5 ms·

Edit: Botnet stats and spread (switch to 24H to see full picture): https://intel.malwaretech.com/botnet/wcrypt https://intel.malwaretech.com/botnet/wcrypt Live

Edit: Botnet stats and spread (switch to 24H to see full picture): https://intel.malwaretech.com/botnet/wcrypt https://intel.malwaretech.com/botnet/wcrypt Live map: https://intel.malwaretech.com/WannaCrypt.html https://intel.malwaretech.com/WannaCrypt.html Relevant MS security bulletin: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx https://technet.microsoft.com/en-us/library/security/ms17-01... Edit: Analysis from Kaspersky Lab: https://securelist.com/blog/incidents/78351/wannacry-ransomware-used-in-widespread-attacks-all-over-the-world/ https://securelist.com/blog/incidents/78351/wannacry-ransomw...

dhimes 9y ago
Are we watching this thing wake up right now?
- devrandomguy 9y ago
  We are seeing new requests from existing bots, the historical data is not shown on this map.
  - dhimes 9y ago
    Gotcha. So yeah, we're seeing it wake up. The first little increase (up to 600) was about the time the article was published.
    - knowaveragejoe 9y ago
      Where are you seeing this? This isn't historical data.
      - squeaky-clean 9y ago
        Here's a page with more info https://intel.malwaretech.com/botnet/wcrypt https://intel.malwaretech.com/botnet/wcrypt
      - dhimes 9y ago
        Yeah it scrolls off to the left. So you came an hour after my comment and it was gone. Heck it was almost gone by my second comment.
- jdironman 9y ago
  If so, that is both scary and exciting.
  - brilliantcode 9y ago
    it took me a while to realize this is live....
    - jdironman 9y ago
      I am curious. How is this tracked? What signature or what component are they looking for to be able to say "Yeah, here is another one"? I'm just curious and would like someone with more experience to weigh in. EDIT: To add on further to my question, I wonder why it does not use a terrain / city / province overlay instead of all black? It seems it would be much more useful to us network and sysadmins out there just in case we realized "Oh, hey that dot is right on top of where we work out of. I should probably fire up WireShark or something and test for infected systems."
hackuser 9y ago
> from Kaspersky Lab ... the lab with ties to Russian intelligence, who are suspected of leaking the NSA tools.
- civilian 9y ago
  Your point?
ptr_void 9y ago
I don't understand. What exactly do the live map points represents and where does the data come from?
- iotasigma 9y ago
  https://www.malwaretech.com/2016/01/exploring-peer-to-peer-botnets.html https://www.malwaretech.com/2016/01/exploring-peer-to-peer-b...
  - ptr_void 9y ago
    That's amazing, thanks for the link.
  - gech 9y ago
    >To ensure the entire network is discovered, we should start the crawler off with multiple supernode IPs and store all IPs found into a database, then each time we restart the crawler we seed it with the list of IPs found during the previous crawler; repeating this process for a couple of hours ensure all online nodes are found. This would just discover supernodes though right? Or any node at some point broadcasts as a supernode?
    - iotasigma 9y ago
      Yes to your first question, no to your second. He goes on to explain that, "In order to map all workers, we’d need to set up multiple supernodes across the botnet which log incoming connections (obviously every worker doesn’t connect to every supernode at the same time, so it’s important that our supernodes have a stronger presence in the botnet)." From what I understand the process is: 1. Write a program to pretend to be a compromised peer requesting a connection to a Supernode in order to obtain a peer list of other Supernodes. 2. Recursively crawl for existing Supernodes + the list of Supernode IPs. Store all addresses found. 3. Set up one or more Supernodes and 'infiltrate' the peer list of already established Supernodes. Log incoming connections from Workers. http://whatis.techtarget.com/definition/botnet-sinkhole http://whatis.techtarget.com/definition/botnet-sinkhole
  - 9y ago
pmoleri 9y ago
Great info. So, for the layman. How vulnerable are users behind a firewall or broadband router?
- davidpardo 9y ago
  Pretty safe until a machine in the network gets infected. The first infection comes from a phishing email or similar. From then on, the worm infects other machines connected to the same network, but usually not across the internet. It uses a vulnerability in a protocol that's used for network sharing, and that's usually blocked at your router
arthurfm 9y ago
MalwareTech found the kill switch for WannaCrypt too. https://www.theguardian.com/technology/2017/may/13/accidental-hero-finds-kill-switch-to-stop-spread-of-ransomware-cyber-attack https://www.theguardian.com/technology/2017/may/13/accidenta... https://twitter.com/MalwareTechBlog/status/863187104716685312 https://twitter.com/MalwareTechBlog/status/86318710471668531... https://twitter.com/MalwareTechBlog/status/863189077843116032 https://twitter.com/MalwareTechBlog/status/86318907784311603...
- whatnotests 9y ago
  This sounds like something straight out of a James Bond movie.
  - mirimir 9y ago
    That was a dumb move by the malware coder ;) Wouldn't you want to hide a kill switch?
    - tempay 9y ago
      The MalwareTech write up gives a plausible reason for the developer having accidentally added the kill switch: > I believe they were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the domain responding, they know they’re in a sandbox the malware exits to prevent further analysis.
- pradeepchhetri 9y ago
  MalwareTech wrote a blog about it: https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html https://www.malwaretech.com/2017/05/how-to-accidentally-stop...
bitmapbrother 9y ago
What is the significance of the time span indicators? Does the 1M selection indicate how many computers remain infected or how many that were infected within that time span?

