What is WannaCry ransomware, how does it infect, and who was responsible?
WannaCry Ransomware was a global cyber-attack by the WannaCry crypto worm ransomware in May 2017, by encrypting data on computers that run on Windows OS and requesting payments in the crypto-monetary bitcoin. This spread to older windows systems through EternalBlue, a feat created by the NSA. A few months before the attack, EternalBlue had been hacked and released by a group named The Shadow Brokers. Although Microsoft issued updates earlier on to shut down the ransomware, much of WannaCry’s proliferation has originated from companies that have not used or used outdated, end-of-life Windows systems.
The hack came to an end in a couple of days after Microsoft’s emergency fixes had been published, and a kill switch was found to keep infected computers from further propagating WannaCry. More than 100,000 machines in 150 countries were hit by the attack, and the losses ranged from millions to billions. The government of the United States formally announced on 18 December 2017 that it found that North Korea was the principal responsibility for the assault by WannaCry. In The Wall Street Journal, Homeland Security Adviser to the president, Tom Bossert, penned an op-ed about this claim, writing, “We are not taking this accusation lightly.”
WannaCry’s vulnerability lies in the Server Message Block (SMB) protocol’s Windows implementations. The SMB protocol can connect various nodes in a network, so Windows can be fooled into arbitrary code execution through specially crafted packets. Instead of reporting the vulnerability to the InfoSec communities, the national security agency found this vulnerability, which is called EternalBlue, to be exploited. Wannacry is never the most significant threat ever, but it does threaten organizations with low IT protection goals, such as hospitals, by my definition (using the latest windows vulnerabilities). Only a small portion of offenders have traditionally compensated for this. The bulk of losses occur due to consumer interruption or loss of productivity, or even loss of revenue.
References
Wannacry: what you need to know about this global ransomware attack – SecureLink Norway
What is WannaCry ransomware, how does it infect, and who was responsible? | CSO Online
