&gt; it&#x27;s like they half understood what they were doing.And that&#x27;s exactly what is so wrong about the NSA and others not being good stewards of their own bloody malware. A lot of these criminals would not be able to get their act together at this level without being partially funded by the three letter agencies. Think of it as an advanced form of script kiddies, they can use the tools and wrap them but they could not come up with those tools of their own accord.

It&#x27;s all explained in the article. It is a sandboxing detection method, some environments resolve all DNS requests to a host that captures all traffic. It&#x27;s still stupid but there is a reason for this behaviour.

As with all SW development, there are always a lot of things that they &quot;could have&quot; or &quot;should have&quot; but every day you wait with malware which has a know patch out means less spread for you. So they probably made the decision to just get it out as quickly as possible even if it was not perfect.

&gt; how stupid were the malware authors to ...They were clever enough to execute this attack, collect over £160k according to the last estimate I&#x27;ve seen (likely way more now), and achieve that in one day. You seem to underestimate them including assumptions that this was simply missed. There are many potential scenarios where this is beneficial to the authors.

Honestly, how stupid were the malware authors to use standard DNS for a domain that could take down their shit when they use Tor for the actual key and address communication and everything... it&#x27;s like they half understood what they were doing.Well, I guess maybe they didn&#x27;t want things to get too out of hand and now if they want they can be back up soon with that fixed.

&gt; Two domains, one defuses the ransomware, the other detonates it.And one of the domains will be called redwire[randomchars].com, and the other bluewire[randomchars].com. Which one do you sinkhole, the red wire or the blue wire?

Why? What would be the goal? If you&#x27;re in ransomware business, why would you ever want to delete data before the scheduled time? You want to get paid instead.

This may indeed be exactly what the authors of the next ransomware will do.Two domains, one defuses the ransomware, the other detonates it.

Yeah, I guess in his experience that scenario is less likely tan it being a c2 endpoint so he made the decision on that. And it turned out to be the correct one and might have prevented this from becoming a much more destructive blaster worm.

Some people just want to watch the world burn

&quot;Due to interference, we are no longer able to process unlock requests. Goodbye.&quot;It&#x27;s probably easier, as you point out, to have the virus delete its keys and wipe itself out. (And has the added benefit of taking some forensic info with it.)But in a marketing sense, blaming people interfering with your network for the lost data may make you safer, as many victims are likely to prefer you extorting them to the good guys causing data loss by stopping you.Being a criminal is all about customer service.

I am not sure that being able to trigger the deletion of all data in one sweep would be of any interest to the attacker. Firstly, if they simply chose to stop ransoming decryption keys, the encrypted data would effectively be deleted anyway, and secondly, deleting the data would foreclose on any prospect of further gains from the attack.

Ransomware authors could come up with better flags than registering a domain since anyone can do it. Why not do something like creating an ipns address in ipfs and check if it contains something? Nobody but them would be able to put content at that address and can be checked through multiple gateways.

the guys explains that the ransomware does this check to defend itself from being observed in a vm

I think it&#x27;s great that this was used to stop the malware, but pre-emptively registering the domain without understanding what it did seems dangerous.The malware could have just as easily used the registration of that domain as a flag to start deleting data, no?

Right. But the problem is that malware creators can choose from many more attack vectors than security researchers typically can.

Yet malware creators rely on bugs to spread their work, so why not.
Fighting fire with fire...

There are many things in the current state of security to be worried about, yet complacency remains high (which is one of the things...)

It seems a bit scary that security researchers are relying on bugs in malware to get their job done.

It is normal to see such data move +&#x2F;-1% in a few months time. It is far more shocking to see 18% windows users in China are still running their XP. Must be very easy for NSA to do their job.

&gt; Re your Statscounter link <a href="http:&#x2F;&#x2F;gs.statcounter.com&#x2F;os-version-market-share&#x2F;windows&#x2F;desktop&#x2F;china" rel="nofollow">http:&#x2F;&#x2F;gs.statcounter.com&#x2F;os-version-market-share&#x2F;windows&#x2F;de...</a>Win 7 is rising again for monthsWin10 and WinXP are shrinking

I don&#x27;t get why you are being downvoted (also one word). I thought your comment was quite funny

Lessons learned in school: overestimate and underestimate are both just one word, no spaces needed.

I&#x27;m pretty sure remotely disabling computers is covered under the computer misuse act in the UK and every similar law in all countries that have them.

Pirates don&#x27;t install security patches.

No DNS huh? NTP? Outgoing ssh? Http{s} to​ high number ports? Outgoing RDP?...see the problem?

Oh, you mean like GWX was for Win7+? &quot;Hello, we tried to upgrade your computer to WinX, your computer is now an expensive brick.&quot; Yeah, that&#x27;s a great idea.