dhimes 9y ago

Are we watching this thing wake up right now?

devrandomguy 9y ago
We are seeing new requests from existing bots, the historical data is not shown on this map.
- dhimes 9y ago
  Gotcha. So yeah, we're seeing it wake up. The first little increase (up to 600) was about the time the article was published.
  - knowaveragejoe 9y ago
    Where are you seeing this? This isn't historical data.
    - squeaky-clean 9y ago
      Here's a page with more info https://intel.malwaretech.com/botnet/wcrypt https://intel.malwaretech.com/botnet/wcrypt
    - dhimes 9y ago
      Yeah it scrolls off to the left. So you came an hour after my comment and it was gone. Heck it was almost gone by my second comment.
jdironman 9y ago
If so, that is both scary and exciting.
- brilliantcode 9y ago
  it took me a while to realize this is live....
  - jdironman 9y ago
    I am curious. How is this tracked? What signature or what component are they looking for to be able to say "Yeah, here is another one"? I'm just curious and would like someone with more experience to weigh in. EDIT: To add on further to my question, I wonder why it does not use a terrain / city / province overlay instead of all black? It seems it would be much more useful to us network and sysadmins out there just in case we realized "Oh, hey that dot is right on top of where we work out of. I should probably fire up WireShark or something and test for infected systems."

hackuser 9y ago

> from Kaspersky Lab ... the lab with ties to Russian intelligence, who are suspected of leaking the NSA tools.

civilian 9y ago
Your point?

ptr_void 9y ago

I don't understand. What exactly do the live map points represents and where does the data come from?

iotasigma 9y ago
https://www.malwaretech.com/2016/01/exploring-peer-to-peer-botnets.html https://www.malwaretech.com/2016/01/exploring-peer-to-peer-b...
- ptr_void 9y ago
  That's amazing, thanks for the link.
- gech 9y ago
  >To ensure the entire network is discovered, we should start the crawler off with multiple supernode IPs and store all IPs found into a database, then each time we restart the crawler we seed it with the list of IPs found during the previous crawler; repeating this process for a couple of hours ensure all online nodes are found. This would just discover supernodes though right? Or any node at some point broadcasts as a supernode?
  - iotasigma 9y ago
    Yes to your first question, no to your second. He goes on to explain that, "In order to map all workers, we’d need to set up multiple supernodes across the botnet which log incoming connections (obviously every worker doesn’t connect to every supernode at the same time, so it’s important that our supernodes have a stronger presence in the botnet)." From what I understand the process is: 1. Write a program to pretend to be a compromised peer requesting a connection to a Supernode in order to obtain a peer list of other Supernodes. 2. Recursively crawl for existing Supernodes + the list of Supernode IPs. Store all addresses found. 3. Set up one or more Supernodes and 'infiltrate' the peer list of already established Supernodes. Log incoming connections from Workers. http://whatis.techtarget.com/definition/botnet-sinkhole http://whatis.techtarget.com/definition/botnet-sinkhole
- 9y ago

pmoleri 9y ago

Great info. So, for the layman. How vulnerable are users behind a firewall or broadband router?

davidpardo 9y ago
Pretty safe until a machine in the network gets infected. The first infection comes from a phishing email or similar. From then on, the worm infects other machines connected to the same network, but usually not across the internet. It uses a vulnerability in a protocol that's used for network sharing, and that's usually blocked at your router

arthurfm 9y ago

MalwareTech found the kill switch for WannaCrypt too. https://www.theguardian.com/technology/2017/may/13/accidental-hero-finds-kill-switch-to-stop-spread-of-ransomware-cyber-attack https://www.theguardian.com/technology/2017/may/13/accidenta... https://twitter.com/MalwareTechBlog/status/863187104716685312 https://twitter.com/MalwareTechBlog/status/86318710471668531... https://twitter.com/MalwareTechBlog/status/863189077843116032 https://twitter.com/MalwareTechBlog/status/86318907784311603...

whatnotests 9y ago
This sounds like something straight out of a James Bond movie.
- mirimir 9y ago
  That was a dumb move by the malware coder ;) Wouldn't you want to hide a kill switch?
  - tempay 9y ago
    The MalwareTech write up gives a plausible reason for the developer having accidentally added the kill switch: > I believe they were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the domain responding, they know they’re in a sandbox the malware exits to prevent further analysis.
pradeepchhetri 9y ago
MalwareTech wrote a blog about it: https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html https://www.malwaretech.com/2017/05/how-to-accidentally-stop...

bitmapbrother 9y ago

What is the significance of the time span indicators? Does the 1M selection indicate how many computers remain infected or how many that were infected within that time span?