4 ms·
There are indications that this new version uses a number of ways to spread. Where attacker == the ransomware executable: First is the EternalBlue exploit dev
by SCHiM 9y ago
There are indications that this new version uses a number of ways to spread.
Where attacker == the ransomware executable:
First is the EternalBlue exploit developed by and leaked from the NSA. EternalBlue exploits a flaw in Windows systems on port 445 TCP that can be used to take complete control of an unpatched system. So if an attacker can connect to a vulnerable Windows machine on port 445 tcp they can take control of that machine.
There are also indications that this ransomware sample spreads using legitimate administrative tools in Windows systems such as WMI (execute commands on a remote system if you an administrator account on that PC), and PSEXEC (mount shares on the remote system if you have an administrator account, execute command if ''). These are legitimate (but legacy) Windows components that normally facilitate the management of client PC's when they're connected to a domain at a company or school. So if an attacker can connect to a Windows machine on port 445 tcp (PSEXEC) or 135 (WMI) AND have administrative credentials for that PC they can take complete control of that machine.
These two are probably part of how the ransomware spreads once it gets inside your network. The wcry outbreak a few weeks ago gained access to networks by infecting one or several people via a phishing e-mail with malicious files/links-to-files inside. AFAIK it's currently still unknown/unconfirmed how this outbreak spreads precisely but I'd guess it's either actively being spread by phishing OR it's been present but dormant in these networks for a while after having been installed by phishing over a longer period of time.
If an attacker possesses a 0-day then all bets are probably off, and even step A would not necessarily require any human interaction.
This outbreak is particularly nasty because after it's done encrypting files it supposedly triggers a crash that forces the system to restart. (handy for servers where a user is not normally able to restart the system). Because the system restarts any, artefacts from the encryption process that might be used to decrypt files without paying or restoring backups are gone.
- jsizzle 9y agoActually, I believe phishing / malicious attachment was debunked as the infection vector. Subsequent research found that WC starts scanning hosts and IP's on port 445 to try to find other machines to infect. Source:https://www.us-cert.gov/ncas/alerts/TA17-132A https://www.us-cert.gov/ncas/alerts/TA17-132A "Once the malware starts as a service named mssecsvc2.0, the dropper attempts to create and scan a list of IP ranges on the local network and attempts to connect using UDP ports 137, 138 and TCP ports 139, 445. If a connection to port 445 is successful, it creates an additional thread to propagate by exploiting the SMBv1 vulnerability documented by Microsoft Security bulliten MS17-010."
- thefreeman 9y agoThat only happens after the initial infection into the network. Notice that it says it scans the "local network".
- jsizzle 9y agoThis is minutiae at this point, but it scans the "local" /24. My assumption is that it scans the /24 for any interface available, so if a machine is infected with a public IP, it will start scanning machines on the public Internet. Not to mention other variations may decide to scan more aggressively.
- 110011 9y agoThank you for your explanation (also, others below as well). If I had more time I would try and learn about each of these security exploits because I find it fascinating.