Ms should release one last security patch for XP, even pirate copies: a firewall that kills every protocol except HTTP&#x2F;HTTPS and email.  Close all the ports.

I wonder if something like that might be the case - that this malware escaped early or spread much farther and faster than the authors intended. That would explain the sloppy attempt at an analysis countermeasure that made it trivially easy to shut down the whole thing.

I don&#x27;t think the malware developers wanted this kind of heat directed towards them.If anything they will learn to automatically disable any nodes that are clearly operating out of a public office building.

I&#x27;m that developer but instead of working on malware, I just want to make sure that iPhones can actually use the website.

will he&#x2F;she be called into a HR meeting to make a Performance Improvement Plan? ;)

I like to think that they know anything they implement will eventually get blocked, so they have a big collection of unexploited evasion tricks and just introduce them one by one.

There is nothing that stops them to relaunch attack with modified version. Initial wave will use spam, then worm-like part of the ransomware will penetrate internal networks.

Why wouldn&#x27;t they do it initially? It would take like 5 minutes to make it use a random string instead of a hardcoded one.

You make it sound like some professional outfit. Is it really like that? I would&#x27;ve thought that it&#x27;s a bunch of teens.

&gt; I like to imagine that one of the developers on that team filed a tech debt item to do exactly this, was never able to get their manager to prioritize it, and is now pulling out their hair saying, &quot;I told you so!&quot;Malware authors have budgets and schedules too. It&#x27;s a business, probably more profitable than 90% of the startups in SV

&gt; Lessons learnt by ransomware developers - rather than using a single pretty arbitrary test, always rely on a more robust statistical model to detect whether your code is running inside a sandbox.I like to imagine that one of the developers on that team filed a tech debt item to do exactly this, was never able to get their manager to prioritize it, and is now pulling out their hair saying, &quot;I told you so!&quot;

I guess this came off (unintentionally) as sarcastic.  I had always assumed the risk of the NSA leak was from non-state actors (as this case) and it hasn&#x27;t occurred to me that governments will find it just as handy -- in retrospect of course they will.

&gt; Lessons learnt by the Chinese central government - NSA is a partner not a threat, they build tools which can make the coming annual China-US cyber security talk smooth.Wow, +1 Insightful!

The NSA knew about this vulnerability and decided to use it offensively, rather than notifying Microsoft about it.Then, due to lax controls, the exploit got leaked and used by the ransomware developers.Their culpability goes back a lot further than not noticing a kill switch.

The danish center for cyber security issued a threat assessment, but there was not too many git in denmark because friday was a public holiday.

Do you want 3 letter agencies having more ways to get access to private networks?Right now looking at how the election scandals went they are there at prosecution and have access that they are given willingly.

I&#x27;m kind of confused as to what the role of agencies like NSA, GHCQ, etc are in situations like this. Are they supposed to put an end to the attack? If so, how is it that a single researcher beat them to it (presumably with a budget many orders of magnitude less)?Or maybe this story isn&#x27;t really accurate and there was no accident...EDIT:And if it isn&#x27;t the role of those agencies to defend the public health IT infrastructure, which agencies are responsible, if any?

I don&#x27;t understand your Chinese government point. The post never said anything about China. And the only thing about the NSA was that it was an NSA-developed exploit. That doesn&#x27;t make the NSA look friendly.

If you change the name or location of the shell to something other than &quot;&#x2F;bin&#x2F;sh&quot;, plenty of legitimate software would break too.Even though the POSIX standard says:&gt; Applications should note that the standard PATH to the shell cannot be assumed to be either &#x2F;bin&#x2F;sh or &#x2F;usr&#x2F;bin&#x2F;sh, and should be determined by interrogation of the PATH returned by `getconf PATH`, ensuring that the returned pathname is an absolute pathname and not a shell
built-in.&gt; For example, to determine the location of the standard sh utility:command −v sh

&quot;Lessons learnt by ransomware developers...&quot;If you are suggesting that developers, regardless whether they develop mobile apps or ransomware, will start relying less on DNS, I respectfully disagree.Someone else in this thread commented how reliance on DNS makes systems &quot;fragile&quot;. With that I strongly agree.The same old assumptions will continue to be made, such as the one that DNS, specifcally, ICANN DNS, is always going to be used.How to break unwanted software? Do not follow the assumptions.For example, to break a very large quantity of shellcode change the name or location of the shell to something other than &quot;&#x2F;bin&#x2F;sh&quot;.[1]Will shellcoders switch to a &quot;robust statistical model&quot; instead of hard coding &quot;&#x2F;bin&#x2F;sh&quot;?Someone once said that programmers are lazy. Was he joking?1. Yes, I know it may also break wanted third party software. When I first edited init.c, renamed and moved sh I was seeking to learn about dependencies. I expected things to break. That was the point: an experiment. I wanted to see what would break and what would not.

