Slashdot Mirror
PCs Connected To the Internet Will Get Infected With WanaDecrypt0r In Minutes (bleepingcomputer.com)
An anonymous reader writes: "The Wana Decrypt0r ransomware -- also known as WCry, WannaCry, WannaCrypt, and WanaCrypt0r -- infected a honeypot server made to look like a vulnerable Windows computer six times in the span of 90 minutes, according to an experiment carried out by a French security researcher that goes online by the name of Benkow," reports BleepingComputer. "During one of those infections, Wana Decrypt0r infected the honeypot in a mere three minutes after it was reset, showing the aggressive nature of the ransomware's scanning module, which helps it spread to new victims... Three minutes is about the same amount of time IoT malware will infect a vulnerable home router left connected to the Internet without patches."
The article also highlights the fact that the group behind this threat is possibly made of inexperienced coders, who just stumbled upon a way to weaponize an NSA exploit. Their three previous WanaDecrypt0r campaigns were mundane, and one researcher called their code "utter [expletive]." This is because WanaDecrypt0r is actually made of two main modules, the ransomware itself, and the SMB worm (based on the NSA exploit). While the SMB worm is top-shelf code, the ransomware itself is quite unsophisticated, making a lot of operational errors, including using only 3 Bitcoin wallets to handle payments, instead of one per infected user, as most top-shelf ransomware does. This makes it difficult to tell which victims paid and who didn't, as anyone could claim "x" transaction is theirs, even if they didn't pay.
The article also highlights the fact that the group behind this threat is possibly made of inexperienced coders, who just stumbled upon a way to weaponize an NSA exploit. Their three previous WanaDecrypt0r campaigns were mundane, and one researcher called their code "utter [expletive]." This is because WanaDecrypt0r is actually made of two main modules, the ransomware itself, and the SMB worm (based on the NSA exploit). While the SMB worm is top-shelf code, the ransomware itself is quite unsophisticated, making a lot of operational errors, including using only 3 Bitcoin wallets to handle payments, instead of one per infected user, as most top-shelf ransomware does. This makes it difficult to tell which victims paid and who didn't, as anyone could claim "x" transaction is theirs, even if they didn't pay.
How does it work? I've installed Windows 7 last week, my first Windows install in more than a decade and I'm not infected yet. I've been on-line for hours!
"I'm not much interested in interoperability. I want substitutability. I want to be able to throw your software out."
when you couldn't connect a new XP install to the internet to get updates unless you installed firewall and virus software before hand. It was pretty cool, tested it a few times on my then 1mbit ADSL line. Install XP, connect to internet and within minutes you'd get infected. I can't remember the name of the virus off hand.
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
You can get it either by a) exposing port 445 to the internet, or b) exposing port 445 to a computer on your local subnet that's infected.
If you have no other computers running windows on your local net, and if your network connection doesn't allow port 445 through, you should be safe.
Port 445 is SMB ("samba" over in linux world), which is used to mount remote disks and printers (and some other things). There's really no need for a user to expose this port to the internet unless you want to mount a disk remotely over the internet, which is not something a user would ordinarily need.
SMB not allowed thru windows firewall by default
Most users behind NAT/SPI
All rational ISPs block SMB
SMB worms are quite useful for spreading laterally within local networks after some mental giant (e.g. C-level exec) in your organization clicks the wrong email.
Pretty much DOA elsewhere where your just whacking clueless outliers.
> $38K that he'll never be able to touch because every intelligence and law enforcement agency is watching those wallets
Until the 38k goes out from Wallet A1 to Wallet B1. Meanwhile, Wallets B2....200 send 89.21% of that 38k to wallets A2....200. There's a possibility that will be pieced together, and now the initial criminal A has about 90% of what he extorted, and subsequent money laundering criminal B has accepted the risk for those more closely monitored bitcoins (presumably he believes he can fool the government permanently on this- he may even be correct, but even if he is wrong, there's still no tracing him back to criminal A).
3 Bitcoin wallets to handle payments, instead of one per infected user, as most top-shelf ransomware does. This makes it difficult to tell which victims paid and who didn't, as anyone could claim "x" transaction is theirs, even if they didn't pay.
It's bad customer service. The finest, bestest, top-self ransomware have good customer service. After paying, rate them low because of it.
Must've been Linus.
