PC and servers around the world are currently under attack by a new cyberweapon called WannaCrypt. It is a highly infectious drive-by ransomware attack, and WannaCrypt is spreading “like wildfire” in Europe and other parts of the world. 73 countries have report attacks In May, 2017.

Here is what you need to know about WannaCrypt:

All Windows systems are impacted by a vulnerability in the Windows Server Message Block protocol. WannaCrypt uses an exploit called EternalBlue to infect new PCs without user action.

To protect your system from this exploit, make sure you have applied all available updates and patches available through Windows Update. For more information consult this Microsoft Security Bulletin and this Microsoft Customer Guidance for WannaCrypt Attacks.

Microsoft has set up access for users of Windows XP to get access to the necessary patches. Check this Microsoft Update Catalog site.

Made in the USA

The most disconcerting part of the WannaCrypt story is the use of an American cyberweapon called EternalBlue, which was developed at the National Security Agency (NSA) in Fort Meade, MD. EternalBlue was apparently stolen from the NSA and released onto the Internet by the Shadow Brokers hacker group on April 14, 2017.

I haven’t gone through the Shadow Brokers trove, but if EternalBlue is any indication, it looks like all the years of money and personnel the NSA spent on their spy craft made some pretty slick software for US cyber agents.

Notably, EternalBlue appears to be crafted as a toolkit that can support multiple applications. Such a “divide and conquer” strategy is common when one has a large team of engineers and scientists are working together to build new applications.

By using secret flaws in Microsoft’s SMBv1 file service protocol, EternalBlue gives NSA agents the ability to write custom software to penetrate a target’s computer and perform surreptitious data collection and system modification, all with zero user awareness. This is what I call a “drive-by” or “sneak-and-peak” attack capability, which is much more insidious than a phishing email which requires user activation.

For comparison, look at older ransomware villains like CryptoLocker, that depends on the user clicking on a link or activating executable code to start the attack.

Powered-up with military-grade American cyberweapons, WannaCrypt is a monstrously dangerous new class of malware that is distributed automatically to any Windows computer connected to a network.

Act Now – Eliminate the EternalBlue Vulnerability

This is an IT Red Alert. The NSA’s been compromised, and we’ve got drive-by ransomware in the wild.

Microsoft is working hard to eliminate the flaw. All the details are at Microsoft Security Bulletin MS17-010: Security Update for Microsoft Windows SMB Server.

Hopefully you have been keeping up with your Windows updates, and you have ditched Windows XP long ago. If so, then you’re likely to be protected from the SMBv1 flaws used by EternalBlue. The SMB Server patch was included in most of the March 2017 Microsoft rollup patches.

But, there are literally hundreds of millions of Internet-connected PC’s out in the wild that don’t get the care and feeding they need. Apparently, there are WannaCrypt infections in infrastructure elements in Britain’s National Health Service (NHS) and Telefonica’s telecom operations. Per this Wired article, WannaCrypt is spreading like wildfire and has been reported in 73 countries.

Time to Worry?

EternalBlue uses what is known as a “zero-day vulnerability” which is a flaw or mistake in the code of a computer operating system that can be exploited by external forces to gain control of the target computer.

The light of day exterminates zero-days, so hopefully Microsoft will get most business users cleaned up soon and can put this EternalBlue SMB fiasco behind them. IT administrators should use firewall rules and other tricks to eliminate EternalBlue vulnerability on their edges. I don’t think we’ll see a lot of WannaCrypt attacks here in Silicon Valley where we tend to keep our systems up to date and have a little more advanced service provider networks.

Yes – It is Time to Worry

But, just knowing about EternalBlue does not lessen the threat from other, unknown zero-day exploits.

WannaCrypt deserves fear and respect. WannaCrypt itself is a mutant child like the Alien/Engineer mashup from Ridley Scott’s movie Prometheus. Mashing up hacker tools with the US Military pixie dust has created WannaCrypt, a monstrous new threat.

This powerful creature from Ridley Scott’s Promethus is a hybrid of the famous Alien and the superhuman Engineers. This is like the monster that been created by combining EternalBlue with ransomware

There are dozens if not hundreds of still-secret zero-days in the hands of various actors. Zero-day actors range from individuals, the IT industry, and all the way up to nation-states flexing their military and intelligence-gathering resources.

Another disturbing trend is the packaging of cyberweapons into online services you can buy. If you have the bitcoin, then there is a Cyber-arms Industry where you can find middlemen who will sell you a zero-day exploit. It will cost you, though. Prices for zero-day exploits are estimated to be from $10,000 to $100,000 and up. Someday soon, you’ll be able to go on the dark web and “own” a target’s cyberlife using Zero-Days-as-a-Service (ZDaaS).

What to Do Now?

It seems like a major threshold has been crossed with the NSA being compromised and military-grade cyberweapons are now being mashed up with lucrative criminal schemes like ransomware.

This needs discussion at the federal level. The public needs to become aware of the failure of the NSA to keep a dangerous tool like EternalBlue safeguarded and how the US Government helped to weaponize one of the most dangerous parts of the Internet.

There needs to be a more scientific and common-sense approach to having secure communications and what it means to have privacy in the 21^st century.

Clearly there are major challenges with our basic platforms and operating systems. The best direction for security is the walled-garden approach one can achieve on mobile platforms like iOS and Android. We may never figure out how to eliminate new zero-days on Windows, MacOS and Linux.

In the short term, I am concerned that another new zero-day exploit like WannaCrypt will pop up and have a more widespread impact in the US. If it is serious enough, such an attack could trigger an official response on the part of US Cyber Command. Just think of the unanticipated consequences of the US going public with our cyberweapon capabilities.

Malware Alert: WannaCrypt Weaponizes Ransomware

Made in the USA

Act Now – Eliminate the EternalBlue Vulnerability

Time to Worry?

Yes – It is Time to Worry

What to Do Now?

Related Posts