If you look at cybersecpolitics, a blog written by a former NSA, he specifically says the &quot;we hacked into a server box&quot; story for how these tools got leaked is implausible.

Lesson more people should learn: dump Windows.

Lessons learnt by ransomware developers - rather than using a single pretty arbitrary test, always rely on a more robust statistical model to detect whether your code is running inside a sandbox.Lessons learnt by NSA - never over estimate the skill level of your network admins.Lessons learnt by Microsoft - never under estimate the loyalty of your Chinese Windows XP users, both XP and Win10 have 18% of the Chinese market [1].Lessons learnt by the Chinese central government - NSA is a partner not a threat, they build tools which can make the coming annual China-US cyber security talk smooth.[1] <a href="http:&#x2F;&#x2F;gs.statcounter.com&#x2F;os-version-market-share&#x2F;windows&#x2F;desktop&#x2F;china" rel="nofollow">http:&#x2F;&#x2F;gs.statcounter.com&#x2F;os-version-market-share&#x2F;windows&#x2F;de...</a>

This may well give birth to a new paradigm: Domain-Driven Programming.Each condition is satisfied by a different domain lookup.

I&#x27;m not really sure what you&#x27;re trying to say, but reading the rest of the article will answer your question.

Wow, now, let us imagine using aggregation of millions of states of human minds as a Boolean constant used in millions of scenarios for about four years straight.

I think a distributed global database is a more appropriate analogy.

Can somebody explain how this will work? AFAIK it does not even check for obvious things such as vmware processes running in the background.

More likely used during testing by the author itself?

I believe the malware was designed to do that as part of a way to test and see if it&#x27;s in a sandboxed environment if someone was trying to analyze it. If I understood this correctly, checking the domain was a way to do that (although I might be completely wrong).

I think that it is more likely that there was meant to be something else on the other end which did something but x0rz got there first so it broke.

It&#x27;s a fairly regular thing. If you are a Google Chrome user, then your WWW browser has been doing much the same check, for fairly similar reasons (detecting whether it is running inside an environment where DNS service is being generally altered to redirect clients to a special server), for the past half decade.* <a href="https:&#x2F;&#x2F;mikewest.org&#x2F;2012&#x2F;02&#x2F;chrome-connects-to-three-random-domains-at-startup" rel="nofollow">https:&#x2F;&#x2F;mikewest.org&#x2F;2012&#x2F;02&#x2F;chrome-connects-to-three-random...</a>

&gt; After about 5 minutes the employee came back with the news that the registration of the domain had triggered the ransomware meaning we’d encrypted everyone’s files (don’t worry, this was later proven to not be the case), but it still caused quite a bit of panic. I contacted Kafeine about this and he linked me to the following freshly posted tweet made by ProofPoint researcher Darien Huss, who stated the opposite (that our registration of the domain had actually stopped the ransomware and prevent the spread).That&#x27;s quite an high abstraction level programming thing to do to use a domain name registration state as a boolean. Is that a regular thing ?

...says adolph.  The Germans, however, use much shorter terms like &quot;Rechtsschutzversicherungsgesellschaften&quot;.  :-)

You can tell it&#x27;s _not_ Cymraeg because of the &quot;j&quot;s.Despite Jones being the stereotypical name for people in Wales, the old Welsh language, Cymraeg, doesn&#x27;t have a J, nor have Z, K, V, X (IIRC). Jones is an English loanword, brought over apparently with the Norman conquest (though derived from Hebrew).The modern language of Wales is of course British English with a ~100% use rate; Cymraeg still has an approx 8% (but falling) of the population who say when surveyed that they can speak it fluently, however.Yeah, I&#x27;m terrible at parties.

ends with &quot;gwea.com&quot;. Big difference.

The registered domain gwea.com: <a href="http:&#x2F;&#x2F;www.thedailybeast.com&#x2F;articles&#x2F;2017&#x2F;05&#x2F;12&#x2F;stolen-nsa-tech-shuts-down-hospitals" rel="nofollow">http:&#x2F;&#x2F;www.thedailybeast.com&#x2F;articles&#x2F;2017&#x2F;05&#x2F;12&#x2F;stolen-nsa-...</a>Edit: I&#x27;m not so sure now. The whois record seems to suggest recent activity:<pre><code> Domain Name: GWEA.COM
 Registrar: 22NET, INC.
 Sponsoring Registrar IANA ID: 1555
 Whois Server: whois.22.cn
 Referral URL: http:&#x2F;&#x2F;www.22.cn
 Name Server: PK3.22.CN
 Name Server: PK4.22.CN
 Status: clientDeleteProhibited https:&#x2F;&#x2F;icann.org&#x2F;epp#clientDeleteProhibited
 Status: clientTransferProhibited https:&#x2F;&#x2F;icann.org&#x2F;epp#clientTransferProhibited
 Updated Date: 18-mar-2017
 Creation Date: 17-mar-1999
 Expiration Date: 17-mar-2018</code></pre>

