WannaCry was one of the most damaging ransomware outbreaks in history. On 12 May 2017 it spread around the world in a matter of hours, encrypting more than 200,000 computers in around 150 countries. Hospitals in the UK’s National Health Service (NHS) had to cancel appointments and divert ambulances, and companies such as Renault, FedEx and Deutsche Bahn were also hit.
It is now an old attack, but it is still worth understanding, because the weakness it exploited, unpatched and exposed Windows file sharing, still exists in many networks today.
What is WannaCry?
WannaCry (also called WannaCrypt) is ransomware that behaves like a worm. Once it infects one machine, it scans the local network and the internet for other vulnerable Windows computers and copies itself to them automatically, with no user interaction. Each infected computer had its files encrypted and showed a demand for $300 to $600 in Bitcoin.
The US and UK governments later attributed the attack to the Lazarus Group, which is linked to North Korea.
How it spread: EternalBlue and SMBv1
WannaCry spread using EternalBlue, an exploit for a flaw in Microsoft’s SMBv1 file-sharing protocol. EternalBlue was developed by the US National Security Agency (NSA) and leaked publicly by a group called the Shadow Brokers in April 2017.
Microsoft had already released a patch for the flaw, MS17-010, in March 2017, two months before the outbreak. Computers that had installed it were protected from the worm. The attack succeeded because so many organisations had not patched, were running unsupported versions such as Windows XP, or exposed SMB (TCP port 445) directly to the internet.
The kill switch
Before encrypting anything, WannaCry tried to contact an unregistered web domain. If the domain responded, the malware stopped. Security researcher Marcus Hutchins noticed this and registered the domain, which slowed the outbreak dramatically within a day. Later variants removed or changed the kill switch.
How to protect against WannaCry and similar worms
- Patch promptly. Install security updates, and specifically make sure MS17-010 is applied on every Windows system.
- Disable SMBv1. It is obsolete and not needed on modern Windows networks.
- Never expose SMB to the internet. Block TCP port 445 (and 139) at the network perimeter.
- Replace unsupported systems. Operating systems that no longer receive updates should be upgraded or isolated.
- Segment your network so one infected machine cannot reach every other system.
- Keep offline backups. Ransomware often encrypts connected drives and network shares, so keep backups that are disconnected or immutable, and test restoring them.
- Use endpoint protection that can detect and block ransomware behaviour.
- Monitor your network for unusual SMB traffic and mass file changes.
- Have an incident response plan so you know who does what if ransomware does get in.
- Test your defences. A network penetration test or vulnerability assessment will find unpatched systems and exposed services before an attacker does.
Should you pay the ransom?
Law enforcement agencies advise against paying. Payment does not guarantee you get your files back, and in the case of WannaCry very few victims who paid reported receiving working decryption. Reliable backups are the real protection.
Key takeaway
WannaCry did not use a new or unknown vulnerability. It used a flaw that had a patch available for two months. Basic hygiene, prompt patching, network segmentation and tested backups, would have stopped it. If you are not sure how exposed your own network is, get in touch.
