WannaCry – The largest ransom-ware infection in history
blog.comae.io
blog.comae.io
https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNX... https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8is... https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6N...
As of now, the three addresses have received a total of about 20 BTC, or about $36,000 at current exchange rates. The most typical transaction sends about $300 to the addresses. No funds have left the addresses yet.
1. The amount demanded varies from incident to incident. Bitcoin is fractional to 8 decimal places, so it's possible to narrow down the list of victims by the last N digits of the payment.
2. The original demand for payment includes instructions to list the address you sent from. This would be a lame solution for many reasons, including (1) these victims are probably all new to Bitcoin and would have no idea what an address is, and (2) according to an article I read, some security consultants keep a Bitcoin wallet handy to pay on behalf of their clients, leading to duplicate payer addresses.
3. Same as #2 but demanding that the victim include the transaction ID, which is a long hex string. Similar usability issues.
4. It's possible to embed metadata into Bitcoin transactions. As with the prior approaches, victims would likely get this wrong.
Most likely there's a human criminal on the other end of the exchange, and that human matches up victims and payments.
Because the paying victims are surely unsophisticated about Bitcoin and terrified about what is happening to them, it seems likely that the risk of one victim claiming another victim's payment is small, so the manual match-up method is probably the most practical solution from the criminals' standpoint.
Is it really that small? What's stopping a victim from claiming someone else's payment by watching transactions and notifying the criminal that "their" payment has been sent?
Plus, the criminals they might be trying to scam are almost certainly the victims' only hope of obtaining the symmetric encryption key (there are exceptions; some of these programs have been shown to be written by people not entirely clear on how crypto works -- single global key, obfuscated key on client machine, etc.). By definition, the only people interested in paying are the people who have no backups of data they need, so they have no options, and taking the risk of pissing off the criminal doesn't really make sense.
Moreover, for all we know, some victims haven't figured out that they're paying the same people who did the encryption in the first place. From their point of view, this is just like buying antivirus software or taking their computer to Geek Squad.
Sometimes they accidentally weaken the algorithm (like by chopping it's key bits in half through a weak RNG). Crypto is hard, even when the scammer probably has a good grasp. Which is useful in this case.
It's hard to (a) rapidly, (b) silently, and (c) strongly encrypt a critical portion of a business's network.
You can probably choose two.
Possibly the amount is negotiable, or the amount to pay is different across different geographies. (edit: Looks like this exists, based on the Economist's Big Mac Index: https://www.recordedfuture.com/fatboy-ransomware-analysis/ )
Unfortunately the economics probably work out the same way spam does, meaning it won't go away. All it takes is a couple people to pay up to make it profitable, because the criminal doesn't bear the cost of distribution.
Not enough to make up for having every spy agency on your back. Is there a realistic way to get the funds free and clear even if NSA /FBI /CIA / et al are on your trail?
If really only 120 people paid, I'd find that quite surprising.
Is this just from the one version? Or are there other addresses in use?
All this, and still WannaCry hit the main evening news, which at least around here is somewhat high bar. Not sure what to think about that.
2 months ago, March 17th, and many organizations do not patch as often as they should, Many have even started delaying longer since MS patches of late have been causing more problems for people breaking Office, Breaking WiFi and breaking other critical systems with MS normal response of "opps our bad, well fix it in another month until then get fucked"
> Additionally W10
Win10 has about a 12% Market share, about the same as Windows XP still does.
Win10 has not been widely adopted outside the consumer market.
>All this, and still WannaCry hit the main evening news,
Made the news because of the numbers of systems, and number of high profile systems like Hostipols that were infected not because it was a Technical marvel of malware engineering
It also made the news because the NSA is indirectly responsible for not disclosing these vulnerabilities when they were discovered until they weaponized them for their own gain. While I do not blame the NSA for this infaction, I believe they should be forced, today, to disclose to all software vendors any other vulnerabilities they want to play Hacker with....
It's not just Office that's an issue, it's Windows Update itself. In late 2016 both a Vista and a Windows 7 machine stopped updating. The windows update service on both just hung at 100% cpu time, not updating anything. I didn't actually realise for a few months. Apparently it's a common problem, and the only solution is to manually download and install all the updates. Even after doing that, the problem kept occurring.
I've now upgraded everything to windows 10, and so far no problems.
And, shouldn't a workplace be setup for re-imaging if updates go wrong? I know its easy to just store files in C:\user\name\documents, but then it makes it just as easy to be forced to pay $300 for each computer in the network
That said, yes in a perfect world everyone would have perfect backups, and perfect imaging systems that makes ransomeware a non-event, we do not live in a perfect world and it is easy to monday morning QB the IT Staff.
Most IT depts are understaffed and corners are cut because you have to keep your head above water, business do not want to pay for proper staff or proper infrastructure,
IT is a "cost center" that should be cut every year in perpetuity, after all everything is working so why do I need to pay you to sit there all day
I think the longterm solution is delayed execution. Meaning everything entering such a old, but functional system - no matter what port, will have to get through a VM that simulates a near similar working computer, and checks for data availability. Once the safety of the arriving chunk is confirmed, the data is mirrored up.
On an OS where even the biggest geek advocates insist on running outdated versions (7) + "Common Sense 2017" virus protection and institutions don't want to foot the bill for an XP system upgrade.
The filter driver would ensure access to the files continues transparently even though the underlying data is encrypted.
Things will get much worse.
To mitigate, you can disable SMB1.0 with the following command. Make sure to run as administrator:
dism /online /norestart /disable-feature /featurename:SMB1Protocol
Also note that only works on windows 7 and later, dism is not a tool for XP or Windows 2003 which seem to be the largest numbers hit by this since there is/was no patches for them
I'm all for recommending defence in depth, but please study changes like this before doing them.
