Slashdot Mirror
'Accidental Hero' Finds Kill Switch To Stop Wana Decrypt0r Ransomware (theguardian.com)
"An 'accidental hero' has halted the global spread of the WannaCry ransomware that has wreaked havoc on organizations..." writes The Guardian. An anonymous reader quotes their report:
A cybersecurity researcher tweeting as @malwaretechblog, with the help of Darien Huss from security firm Proofpoint, found and implemented a "kill switch" in the malicious software that was based on a cyber-weapon stolen from the NSA. The kill switch was hardcoded into the malware in case the creator wanted to stop it from spreading. This involved a very long nonsensical domain name that the malware makes a request to -- just as if it was looking up any website -- and if the request comes back and shows that the domain is live, the kill switch takes effect and the malware stops spreading. Of course, this relies on the creator of the malware registering the specific domain. In this case, the creator failed to do this. And @malwaretechblog did early Friday morning (Pacific Time), stopping the rapid proliferation of the ransomware.
You can read their first-person account of the discovery here, which insists that registering the domain "was not a whim. My job is to look for ways we can track and potentially stop botnets..." Friday they also tweeted a map from the New York Times showing that registering that domain provided more time for U.S. sites to patch their systems. And Friday night they added "IP addresses from our [DNS] sinkhole have been sent to FBI and ShadowServer so affected organizations should get a notification soon. Patch ASAP."
UPDATE: Slashdot reader Lauren Weinstein says some antivirus services (and firewalls incorporating their rules) are mistakenly blocking that site as a 'bad domain', which allows the malware to continue spreading. "Your systems MUST be able to access the domain above if this malware blocking trigger is to be effective, according to the current reports that I'm receiving!"
You can read their first-person account of the discovery here, which insists that registering the domain "was not a whim. My job is to look for ways we can track and potentially stop botnets..." Friday they also tweeted a map from the New York Times showing that registering that domain provided more time for U.S. sites to patch their systems. And Friday night they added "IP addresses from our [DNS] sinkhole have been sent to FBI and ShadowServer so affected organizations should get a notification soon. Patch ASAP."
UPDATE: Slashdot reader Lauren Weinstein says some antivirus services (and firewalls incorporating their rules) are mistakenly blocking that site as a 'bad domain', which allows the malware to continue spreading. "Your systems MUST be able to access the domain above if this malware blocking trigger is to be effective, according to the current reports that I'm receiving!"
Here is a factsheet: https://gist.github.com/slider23/bd617d0d376047c05d18980fde306840
The domain in question is "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com".
Please read the post before mouthing off. The first three words "for my education please" are an admission of ignorance and a request for information.
All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe
There's a good sumamry over at github.
Essentially, the malware looks for port 445 (SMB) on local computers and the internet. If you have this port open on the internet, and have older than Win10, and haven't updated with the Mar 2 patch, then you're vulnerable.
Note that WinXP has about 8% market share and cannot be patched. You can get infected from another machine on the local subnet as well.
Here is a good detailed description of how it works and what it does.
Note that the propagation has halted for now, however the virus also installs a rootkit on the user's machine. If the virus writer realizes that the domain has been taken, he could remotely change the hard-coded domain name on every currently-infected machine, thus restarting the propagation process.
A new version of WannaCry ransomware is on the loose!
This is a game of cat and mouse, so don't assume you have won.
Anons need not reply. Questions end with a question mark.
IMO it has bought them some time until the attackers figure out another way to continue the attack. Even when the Wikileaks announced that it will work with the tech giants to fix the vulnerabilities but it does not seem to be the case, but it falls on the hands of organizations and people alike to keep their systems updated all the time. NHS has now been hit by ransomware twice in a row.
In the next malware it might be "delete everything" switch.
... does any network expose SMB to the outside world?
I'm not really sure what it would achieve given that this attack was dependent on old versions of Windows, and people being dumb.
A new version of Windows will fix neither of these things given that installing the latest version would've already prevented it.
Can the EU and UK sue the US NSA for damages caused by the exploitation of their dangerous creation?
The "S" in NSA stands for "Security" -- but what happened here is the exact opposite of security, undoubtedly costing many actual lives (as people cannot go to particular hospitals, or have surgeries disrupted) and a huge amount of money, which could have been avoided if the NSA had instead helped SECURE the affected operating systems rather than developing a dangerous and effective software weapon which could be easily leaked and used by anyone on the planet to wreak havoc.