Will visiting that URL cause my IP to &quot;hit&quot; on <a href="https:&#x2F;&#x2F;intel.malwaretech.com&#x2F;WannaCrypt.html" rel="nofollow">https:&#x2F;&#x2F;intel.malwaretech.com&#x2F;WannaCrypt.html</a> now?The map is populating much faster now, maybe they integrated it with the URL?

Does someone know what this domain actually is?EDIT: After looking explicitly for it I found www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com.

install security updates and do security hardering by whitelisting only what you need.

So from a practical point of view how to disentangle infrastructures from this sort of attack?

Yeah, I&#x27;d love to do that kind of stuff for a living. Not sure if I&#x27;d be good enough though. I&#x27;m fluent in x86 assembly and do quite a lot of debugging on that level, but reverse engineering remains a tough problem.

That&#x27;s where the real money is in malware. This malware group may have made $30k on the attack, but the malware-protection industry will earn orders of magnitude more business.

Probably freelance consulting for companies who really want to keep their stuff protected from this sort of thing.

Agreed. I&#x27;ve been following him for a few years now, very interesting account.

I think he&#x27;s been working for the same people since before Mirai.

He&#x27;s a great follow on Twitter, he works for some cyber security company in LA I think but lives in England. Got offered the job after he created a Mira bot tracker IIRC.

The author says they are doing this for a living. Who are they working for?

Sure, and something like dnscrypt-proxy can do that, but in what is being discussed here, blocking the domain would do the opposite of what you are trying to achieve.The ransomware prematurely quits if the domain resolves to an IP, and a webserver listens to that IP.

I recommend pi-hole if you have a Raspberry Pi laying around: <a href="https:&#x2F;&#x2F;github.com&#x2F;pi-hole&#x2F;pi-hole" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;pi-hole&#x2F;pi-hole</a>

DNS being one of the most fragile aspects of the net, a lot of issues can be solving by a local DNS resolver that does a lot of caching and blocking

Adding this domain to various adblocker list might also have interesting effects.

Ironically, lying DNS resolvers redirecting nonexistent domains to ads were also helpful in order to mitigate the attack.

I&#x27;m sort of bearish on most things blockchain but this seems like one of a very small number of things that zero-trust auto-executing contracts could be useful for. Someone could probably work out a mathematical proof of &quot;if you transfer this much etherium the private key will be decoded.&quot; Heh.

No. Paying doesn&#x27;t guarantee you recover your data or that you won&#x27;t get hit again. If you&#x27;re getting to the stage where you&#x27;re dealing with contracts and money, implementing a backup system is likely a simpler solution.Also btc price is a bit unpredictable. Would you really risk buying it ahead of time, not knowing if you&#x27;ll ever need it? What if the price goes down and you need to buy extra anyway? Apart from very specific situations it just isn&#x27;t a great investment.

Keep in mind this article makes... Little sense the way it was written. The DDoS attack at the time was done in a way that could be replicated by anybody. Multiple control networks gave jobs to IoT devices without real authentication. That means anybody known to pay off attackers would immediately get attacked by another group using the same sources. Maybe there&#x27;s some stockpile of Bitcoin &quot;just in case&quot;, but it would require a very special situation - not a common DDoS they talk about.

Yes:Several of London’s largest banks are looking to stockpile bitcoins in order to pay off cyber criminals who threaten to bring down their critical IT systems.<a href="https:&#x2F;&#x2F;www.theguardian.com&#x2F;technology&#x2F;2016&#x2F;oct&#x2F;22&#x2F;city-banks-plan-to-hoard-bitcoins-to-help-them-pay-cyber-ransoms" rel="nofollow">https:&#x2F;&#x2F;www.theguardian.com&#x2F;technology&#x2F;2016&#x2F;oct&#x2F;22&#x2F;city-bank...</a>

You&#x27;ve just made me consider that this could be an attempt to inflate BTC.Create a demand. The wallet wouldn&#x27;t even ever have to be tapped. $300 is small fry, but an overall inflation on a strongly-leveraged BTC investment could allow an disconnected cashout.

So will companies start holding bitcoin as insurance on these kinds of attacks?

The Government can hire developers to do it themselves.