This malware somehow got seeded, either by (1) direct scanning the internet for vulnerable systems, or (2) traditional "open-this-link / install-this-file" emails/downloads. Maybe that's why we see at least 3 bitcoin addresses: 3 different "seeding" groups.
Corp networks shouldn't be accepting outside SMB connections, and home routers will block them too, so that's where user-initiated emails/downloads come in (or someone connecting an outside laptop).
Incentives matter, and if the ransomeware developers are actually getting paid a lot, they will continue exploiting these vulnerabilities. On the other hand, if it turns out people don't actually bother paying despite being locked out of their computers, would the hackers even bother continuing this line of attack?
So I bet their plan was to infect as many as possible over the weekend, and see money roll in come Monday once the Business Decision makers are in play and IT has had time to say "Yea our backups are fucked so we either pay or lose all data"
Lots of money might pour in on Monday as those infected decide that paying the ransom maximizes business continuity.
Already has, twice
Depends on where they live. For most people on Earth this is a very large sum of money that will go a long way (just not 'here' in the countries where the virus spread).
Perhaps a ransomware/malware criminal reading this can make a throwaway and provide a better estimate.
edit: 2003* my bad
https://arstechnica.com/security/2017/05/wcry-is-so-mean-mic...
The FBI doesn't publicly comment on on-going investigations. You might be able to ask them if one exists, though.
NSA only has red tape when it comes to U.S. citizens, but GCHQ doesn't. GCHQ's mandate also includes serious organized crime. Moreover, considering the damage ransomware can do to critical government infrastructure (for example NHS), it's not a stretch to imagine that targeting ransomware operations would fall under legitimate national security grounds.
Personally I'm surprised they don't just completely fuck these people up to set an example. On the other hand, there's always the possibility WannaCry could be a mud slinging attempt from a state actor, given the much-publicized fact it uses leaked NSA vulns.
I don't think it would be very effective.
There are three reasons for hunting down and persecuting perpetrators of crime: vengeance, setting an example, and undoing the damage.
Only the last reason makes any practical sense here.
This attack works, so there will be others in the future, but it will happen regardless of the threat of punishment. Sure, if you set an example some people might be deterred, but surely not the bright hacker in a basement in Yekaterinburg, or the determined gang in Nigeria, or the mobsters in Chengdu City; i.e., anyone, anywhere without much to lose?
Puting 50% of your diplomats on a plane with 48 hours notice sends a message - you can also start having the IRS / HMRC invstigate rich expats friedly to the regime.
Admittedly there's only so much damage SIGINT agencies can do, but if you get other intelligence agencies involved that have a more human side about them, that changes.
I think that is bit disingenuous. The worm spreads through hole that was known to NSA and publicly disclosed and patched few months ago. That is hardly something I'd call "NSA tool", they didn't make the hole (best to our knowledge).
Sure, it would have been nicer if the discoverer would have been more forthcoming about the vulnerability, but that would have not really changed the fact that this exploitation happened well after the public disclosure and patch availability.
2. Timely discloure is very important, and could have infact prevented this, If the NSA knew about this years ago then chances are far far far far more systems including the older XP/2003 system could have been patch, and some systems may have never had the flaw at all. So it is completely false to say that even if the NSA would have disclosed it when they found it everything would have still happened the way it did. The Patches where only released for Win7/10/2008/2012 2 months ago, many companies hold back MS patches for any where from 1 to 3 months because MS has shitty quality control. On top of that MS stopped allowing individual patches instead going to a "update rollup" meaning you take all of MS's shitty patches or none of them
Further XP and 2003 Patchs where not released until Sat.
2. If a worm is based on the disclosure and hits two months after public disclosure of a hole, then it doesn't really matter if that disclosure happens in 2014, 2017, or 2020. Heck, in this case specifically it could be argued that the delay has been beneficial because we are now better equipped in general to manage such attacks.
If you can't get critical security patches deployed in two months, then it is your problem, not NSAs or MS'. If you can't deal with MS patch quality then don't frikkin use their software.
Running XP/2003 in a non-isolated environment is irresponsible as hell and utterly inexcusable. This sort of infection was completely predictable outcome for XP/2003. Considering that MS was under no obligation to patch XP/2003, I can't imagine what the admins were planning to do in this inevitable situation other than bury their heads into sand.
First off I never said disclose publicly, I said disclose to software vendors.
Further you can not know if it disclosed soon after discovery, which I personally believe was discovered long before 2014, probably has been in the NSA inventory for a decade or more, it would have had a worse impact, or that a ransomware worm would have been developed 2 months later
Ransomware is reality new in this kind of attack, most likly if this would have been released in say 2007 it would have been a Spam Botnet or a DDOS Botnet if anything, not Ransomeware.
>>>If you can't deal with MS patch quality then don't frikkin use their software.
Ohh that is the dream. I use bullshit like this to advocate dropping MS like a bad habit, every year I get more traction in my crusade to rid my company of MS
Run adblock and no-script on your web browser, only visit trusted sites. If you must, use a VM.
Don't download and install software you don't trust. Either it should be a big company in the news regularly, have good reviews from people you trust, or it should be open source. If you must use a VM.
Backup your files regularly (and have offline backups, the data is the most important thing), reinstall your OS regularly (this gets rid of old and outdated software you don't remember; because I doubt you install all updates, have you updated Java recently? How about adobe flash or reader? How about the chipset drivers that likely came with your machine?).