... although .. after we've all finally moved onto IPv6 networking, and all our home systems (not just well-run geek systems but also all Joe Public's PCs running Windows 17) are sitting on publically routable real addresses and *not* behind NATs, the situation won't be as comfortable any more.
For the record, the reason why PC are currently secure under IPv4 is because of the router functionnality inside the xDSL modem.
The modem runs some sort of firewall - i.e.: packets are inspected and filtered.
The fact that the addresses are masquaraded from/translated to non-routable local IP ranges is just icing on the cake.
The core of the cake is that the router *does filter*...
It would work just as well if publicly addressable addresses where used behind the router.
(NAT just makes the router function mandatory, because you could not achieve the same simply with a network hub/switch and a dumb-modem).
So no NAT any more, and we have to hope that everybody's ISP-supplied "router" will contain an adequate firewall as a perimeter defence.
Again, NAT isn't necessary per se. You don't need to remap all the addresses into some fdxx:: prefix to make the network secure. What you need is actually DOING filtering, even if the in-network IPv6 addresses are publicly routable.
And in practice that's exactly what I'm seeing in all local ISP IPv6 deployement : their stantard modem is a modem/router combo. It has filtering capabilities.
By default, there's no inbound access. It *happens* that they also do NAT on IPv4 because they only get a single IP.
But it's mainly functioning as a firewall, on both IPv4 and IPv6.
In 2017, nobody sane is using dumb-modems+switches, so stop agitating this IPv6 strawman.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I put a Windows 7 PC directly on the Internet last night after reading this story and it still has not been infected.
So, this morning, I replicated 16 Windows 7 VMs and placed them all on the Internet, and not one of them has been infected in the 3 or so hours they have been connected.
I call this claim bullshit.
I'm a sitting duck here, running a Windows 7 install that hasn't been updated in ages, on a LAN that I can reasonably assume will eventually be infected - how do I update Windows 7 safely, without risking an install of Microsoft's latest malware (Windows 10), or other privacy invading updates from Microsoft? Is there any safe way for me to install only necessary updates, without all of the above shite installing as well?
The best code for malware is code that when disassembled sends the researcher (copyright violator) mad.
What copyright violator? Intermediate copies created in the course of reverse engineering to discover a computer program's method of operation are not infringing. Sega Enterprises Ltd. v. Accolade, Inc., 977 F.2d 1510 (9th Cir. 1992).
The U.S. DMCA has explicit exceptions for law enforcement and security testing. Title 17, United States Code, section 1201, subsections (e) and (j).
PCs are personal computers. There are plenty of PCs which don't run Windows. The original article doesn't have this glaring mistake, and a Slashdot poster should know better.
At this point, anyone who connects a PC directly to the internet is begging to be hacked. This has been shockingly bad practise for literally *decades* now, and people absolutely should know better. This isn't even a Windows-specific thing, even though Windows machines are overwhelmingly affected.
Important things about the internet today:
-Keep your machine behind a router
-Don't open attachments that you weren't expecting, especially if it's from someone you don't recognize.
-Don't share your passwords with anyone.
The internet has been a dangerous wild west for a long time now, and people have no choice but to learn basic safety precautions. It's no less critical than "look both ways before crossing the street" or "use a condom". This is just how it is now.
Ilsa
NAT routers don't filter.* Any incoming traffic
* some also filter, but that's not really part of NAT
(Note: I was using "filter" in a very liberal way. Basically: they don't just pass blindly ethernet packets around as a hub/switch would.
Technically, yes, NAT router don't pay as much attention to the source IP as they pay to the destination port, so the applied rules are a bit unusual).
But most modem with NAT I've seen have their router set to drop most their inbound connection, unless addressed to a port that was white-listed : ...manually by the modem webinterface (forward port "6992" to the machine running bittorrent) ...ask by a machine over UPnP (skype running on a laptop asks router to have a port forwarded to the laptop) ...answering the port of an out-bound UDP request (so either a live video chat, or as part of a STUN firewall whole punching instead of classic UPnP) ...as part of an out-going TCP request (the answer of a HTTP request) ...as requested by a special protocol (as part of the in-bound TCP data channel in an FTP session, as specified in the port command)
-
-
-
-
-
Such modem systematically check any incoming packet for the destination port, and will block or forward it depending on the destination port.
