6 ms·

What's special about WannaCry that has made this such a widespread thing? I presume there's has been plenty of malware for a while that can propagate itself aro

What's special about WannaCry that has made this such a widespread thing? I presume there's has been plenty of malware for a while that can propagate itself around a network of unpatched old Windows machines and people have been trying to get users to clicks on emails to infect themselves for years. So why now? What's so special now?

pishpash 9y ago
This time you have to pay money. That perks people up.
- rhubarbcustard 9y ago
  Hasn't that been a common thing in bitlocker malware for ages too? Did they just manage to craft so really persuasive emails this time?
  - CydeWeys 9y ago
    WannaCry is a worm. It does not require people to click on anything in emails to be infected. It scans for vulnerable computers and infects them directly over the network.
    - deleted 9y ago
      [deleted]
toyg 9y ago
Most vulnerabilities are limited to old releases or new releases, whereas "EternalBlue" affected all Windows versions across the board. The patches are less than two months old, so there was a chance to exploit old machines and newer ones that slow IT might have left vulnerable. This is why someone invested a bit in making the exploit wormable and unleashed it, the potential pool of victims was bigger than usual.
boomboomsubban 9y ago
It's not "old Windows machines," it's XP to Server 2012. It also isn't clear that it came from e-mails yet. It's widespread, easy to propagate, and is hitting the places most affected by Windows 10's advanced telemetry and hidden update.
- rl3 9y ago
  >...and is hitting the places most affected by Windows 10's advanced telemetry and hidden update. Can you elaborate on this?
  - boomboomsubban 9y ago
    Places where uptime is vital were bothered by the 10 rollout and may have altered their patching method after. And places with serious privacy concerns must be wary of Windows updates. Enterprise is supposed to allow everyone to be shut off, but mistakes can be very expensive.
- johnmcd3 9y ago
  > It's not "old Windows machines," it's XP to Server 2012. This is incorrect or at least misleading. Any machine still running Windows XP, is by any reasonable definition, an "old Windows machine." Windows XP was first released in 2001, and actively supported with updates for 12 years. Windows XP hasn't been supported with critical security patches for over 3 years. Windows Server 2012 is under active support until Oct. 10, 2023, and was patched against this vulnerability in MS17-010. See the middle of the page here: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx https://technet.microsoft.com/en-us/library/security/ms17-01... If your Windows Server 2012 machine fell victim to this ransomware, it was for the same reason as those running the newer Windows Server 2016 (also vulnerable to WannaCry): because someone didn't apply security patches in a timely manner. This ransomware was particularly damaging because of it's unusually wormable nature. (Ring 0, commonly enabled networking protocol, no user interaction required.)
  - boomboomsubban 9y ago
    An XP computer is old, Windows 8.1 is one generation back. Both are vulnerable to this exploit. Yes, patches have been available for supported versions, I don't know how that makes anything I said wrong or misleading.
guscost 9y ago
Basically, this is a successful old-fashioned computer worm, operating at a scale we've not seen for more than 10 years. On modern operating systems most attack surfaces that were easy to crack in the past have been locked down at least to the point where it is nearly impossible to find an exploit in a common protocol like this that doesn't require user interaction (hence the popularity of phishing). Apart from that we've just gotten lucky, really. Many of the most catastrophic bugs in recent years (Heartbleed, etc) were never successfully turned into exploits of this nature. Instead they were discovered and fixed quickly by researchers. This worm targets older Windows versions that are installed (and use the exploited protocol) in a lot of critical infrastructure, and the worm was hoarded by the NSA all packaged up and ready to deploy (because it can propagate through SMB and therefore would be perfect for a future Stuxnet-like operation). So of course some criminals get their hands on it, and hey look it works. It's an absolutely bonkers story.
- gerdesj 9y ago
  "older Windows versions" Win 10 is vulnerable without the patch that came out in march.
  - guscost 9y ago
    Wow, I've heard various rumors about the scope but that is pretty serious.
  - cschmittiey 9y ago
    Any chance you've got a source on that? Most everything I've read said Win10 was protected since March. Edit: I'm dumb, misread the above comment as saying "Win10 was affected even with the patch in March."
  - criley2 9y ago
    >Win 10 is vulnerable without the patch that came out in march Microsoft clearly disputes this in their own posts on the subject. https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ https://blogs.technet.microsoft.com/msrc/2017/05/12/customer... "Customers running Windows 10 were not targeted by the attack today." What's your source?
throwaway91111 9y ago
Well, this is in fact similar to botnets, but the virality was absolutely explosive compared to other ransomware—you typically need to target people.
globile 9y ago
The thing that scares me most is that while this has been a public facing issue, many of these computers at Telefonica, the NHS, and others, have been silently accesible via the exploit for a while. Nobody seems to be talking about this, but we can only guess that a lot of stuff has been compromised and still is. What really worries me is the huge amount of non-patched computers that have not fallen with this specific WannaCry issue and are sitting idly waiting for their glory day.
remx 9y ago
> So why now? I think it's because it's cool to use the word "cyber" now in the news. It makes news outlets appear edgy and with it. Infact these cyber attacks are nothing new, and have been an ongoing problem for organizations like the NHS, the only difference being there is a remarkable uptick in the scale of the attack. The reason it stands out is because it's a cluster, instead of a slow, trickling problem for the NHS and other organizations. > What's so special now? The sophistication and worm capabilities. Were it not for the Shadowbrokers leak, small time malware authors had to use tired old strains of malware to spread. Now they can draw upon the vast arsenal of the Shadowbrokers leak and appear like state actors, which they are not. If anything, the leaks were a blessing, because now we can mitigate against such attacks. NSA's mantra 'NOBUS' (No-one-but-us) does not apply here.