Not in all jurisdictions, per <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Negotiorum_gestio" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Negotiorum_gestio</a>&gt; Negotiorum gestio (Latin for &quot;management of business&quot;) is a form of spontaneous voluntary agency in which an intervenor or intermeddler, the gestor, acts on behalf and for the benefit of a principal (dominus negotii), but without the latter&#x27;s prior consent. The gestor is only entitled to reimbursement for expenses and not to remuneration, the underlying principle being that negotiorum gestio is intended as an act of generosity and friendship and not to allow the gestor to profit from his intermeddling. This form of intervention is classified as a quasi-contract and found in civil-law jurisdictions and in mixed systems (e.g. Scots, South African, and Philippine laws).&gt; For example, while you are traveling abroad, a typhoon hits your home town and the roofing of your house is in danger. To avoid the catastrophic situation, your neighbour does something urgently necessary. You are the &#x27;principal&#x27; and your neighbour here is the &#x27;gestor&#x27;, the act of which saved your house is the negotiorum gestio.

You may want to read CFAA rules (<a href="https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Computer_Fraud_and_Abuse_Act" rel="nofollow">https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Computer_Fraud_and_Abuse_Act</a>) first. Breaking into someone&#x27;s computer to fix it is still breaking into someone&#x27;s computer and very illegal.

I think someone did that for some iot devices

Now is the time to write a virus that uses the same exploit and automatically patches the vulnerable before a new version of the ransomware is released.

Yep, tried doing that. But unfortunately I could get it to install. Keep getting &quot;This update is not applicable to your computer&quot; even though I&#x27;m doing everything right.

No! All it takes is a single byte to be patched and the &quot;killswitch&quot; can be disabled. There are almost certainly other variants already in circulation.Use an offline security update.

Are there any side effects of disabling SMBs for your local machine that you won&#x27;t be using to connect to network drives?

You are fine if you are behind a router on a local network at home and don&#x27;t have SMB port exposed to the public internet. And assuming all other clients on your network aren&#x27;t infected.

Does this mean that I can safely connect my outdated Windows 7 back to the internet?

Interesting timing for this cyber attack given the recent news. Are Robert Mercer and Cambridge Analytica also being investigated?

That&#x27;s HexRays in IDA. Pretty nice but damn expensive.

I&#x27;m curious, does anyone know what tool he uses to disassemble the program into C? It looks neat.

Was the domain ever named?Found it www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

Thanks for the tip, and I will try this. As I said, .DOCX files work best in their native Win Office environment as I&#x27;ve had problems with them in open source solutions (formatting issues), whitespace injection ruining the layout, etc

Or Libreoffice, which has had many enhancements (including to compatibility with MS Word files) since it forked from OpenOffice.org, while Apache OpenOffice stagnated.

&gt; This is a conscious decision to permaban Google from my lifeMS collects alot of metrics from your devices, not just G*g.

To mitigate, I am running Debian as the host and jailing Windows 10 in a Virtual Machine, and have uninstalled SMB1.0 on the machine by going into &gt; Programs and Features &gt; Add or Remove Windows Components. I have also blocked port 445 (SMB) with ufw (On Debian)<pre><code> sudo ufw deny out to any port 445
</code></pre>
Aswell as this I am not deferring updates in any way and dutifully patching. I&#x27;ve always hardened Windows in this way and I&#x27;ve never had issues with malware, and if I did, the impact would be minimal because I&#x27;ve compartmentalized my files in such a way that even the worst malware would only encrypt some of my files and not all of them.I store all my critical files in an offline environment (sandbox) so the only files that are going to be encrypted are replaceable (non important) and disposable. For example, I wouldn&#x27;t cry if my C.V got encrypted because a copy of it exists in about 50 locations either offline and online.Unfortunately I need Windows because my colleagues like to send Windows-only .DOCX files which work best in MS Word, and I don&#x27;t have a Google account, so I can&#x27;t open them in Docs. This is a conscious decision to permaban Google from my life, but Windows is staying.

The ransomware was already active for hours by that point. The answer the employee provided did not make any sense. Not now, not the first time I read the blog.

It&#x27;s an interesting thought experiment. The closest analogy I can think of is pulling the wrong wire on a bomb.

That&#x27;s what bugs me about the blog post but it may only be an issue with how it&#x27;s written or my understanding.From the Talos Intelligence blog:&gt;The above subroutine attempts an HTTP GET to this domain, and if it fails, continues to carry out the infection. However if it succeeds, the subroutine exits.It&#x27;s not clear if the subroutine being shown is the main entry point in which case return 0 exits (which is good for us), or if it&#x27;s part of a larger framework that would be doing stuff later on (which is potentially bad for everyone because it could decide to do other things if it finds that domain sinkholed?)The blog author checked on whether or not the domain name changes, but didn&#x27;t specify any details about anything going on higher in the stack:&gt;All this code is doing is attempting to connect to the domain we registered and if the connection is not successful it ransoms the system, if it is successful the malware exits (this was not clear to me at first from the screenshot as I lacked the context of what the parent function may be doing with the results).So my question is how much knowledge did they have of the rest of the code when registering the domain? Would the analysis environment have provided more information if the malware had continue to run after realizing the domain was sinkholed?