Damn script kiddies, get off my LAN!
I am on Windows 7 Home Premium and have all the patches Windows Update offers me (including "Security Monthly Quality Rollup for Windows 7 for x64-based Systems" dated for May, April, March, January, December, November and October), am I patched?
Also, given how many exploits target these Microsoft networking protocols (NetBIOS, SMB etc) and given that I dont actually need to use these protocols for anything, is there a way to turn them off so they aren't exposed to the outside world?
I am also in two minds about this. Having it spread further could make more people realize that computer security is important, but due to the affected hospitals, people can die. This would probably be the first time that people die from a computer virus.
That sounds pejorative to me. Most discoveries involve accidents - just ask Alexander Fleming, Christopher Colombus, or Doctor Spencer Silver (post it notes).
Like all of these men, this HERO, was investigating something not fully understood, stumbled by accident on something interesting, REALIZED that it was interesting and worked hard to understand exactly what it was. The realization and hard work are not common, they make the difference between a real discovery and a random day.
This is no more accidental than 90% of scientific discoveries.
excitingthingstodo.blogspot.com
This won't accomplish what you intend - the .onion addresses are looked up within Tor, bypassing your standard DNS infrastructure.
With the way software is written today, And i was told there was a security patch for an OS component that didnt require a restart, I would still fear that the issue in question was not completely patched. and maybe just had a bandaid attached to it with a little bit of bubblegum. as ive seen too many times that one security patch turns into a new 0day the very next day. The white hat hackers are smart. and they do alot of good. and the black hats just try to stay a step ahead of the whitehat. the real winners are the grey hats. they have the real knowledge and alot of time you cant tell the difference between them and the other hackers. and most of the time they work real deep in the industry.
Im not 100% sure as i havent looked into this. but if it was me writing it. heres how it would work. SMB is a filesharing server that windows uses to talk to linux mac and other windows machines. when there is a SMB exploit sometimes it just allows you to view files, and copy/write files(like an auth bypass) Then sometimes there is privilege escalation. meaning i give server this string which it unwittingly passes onto the windows OS to give me full admin rights. Then you get to overwrite system files(see where im going?) Sometimes you can also break out of the main process to a shell, or just execute code as if you were the smb server. in any of those instances you can 1) Overwrite explorer.exe, and then wait for the system to call it. 2) upload file, open shell and execute file. 3) Inject raw data into memory and make SMB run data from memory.
I agree that Microsoft and the NSA should pay for it and their execs should get that sort of sentence.
Custom electronics and digital signage for your business: www.evcircuits.com
uhh you realize last month this effected 90% of windows systems? new and old? microsoft decided that older versions of windows didnt matter anymore. even know in the 90's they convinced all kinds of Cat Scan and MRI makers to install windows XP or even worse windows SE on their machines for ease of use.. and now they refuse to give updates to people that paid $200,000-$5,000,000 for their computers. sounds like shitty business practice to me. Now i understand microsoft didnt sell the people the machines. but they did a damn good job of making sure their shitty OS was inside of them.
It should be straightforward to hide those unpatched machines behind a proxy. Give them an Ethernet connection to only one other machine and let that other machine be fully patched and updatable. That's a fix, but, honestly, I'm confused why critical medical equipment is fully exposed to the network in the first place.
Most radiology scanner manufacturers require that the device be connected to the internet so that they can download system logs and troubleshoot problems. It is usually via a VPN. Some of the scanners that I know of have workstations as part of the device. The system is usually the physical scan device, an acquisition computer and a processing computer. They are configured so the technologist can be post processing one scan while another is being acquired. The national accreditation agencies require that radiology dosage reports be sent via the internet to be summarized and to help develop standard protocols. The data is anonamized before transmission.
In summary no one expects computers to be reliable it's all about cost. Even for the same manufacturer the MRI, CT and IR scanners may not be compatible. Usually the software development is outsourced. The device is FDA approved with a specific configuration. There are required directory exceptions for Anti-virus scans.
Sorry way too much information
Or, you could hack the registry to make them self-identify as embedded and get security updates from Microsoft until 2019.