pishpash 9y ago

This time you have to pay money. That perks people up.

rhubarbcustard 9y ago
Hasn't that been a common thing in bitlocker malware for ages too? Did they just manage to craft so really persuasive emails this time?
- CydeWeys 9y ago
  WannaCry is a worm. It does not require people to click on anything in emails to be infected. It scans for vulnerable computers and infects them directly over the network.
  - deleted 9y ago
    [deleted]

toyg 9y ago

Most vulnerabilities are limited to old releases or new releases, whereas "EternalBlue" affected all Windows versions across the board. The patches are less than two months old, so there was a chance to exploit old machines and newer ones that slow IT might have left vulnerable. This is why someone invested a bit in making the exploit wormable and unleashed it, the potential pool of victims was bigger than usual.

boomboomsubban 9y ago

It's not "old Windows machines," it's XP to Server 2012. It also isn't clear that it came from e-mails yet. It's widespread, easy to propagate, and is hitting the places most affected by Windows 10's advanced telemetry and hidden update.

rl3 9y ago
>...and is hitting the places most affected by Windows 10's advanced telemetry and hidden update. Can you elaborate on this?
- boomboomsubban 9y ago
  Places where uptime is vital were bothered by the 10 rollout and may have altered their patching method after. And places with serious privacy concerns must be wary of Windows updates. Enterprise is supposed to allow everyone to be shut off, but mistakes can be very expensive.
johnmcd3 9y ago
> It's not "old Windows machines," it's XP to Server 2012. This is incorrect or at least misleading. Any machine still running Windows XP, is by any reasonable definition, an "old Windows machine." Windows XP was first released in 2001, and actively supported with updates for 12 years. Windows XP hasn't been supported with critical security patches for over 3 years. Windows Server 2012 is under active support until Oct. 10, 2023, and was patched against this vulnerability in MS17-010. See the middle of the page here: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx https://technet.microsoft.com/en-us/library/security/ms17-01... If your Windows Server 2012 machine fell victim to this ransomware, it was for the same reason as those running the newer Windows Server 2016 (also vulnerable to WannaCry): because someone didn't apply security patches in a timely manner. This ransomware was particularly damaging because of it's unusually wormable nature. (Ring 0, commonly enabled networking protocol, no user interaction required.)
- boomboomsubban 9y ago
  An XP computer is old, Windows 8.1 is one generation back. Both are vulnerable to this exploit. Yes, patches have been available for supported versions, I don't know how that makes anything I said wrong or misleading.

guscost 9y ago

Basically, this is a successful old-fashioned computer worm, operating at a scale we've not seen for more than 10 years. On modern operating systems most attack surfaces that were easy to crack in the past have been locked down at least to the point where it is nearly impossible to find an exploit in a common protocol like this that doesn't require user interaction (hence the popularity of phishing). Apart from that we've just gotten lucky, really. Many of the most catastrophic bugs in recent years (Heartbleed, etc) were never successfully turned into exploits of this nature. Instead they were discovered and fixed quickly by researchers. This worm targets older Windows versions that are installed (and use the exploited protocol) in a lot of critical infrastructure, and the worm was hoarded by the NSA all packaged up and ready to deploy (because it can propagate through SMB and therefore would be perfect for a future Stuxnet-like operation). So of course some criminals get their hands on it, and hey look it works. It's an absolutely bonkers story.

gerdesj 9y ago
"older Windows versions" Win 10 is vulnerable without the patch that came out in march.
- guscost 9y ago
  Wow, I've heard various rumors about the scope but that is pretty serious.
- cschmittiey 9y ago
  Any chance you've got a source on that? Most everything I've read said Win10 was protected since March. Edit: I'm dumb, misread the above comment as saying "Win10 was affected even with the patch in March."
- criley2 9y ago
  >Win 10 is vulnerable without the patch that came out in march Microsoft clearly disputes this in their own posts on the subject. https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ https://blogs.technet.microsoft.com/msrc/2017/05/12/customer... "Customers running Windows 10 were not targeted by the attack today." What's your source?

throwaway91111 9y ago

Well, this is in fact similar to botnets, but the virality was absolutely explosive compared to other ransomware—you typically need to target people.

globile 9y ago

The thing that scares me most is that while this has been a public facing issue, many of these computers at Telefonica, the NHS, and others, have been silently accesible via the exploit for a while. Nobody seems to be talking about this, but we can only guess that a lot of stuff has been compromised and still is. What really worries me is the huge amount of non-patched computers that have not fallen with this specific WannaCry issue and are sitting idly waiting for their glory day.

remx 9y ago

> So why now? I think it's because it's cool to use the word "cyber" now in the news. It makes news outlets appear edgy and with it. Infact these cyber attacks are nothing new, and have been an ongoing problem for organizations like the NHS, the only difference being there is a remarkable uptick in the scale of the attack. The reason it stands out is because it's a cluster, instead of a slow, trickling problem for the NHS and other organizations. > What's so special now? The sophistication and worm capabilities. Were it not for the Shadowbrokers leak, small time malware authors had to use tired old strains of malware to spread. Now they can draw upon the vast arsenal of the Shadowbrokers leak and appear like state actors, which they are not. If anything, the leaks were a blessing, because now we can mitigate against such attacks. NSA's mantra 'NOBUS' (No-one-but-us) does not apply here.