Security researchers absolutely should have liability for poking malware in the wild on their own initiative.If you&#x27;re a bomb enthusiast or researcher, you&#x27;d absolutely be liable if you tried to defuse a bomb without being requested to by the police. This is no different because of the potential for massive collateral damage. You want to see what happens when the domain is registered? Resolve the DNS on your own network.It&#x27;s only when acting under government direction that you should be immunized from liability.

Under that same assumption of assuming maximum damage, what was the motivation for the malware author to put in a killswitch?

I would think not. For something bad to happen from registering the domain, there would have to be some kind of weird booby-trap in the malware. What&#x27;s the motivation for a malware author to do that? If they can do something worse, the incentive is to just do it, rather than wait for a security researcher to do something first that they may or may not ever do. It&#x27;s not impossible, but it&#x27;s a little ridiculous and wildly unprecedented in the field of malware analysis.When there&#x27;s a global infection spreading wildly and crippling essential organizations, you want everyone to act fast, not spend weeks making sure everything is perfect. If you see the malware connecting out to an unregistered domain, you just register it now. Whoever is first gets it, and the attacker could realize their mistake at any time. Even without knowing what this malware does with the connection, odds are 99.9% that the situation is better with the domain controlled by a security researcher than by a malware author. Punishing researchers if something done in good faith turned out badly would incentivize them to overanalyze everything and delay taking any potential beneficial action until it&#x27;s too late.

&gt; Would the security researcher be held in any way accountable for activating the ransomware?I think that would be the equivalent of an arsonist also leaving a water activated chemical at the scene of the fire, and then blaming the firemen for using water to put out the fire when it made the situation worse.

Let&#x27;s be honest if he didn&#x27;t someone else malicious or otherwise would have. This is the internet.Better in the hands of someone like this.

&gt; the employee came back with the news that the registration of the domain had triggered the ransomware meaning we’d encrypted everyone’s files...Even though this fortunately turned out to be false, what if it had been true? Would the security researcher be held in any way accountable for activating the ransomware? If I were the author, I might be a bit more careful in the future before changing factors in the global environment[1] that have the potential to adversely affect the malware&#x27;s behavior, but of course I&#x27;m not a security researcher, so I really don&#x27;t know.[1] I suppose a domain could probably be made to appear unregistered after being registered - depending on the actual check performed - but there are other binary signals (e.g., the existence of a certain address or value in the bitcoin blockchain) that might not be so easy to reverse.

Private dns server connected to the vm malware host

In a sandbox environment (e.g., in a lab trying to deconstruct malware) they&#x27;ll have a private DNS infrastructure setup to resolve all domains to some local IP address. That way they can intercept and reverse engineer the command &amp; control traffic. The author of this malware tried to slow down security analysts by trying to resolve a &quot;fake&quot; (unregistered) domain. Probably just pounded on the keyboard and added a .com. The idea is that the domain should not resolve. If it does, it&#x27;s an indication that they&#x27;re in a sandbox &#x2F; lab environment so the malware doesn&#x27;t trigger. Again, this is an attempt to slow down analysis. Of course this was a stupid tactic because registering the domain and setting up DNS stopped the malware from triggering globally.

&gt;In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen).Can someone please explain this? I have no idea what was said there.

That would be fine, as all commercial home routers firewall off access to the SMB service that is being exploited.

Can a Windows laptop that doesn’t have the Windows Update patch get infected just by being connected to the Internet via a home Wi-Fi network?

It only spread through SMB shares where available. Other vectors include downloaded executables (email, web, etc).

Certainly possible, but if it was spread with an ordinary phishing attack, I gotta wonder why all of these organizations got hit so hard in such a short timeframe. We&#x27;ve had lots and lots of conventionally spread ransomware attacks go out, but I don&#x27;t know of any that have had this kind of effect in this timeframe.

Could it be organisations sharing data by SMB infecting each other?

The irony of this is SMB servers are often setup with insecure configs exactly because it&#x27;s so rarely used over public networks. Too many people assume public networks will be their Maginot Line against SMB attacks.

The attack was usually introduced via a phishing attack and then spread through SMB vulnerabilities. It generally wasn&#x27;t that SMB endpoints were open to the internet.

Any network service being shipped right now by a serious vendor ought to be secure enough for the open Internet; frankly most large organizations&#x27; internal networks aren&#x27;t any safer than the Internet. Why should SMB be any less safe than SSH or HTTP?

