Skip to content
Rabin Poudyal
Page 9-1
9-1 Incidents

9.11WannaCry and the accidental kill switch

Ransomware spread itself between Windows machines through a flaw Microsoft had patched two months earlier, until a researcher registered the one domain every copy checked before it ran.

Microsoft Windows users, including the NHS · 12 May 2017 · Attacks at scale

  1. 1Read
    Blast radius
    More than 200,000 computers in at least 100 countries, by the UK National Audit Office (NAO). In England's National Health Service (NHS), at least 80 of 236 trusts were affected, 34 of them infected and locked out of devices, along with 595 GP (general practitioner) practices; 6,912 appointments were known to be cancelled, and more than 19,000 by NHS England's estimate.
    Duration
    The campaign began at around 08:00 Coordinated Universal Time (UTC) on Friday 12 May 2017, by MalwareTech's reading of lookups for the domain, and the kill switch stopped its spread that evening. NHS England stood its incident down at 5:30 PM on 19 May.
  2. 2Follow

    What happened, in order

    1. 14 Mar 2017

      Microsoft publishes security bulletin MS17-010, rated critical for every supported version of Windows: specially crafted messages to an SMBv1 (Server Message Block version 1) server can run code on it. Windows XP and Server 2003, out of support, are not covered.

    2. 17 Mar and 28 Apr

      NHS Digital issues alerts asking NHS trusts to apply the patch.

    3. 14 Apr 2017

      A group calling itself the Shadow Brokers releases a large set of exploits. Microsoft triages them that day: "EternalBlue", among others, is addressed by MS17-010.

    4. 12 May, ~08:00 UTC

      The campaign starts. WannaCry encrypts files, demands a ransom, and scans random addresses on port 445 for other machines to infect, without anyone opening anything.

    5. 12 May, 1:06 PM

      After trusts start reporting problems in the late morning, NHS England's emergency preparedness team gets its first notification. At 4:00 PM it declares a national major incident.

    6. 12 May, afternoon

      A researcher who writes as MalwareTech runs a sample, sees it query an unregistered domain and registers the domain, as he routinely does with malware's control servers, to track infections. Without knowing it yet, he has stopped the malware.

    7. 12 May, evening

      Testing confirms it: with the domain reachable the sample exits; with the domain blocked it encrypts the machine. Microsoft takes the highly unusual step of releasing a patch for Windows XP, Windows 8 and Server 2003.

    8. 19 Dec 2017

      The UK and US governments attribute WannaCry to North Korean actors.

  3. 3Find

    Root cause

    Note

    WannaCry was ransomware with a worm attached. After encrypting a machine it scanned random IP (Internet Protocol) addresses on port 445, the port SMB uses for Windows file sharing, and broke into any machine that still had the SMBv1 flaw MS17-010 fixed. Microsoft's own account of the exploits released in April lists EternalBlue as one that MS17-010 addresses. So any unpatched Windows machine that another infected machine could reach on port 445 could be infected with no one clicking anything.

    Before it did anything, each copy tried to connect to a single hardcoded domain. If the connection failed, it went on to encrypt the machine; if it succeeded, it exited. MalwareTech registered the domain to watch the infection spread, and every new copy that reached it shut itself down. He believes the check was a badly thought-out anti-analysis trick, not a deliberate off switch: some analysis sandboxes answer every lookup as if the domain existed, so a successful connection told the malware it was being watched. Because the domain was the same in every copy, registering it made every infection worldwide think it was in a sandbox.