(= so they look pretty close to the filtering work done by a classic firewall, except for the "not having to care the destination IP" part)
and in addition will remap the IP addresses (that's the extra part that NAT adds to the top of a regular firewall).
But again, the security brought by modern modems comes from the fact that they decide to drop or allow inbound traffic based on rules.
The IP remapping is additional mumbo-jumbo necessary to circumvent the limited amound of public IPs.
TL;DR: it's secure because the Modem's embed Linux' iptables. The fact that you can use a private IP range is just bonus.
Otherwise it responds, or doesn't, to traffic addressed to it, just like any other machine would.
I haven't seen a modern modem that responds to traffic it self by default.
All I've seen have: drop or forward rules (some forward rules built on the fly other manually set as mentioned above)
It usually takes special settings to actually have the router itself respond to external traffic. (usually to allow the ISP to administer it).
Or in other words : all the inbound traffic gets into the modem's embed Linux' iptables ruleset, from that point onward it's either sent to other machine or dropped, but under normal circumstances (i.e.: default settings) it never reaches the embed Linux' network socket layer.
The only exceptions are stuff like DHCPv4, RA for IPv6 and much more seldom telnet)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Really what happens is that a NAT router drops any packet that it can't figure out a destination for.
Nope.
They drop any packet, because that's the default rule in the iptables (sidenote: anyone with a modern modem that uses netfilter ?)
loaded into the linux kernel that runs on the MIPS (mostlikely) inside your modem/router.
The rest are exceptions.
On a NAT router the rules will be in the form 'if destination port is "6992", then replace destination ip with "192.168.2.13" and keep the packet'.
On a regular IPv6 router the rules will be in the fromo 'if destination IP is ":81a6:3d0f:5025:9243:5660" and destition port is "6692" then keep the packet'.
But the rest, on any sane modem implementation doesn't even leave the iptables rules.
It's kind of like the post office... they don't deliver mail for which they can't figure out the destination address.
Nope. :
To keep the metaphore
- security works because you have a post-office to begin with (filtering capabilities, thanks to iptables).
- the default for that post-office is to burn with a flamethrower anything that doesn't match known names and/or street numbers.
- the question of whether the destination address exists or not will never come, because most of the mail will have already been burnt before hand, on the grounds on not being on the list of allowed name or allowed street numbers. They never reach the postman's backpack / they're never scheduled for delivery.
It seems like a pedantic point, but it becomes important when you talk about IPv6. Computers behind NAT are protected because they don't actually exist on the Internet.
Nope.
They are protected because the metaphorical post office is trained to burn mail my default. Any sane router drops incoming traffic by default.
Even if they had public addresses, that could be reached from anywhere on the internet, they would be still protected because the default rules is to drop any packet that didn't get authorised by another rule.
The fact that the address needs to be rewritten is just icing on the cake.
They can only be reached via special tricks, and those tricks have to be implemented for the thing to work.
Those "special tricks" are just "yet another entry in the iptables".
In the very special sub-case of IPv4 behind a NAT, it happens that the rule also needs to rewrite the destination address. But that's about it.
Aside from that smal detail, everything is the same, including with IPv4 and public addresses. Including IPv6 and public addresses.
You could even imagine including IPv6 and private addresses, but it's not worth the hassle.
On the other hand, a device with an IPv6 address DOES exist on the internet.
Again : so what ?
The question of whether the IP is publicly addressable or not is completely perpendicular to the quesiton of whether the current ruleset will allow the packet through, or not.
(by default : it's not)
Unfortunately, protecting the IPv6 devices isn't as simple as just building routers that use the same filter as NAT routers do,
Yes, it is, as proven by nearly any modern sane router (random example : AVM's Fritz routers).
because NAT routers don't use a filter.
Wha.... ?
Here's an incredible surprise for you : nearly every modern modem/router runs a Linux kernel.
iptables are default feature of the linux kernel
iptables are necessarily present in modem/routers.
iptables ARE USED because you need it to put the default "masquarade out-going traffic rule".
iptables ARE USED because you need them to put additional port-forwarding rules.
You could build an IPv6 router that imitates what a NAT router does,
Manufacturer DO ALREADY build IPv6 routers that do what NAT router do and drop by default anything incoming, exce
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
F.U.D. (fear, uncertainty, doubt) isn't just for IBM anymore.
Beware of Sales Reps bearing gifts.
Have you met ANY developer, ever?