The whole attack is a wonderful show of incompetence within the IT departments of the compromised companies.

First of all, SMB is a network protocol for sharing files. It&#x27;s sometimes known by the name samba, which is an implementation of the protocol. If you have a remote drive mounted for sharing documents with your coworkers there&#x27;s a good chance you&#x27;re using SMB.This exploit worked in two stages. First, there was a massive email campaign. Then, when employees would click on the attachment, the malware would worm its way onto other computers on the local network using an exploit in the SMB file sharing stack (which orignally came from leaked NSA malware). Then it would encrypt the user&#x27;s files and demand the ransom.

After the recent so called &#x27;cyber attacks&#x27; of WannaCry, I was careful to update any Windows machine I have and install things like EMET and MalwareBytes on them. I switched to Linux years ago because I&#x27;ve heard nothing but bad news concerning Windows, but one thing struck me about the WannaCry infections: I heard the attackers used an exploit pulled from the recent ShadowBrokers leak, something related to &#x27;SMB&#x27;. A few questions:
Explain it to me like I&#x27;m five please1.) What is SMB? And is it easy to remove from systems by simply uninstalling it (like I have done[0])?2.) Does WannaCry just land on a machine through a simple point-and-click exploit? Do they just enter a vulnerable IP address and they can plant the exploit on the machine and run it?3.) I am aware that it also gets onto machines by people randomly clicking on shady e-mail attachments, but I am very curious about how it simply lands on computers with very little or no user stupidity at all?[0] I uninstalled SMB by going to &gt; Add or remove programs &gt; Remove windows features

What really amazes me about this attack is that the main attack vector seems to be exploiting a SMB vulnerability. Reasonable enough of a way to spread within an organization, but it&#x27;s amazing that so many organizations seem to have this port and service open to the world for this worm to exploit.I&#x27;m not the most diligent follower of security news, but I&#x27;m pretty sure that SMB network sharing is riddled with security vulnerabilities, latency issues, etc, and is generally wildly unsuitable for being left wide open to the entire internet. How could any institution with a competent IT department not have had this service firewalled off from the net for years?

&gt; &quot;One thing that is very important to note is our sinkholing only stops this sample and there is nothing stopping them removing the domain check and trying again, so it’s incredibly importiant that any unpatched systems are patched as quickly as possible.&quot;(A very important point at the bottom of the article)

Great write-up. It&#x27;s funny; a mistake&#x2F;exploit allowed the malware; a mistake&#x2F;bug allowed it to be mitigated...by the researchers mistaken intent that registering the domain would simply provide him with sample data.

My understanding is the idea is more to check if a non registered domain behaves as if it was registered. Some sandboxing methods apparently lead to this for some reason.

or instead of relying on the domain name existing, look at the contents of the web page

or just check against a handful of www.{{UUID}}.com domains instead of hard coding anything

Sometimes you&#x27;ve got a deadline and you just have to ship it.

Reddit has been used to point to C&amp;C servers in the past[0], so I wouldn&#x27;t be surprised if some malware does send commands directly via Reddit.[0] <a href="https:&#x2F;&#x2F;www.intego.com&#x2F;mac-security-blog&#x2F;iworm-botnet-uses-reddit-as-command-and-control-center&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.intego.com&#x2F;mac-security-blog&#x2F;iworm-botnet-uses-r...</a>

Pretty interesting, if I&#x27;m reading it correctly the existence of the domain is checked, and if is there, the program is aborted, in order to stop sandbox analysis.I was wondering why they didn&#x27;t just do a simple variant:1) Instead of relying on DNS, which anyone can create, why not make a user account on some well known forum site. Like HN or Reddit.2) Open the site, look for the user&#x27;s page, and check his message titles by hashing them against some hash that can be in your code.3) Detonate if you don&#x27;t see the code, or the user account doesn&#x27;t exist.This would have the useful characteristic that you could start&#x2F;stop the attack using just an internet browser, anywhere. And the code word that you are after would be crypto hashed, so the defenders would have to find your keyword somehow from the hash. Heck, you could confound everyone by turning the thing on or off according to location, time of day, and so on.For extra points make it a blockchain thing. They&#x27;re already using that for payment, right?

&quot;Please turn JavaScript on and reload the page.&quot;Uh, no. Here&#x27;s an archived copy:<a href="https:&#x2F;&#x2F;archive.fo&#x2F;BhLZn" rel="nofollow">https:&#x2F;&#x2F;archive.fo&#x2F;BhLZn</a>

Well, it didn&#x27;t really stop it. It slowed it for a little bit, and then it was modified and spread again.I also wonder if now ransomware developers will leave red-herrings in the code where if the wrong domain is registered, it will do something more destructive.It&#x27;s like knowing which wire to cut when you&#x27;re defusing a bomb!