Registry hack enables free Windows XP security updates until 2019
It little behooves the best of us to comment on the rest of us.
uhh you realize last month this effected 90% of windows systems? new and old? microsoft decided that older versions of windows didnt matter anymore. even know in the 90's they convinced all kinds of Cat Scan and MRI makers to install windows XP or even worse windows SE on their machines for ease of use.. and now they refuse to give updates to people that paid $200,000-$5,000,000 for their computers. sounds like shitty business practice to me. Now i understand microsoft didnt sell the people the machines. but they did a damn good job of making sure their shitty OS was inside of them.
Why would you expect Microsoft to pay for the mistake the CAT scan and MRI makers made in designing their equipment? If the MRI machine used a plastic gear to move some of the mechanics of the machine and it turned out that the gear would wear out and needed to be replaced by a metal gear, you wouldn't blame the manufacturer that made the gear or attempt to get the manufacturer to pay for a different kind of gear, you would blame the MRI designer for using a part that was inappropriate for the task at hand. The operating system is just part of the overall design of an MRI system and if you use an OS that doesn't perform adequately over the expected life of the machine, you have made a poor engineering decision. In addition if your operating system isn't rated as a life safety system (Windows and most operating systems are not), you may have made a dangerous engineering decision. (Yes the software of the MRI machine that actually directly controls the dangerous part of the machine is probably embedded and rated for life safety operations, but if a compromise of the Windows software can lead to bad instructions or control limits being sent to the embedded software, you have made a dangerous design mistake.)
Microsoft, for public relations reasons, may opt provide support beyond their original intentions, but it ultimately comes down to a business decision. It is not Microsoft's (or any vendor's) responsibility to pay big dollars forever to compensate for bad engineering decisions of other companies.
Malwarebytes wrote: “This was probably some kind of kill switch... UPDATE: The second argument to InternetOpenA is 1 (INTERNET_OPEN_TYPE_DIRECT), so the worm will still work on any system that requires a proxy to access the Internet, which is the case on the majority of corporate networks.”
And how would they get users to upgrade?
That's not so difficult. Just keep the functionality and look-and-feel and people will be fine with an upgrade (not a down-grade to an OS that they actually don't want).
"Trump!!", the new Godwin.
Yes... so how would making a new version from scratch solve this problem exactly?
I'm not sure what the relevance of the first part of your reply is - the GP said Microsoft should write a new version from scratch, I pointed out it wouldn't make much difference because only old versions were effected - you replied to me highlighting that point, so um, thanks for proving my point I guess? My comment on it relying on people being dumb is based on the fact the only infection vector is either machine sat facing the open internet with no firewall and ports wide open, or people clicking e-mail attachments. Given it's been known this is a bad idea for any computer running any OS since near enough the dawn of the web and e-mail, then yes, for this to spread it required an exceptional amount of stupidity.
But regardless the rest of your argument really is fucking stupid - no longer updating a 16 year old OS is not a shitty business practice? especially when you gave a number of support extensions and gave people more than enough time and warning to upgrade? You'll find very few products in the world where the manufacturer still gives a shit after 5 years, let alone 16 years. Google for example stopped updating my Google branded Galaxy Nexus after only 18 months from UK release leaving it vulnerable, Microsoft have the longest support period of all major vendors - long support periods is one of Microsoft's greatest strengths, the fact there are people who wont upgrade ever is really not on Microsoft, especially when they had a free upgrade path to Windows 10 for 18 months which wasn't effected precisely because they were trying to do everything they could to get vulnerable OS off the internet.
It also didn't effect 90% of Windows systems new and old, I don't even know where you got that fake number from and can only assume you just outright pulled it out your ass because Windows 10 marketshare is alone at 26%, Windows 7 at 48%, and then Windows 8 at 9%, XP at 7%. So 64% of the OS market was vulnerable back in March before the exploit was in the wild when Microsoft released a patch. This was patched then, leaving 16% vulnerable with no patch options leaving 84% of the OS market safe from this exploit as of March this year if IT admins did their job, of which 74% of that share was Microsoft OS'.
Oh, and um, Windows XP came out in 2001, so no, they weren't convincing anyone to install it in the 90s. Really, let's be honest, what you were actually saying was "I'm an open source zealot, and you said something that gives Microsoft some kind of defence so I'm going to unthinkingly pounce on you!" wasn't it? because the first half of your argument agreed with me despite being written in a tone of disagreement, and the second part is just drivel that bitches at Microsoft for the sake of bitching at Microsoft regardless of rationality.