong: Block it in router firewall (or hosts + software firewall) 0.0.0.0 iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com it stops working & TOR doesn't access THAT in this version of the malware!
I.E.-> It's a dummy the creator of it MADE to protect his own network obviously (no doubt using the methods I just extolled) & yes I added it to my firewalls (hardware + software) + hosts just in case after seeing it @ malwr.com & norton safeweb too!
APK
P.S.=> Guess what? I was RIGHT as usual - that domain/hostname (that didn't exist) KILLS IT/stops it working - blocking it the way I note does the job... apk
Wrong: Block this host-domain name in router firewall/hosts/software firewall 0.0.0.0 iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com it stops working!
THAT's WHAT THIS ARTICLE's ABOUT ON THIS VERSION OF THIS MALWARE!
I.E.-> It's a dummy the creator of it MADE to protect his own network obviously (no doubt using the methods I just extolled) & yes I added it to my firewalls (hardware + software) + hosts just in case after seeing it @ malwr.com & norton safeweb too!
By the way - your TOR note (which sux it's so slow)? ONLY if they are an EXIT node & that way only is it as you say!
APK
P.S.=> Guess what? I was RIGHT - that domain/hostname (that didn't exist & BLOCKING IT makes sure IT DOES NOT EXIST (even if registered by someone which it NOW is - you can't REACH it so as far as this malware OR your IP stack is concerned? It does NOT exist & MALWARE SHUTS ITSELF OFF if blocked thus above). Yes, it KILLS IT/stops it working - blocking it the way I note does the job... apk
Wasn't Weinstein shitcanned after weeks straight of political spam (see their posting history)? Why are they back and being taken seriously for anything?
If you'd really cared about MalwareTech's privacy you wouldn't given this much attention to the fact he was doxxed. Now even more people will know about it. The journalists that wrote about MalwareTech being doxxed are as bad as the ones who first doxxed him.