Wonder how much longer it would have taken to understand the impact if he had just modified the hosts file instead of registering the domain?

Imagine how bad it would have been if someone actually competent had chosen to weaponize one of the NSA exploits?  This seems to have script kiddie written all over it.

All I see here is &quot;Please turn on Javascript and reload the page&quot;.

Not surprising to see 14 year old unpatched software connected to the internet being hacked like that. At least, the ones in charge of budgeting these upgrades should pay a price for failing at doing so, the users are obviously innocent victims.

The hackers would have easily figured out the kill-switch site is up when trying to debug in their own environment

It&#x27;s highly doubtful the malware authors hadn&#x27;t already figured out what went wrong by the time this was published.

Kudos to MalwareTech, but they could have delayed a month or so this publication.

Sadly, the malware author(s) have updated their code and are now spreading a variant without the &quot;kill-switch&quot; domain check: <a href="https:&#x2F;&#x2F;motherboard.vice.com&#x2F;en_us&#x2F;article&#x2F;round-two-wannacry-ransomware-that-struck-the-globe-is-back" rel="nofollow">https:&#x2F;&#x2F;motherboard.vice.com&#x2F;en_us&#x2F;article&#x2F;round-two-wannacr...</a>However, MalwareTech&#x27;s sinkhole intervention has bought enough time for patches to be pushed out, so at this point it is absolutely imperative that everyone apply these patches as soon as possible.

Somewhat reasonable.NSA can be held accountable for not disclosing a vulnerability responsibly but this exploit may have been found anyway by the creators of this ransomware. There is no one person&#x2F;group&#x2F;institution to blame here. It&#x27;s multiple vectors that failed. Are there any reports that connect deaths of patients directly to this ransomware attack?

How reasonable is it to say that NSA are at least in part responsible for deaths resulting from the NHS crisis, since the ransomware is using their exploit?

Can someone write a patch worm that spread and fix the bug by exploiting the bug itself?

Although the domain name registration was intentional, activating the kill switch wasn&#x27;t.The author registered the domain name without knowing what would happen (the virus might as well have wiped the entire disk) and was surprised to see that he had activated a kill switch. That&#x27;s the accidental part.

This is not accidental. Not even close!This story, if true, details a person who profiled this malware and correctly logged the network requests it was making and then correctly identified a fundamental vulnerability in the software. This is not an accident at all - it is rather a profile in supreme competence. We should recognize it as such.

Happy outcome but could have so easily gone the other way. Surely it would have been been more responsible to locally fake the registration of the domain first (apparently as easy as modifying &#x2F;etc&#x2F;hosts in this case) given he had no idea how the payload would respond? o_ONot sure I&#x27;d be singing his praises if his rash decision had triggered the deletion of the encrypted files.

Most of the machines out there are single user, and managed by that user, not by a professional sysadmin. As such, the user has the needed access (root) to install any programs that they want, and all modern OSes allow only the admins to install programs.We already put multiple warning messages when a user decides to execute a suspicious binary, and yet everyone still clicks through any prompt without the second thought ?What&#x27;s your suggestion that a). allows any user to have the machine installed and configured as he wants? and b). do not allow random programs from executing ?

Why do operating systems allow users to run any executable?For programmers it&#x27;s important to be able to - but when you&#x27;re not coding, running any executable is not required.It should be that all programs are in &#x2F;usr&#x2F;bin &amp; the others. Only root can write there. Users shouldn&#x27;t be able to run any program that is located anywhere else.And this would be no problem. Am I wrong?

On Monday, are some governments going to have to make a statement on what they advise owners of infected computers to do?

One of the comments (under the article) is very apt: better wording would have been to say &quot;serendipitous&quot; instead of &quot;accidental&quot;.This guy is sort of a hero, IMO. Given that this is affecting healthcare systems, he might very well have actually saved a bunch of lives! I hope he slept well, totally deserved it :)

<a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;when-the-bad-guys-name-malware-after-you-you&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;when-the-bad-guys-name-malware-a...</a>

Off-topic: what is the site doing &quot;checking your browser&quot; for five seconds before showing the content?I know that this sort of data can be valuable - what browser I use, which plugins are there - but I just assumed everyone was doing this in negligible time frames.
What more is there to check in a browser?

&gt; In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen).Is this something VMs do?
Does anyone have more info on this?

It sounds like the mere existence of a specific DNS A record was the kill switch for the ransomware.
That seems like a pretty bad kill switch, surely the attacker should have required some sort of password to deactivate the ransomware.

Accidentally Stopping a Global Cyber Attack