    One domain, every copy WannaCry reached Windows machines that had SMBv1 open on port 445 and had not applied MS17-010, available since 14 March 2017, using the EternalBlue exploit. Before running, each copy tried to connect to one hardcoded domain. With no answer it encrypted the machine and scanned port 445 for more targets. Once MalwareTech registered the domain on 12 May 2017, the connection succeeded, the copy took itself to be in an analysis sandbox and exited, and new infections stopped everywhere. The target The worm Before it runs The outcome Unpatched Windows SMBv1 open on 445 WannaCry copy EternalBlue exploit Kill-switch check one hardcoded domain Encrypt and spread if the domain is silent MS17-010 patch out since 14 Mar 2017 Domain registered by MalwareTech, 12 May Copy exits if the domain answers every copy checked the same domain, so registering it once stopped new infections everywhere; a patched machine was never reached
    The worm reached any unpatched machine with port 445 open, and every copy asked for the same domain first. Once that domain answered, every new copy exited.
  4. 4Trace

    Why it got through

    The fix existed and had not been applied. All the NHS organisations WannaCry infected had unpatched or unsupported Windows. The common telling blames old Windows XP, but NHS Digital told the NAO that most infected NHS devices were on Windows 7, which was supported and simply unpatched, and that XP machines were in the minority. NHS Digital had sent alerts in March and April asking trusts to patch, and before 12 May the Department of Health had no formal way to check whether they had.

    Patching was not the only layer. The NAO found that managing the firewalls facing the internet would have protected organisations whether they had patched or not. The worm needed both holes, a reachable port and an unpatched machine, and it found many places where both were open. What stopped it in the end was a mistake in the malware, found by a researcher acting on a habit. MalwareTech warned that nothing stopped the authors from removing the check and trying again.

  5. 5Check

    The lesson

    Unpatched systems are the real attack surface, so patching speed is a security control and exposure is another. Know which machines can reach which ports, and do not plan your defence around the attacker's mistakes.

  6. 6Change

    What changed afterwards

    Microsoft released emergency patches for Windows XP, Windows 8 and Server 2003, versions that were only in paid custom support, on the day of the attack. NHS England and NHS Digital wrote to every trust on 14 May advising against paying the ransom, and by that evening 3,486 GP practices, 44 percent, had applied the patch. No NHS organisation paid.

    The NAO's investigation, published in October 2017, found that the Department of Health had been warned of the risk of cyber attacks a year before and had not responded formally until July 2017, and that none of the 88 trusts NHS Digital had assessed on site had passed. NHS boards were asked to make sure every one of the 39 alerts NHS Digital had issued between March and May 2017 had been carried out. The Department of Health and Social Care later put the cost to the NHS at about 92 million pounds, as an approximate estimate.

  7. 7Verify

    Where the sources differ

    • The scale differs by source. The NAO says more than 200,000 computers in at least 100 countries. The UK Foreign Office's attribution statement says 300,000 computers in 150 countries, including 48 NHS trusts; the NAO counts 34 trusts infected and 80 affected.
    • No single source used here says WannaCry used EternalBlue leaked from the NSA (National Security Agency). Microsoft's post of 14 May says the exploits used were drawn from those stolen from the NSA, and Microsoft's April triage lists EternalBlue as fixed by MS17-010; MalwareTech, on the day, only suspected the leaked exploit.
    • Windows XP is often blamed. NHS Digital told the NAO that most infected NHS devices were unpatched Windows 7, with XP in the minority; about 5 percent of NHS devices still ran XP on 12 May.
    • The NAO describes the domain as a "kill-switch". MalwareTech believes it was a botched sandbox check, and says he registered it to track the infection without knowing it would stop it. MalwareTech is the name on the post; the researcher is widely known as Marcus Hutchins, a name the sources used here do not give.
    • MalwareTech's post gives no exact time for the registration. The only clock time in it is 6:23 PM British Summer Time, when he asked a colleague to check whether the domain would change. The NAO says the kill switch was activated on the evening of 12 May. NHS England's times are UK local time.
    • The quote that the attack "could have been prevented by the NHS following basic IT security best practice" is from the head of the NAO, in its press release; the report itself says organisations "could have taken relatively simple action to protect themselves".
  8. 8Source

    Sources

  9. 9Go