WannaCry – New Variants Detected • Hacker News Board

Re: WannaCry – New Variants Detected

#61

Post by SomeStupidPoint » Sun, May 14, 2017, 8:51 PM UTC

kps wrote: post #51

dralley wrote: post #43

Earlier quoted context omitted.

If you're talking about an MRI machine, the proper drivers may not exist for a current operating system. The absolute last thing you want is for an image to show up differently on the new system due to changes to OpenGL or something.

If you're talking about an MRI machine, and you put it on the goddamned internet, $300 is actually a pretty cheap security tutorial.

I imagine the infection zigzagged to get there. Something like:

1. A doctor opens an email on an office computer. Infection entrypoint from the internet.

2. The office computer worms it to a patient record server.

3. The patient record computer worms it to an MRI tech computer.

4. The tech computer worms it to the MRI itself. (If it's even hitting MRIs and not just tech computers.)

Each of the machines has a reason it needs to share files/data with the two layers it connects to, and there's no "bad" direct link. The worm exploited the filesharing mechanism.

A high security situation would probably implement a one-way upload from the MRI subsystem (machine + tech computer), but c'mon, lots of us work on networks with filesharing zigzags to penetrate deep in to them.

Re: WannaCry – New Variants Detected

#62

Post by golergka » Sun, May 14, 2017, 9:01 PM UTC

nagvx wrote: post #56

huhtenberg wrote: post #20

Earlier quoted context omitted.

Psst, downvoters - https://en.wikipedia.org/wiki/Reamde

Downvotes are appropriate. HN isn't the place for in-jokes or pop culture references.

As in 'Culture references considered harmful'?

Re: WannaCry – New Variants Detected

#63

Post by rickdg » Sun, May 14, 2017, 9:02 PM UTC

nthcolumn wrote: post #33

Nrsolis wrote: post #13

Earlier quoted context omitted.

The initial attack vector is via an email attachment. Once it's infected a host, the SMB scanning for vulnerable hosts is launched and secondary infections begin with no further user action required.

Why isn't the internet alive with the email subject line then? The email would be multi-lingual too?

Spear phishing is now a lot more effective.

Re: WannaCry – New Variants Detected

#64

Post by Aldo_MX » Sun, May 14, 2017, 9:03 PM UTC

eriknstr wrote: post #29

acd wrote: post #16

These systems would be better of security wise if they would use the latest open source operating system including the embedded code. The damage this will cause to embedded systems is distasteful.

I'm am very much in favor of open source always but let's not pretend that embedded systems don't end up with out of date software just because it's open source. In the case of WannaCrypt0r, the vulnerability had already been fixed by Microsoft but those who were hit hadn't patched because as discussed elsewhere applying patches may break things so some postpone or ignore it. Same thing could have happened to a syste…

Thank you for your thoughtful comment... People who get drunk with the Linux cool-aid are really tiresome. They believe they're safe by using Linux, and completely disregard good security practices with their windows-bashing speech.

Re: WannaCry – New Variants Detected

#65

Post by sonium » Sun, May 14, 2017, 9:04 PM UTC

I really am a bit puzzeled by the killswitches. Why does WannaCry have this functionality in the first place? It sounds almost ironically like a hollywood villain mistake.

Re: WannaCry – New Variants Detected

#66

Post by rnhmjoj » Sun, May 14, 2017, 9:05 PM UTC

I don't get it: why are the using using many fake but valid domains? Wouldn't a non-existing TLD do exactly the same thing while being impossible to register by anyone trying to stop the malware?

Re: WannaCry – New Variants Detected

#67

Post by mef » Sun, May 14, 2017, 9:07 PM UTC

rnhmjoj wrote: post #66

I don't get it: why are the using using many fake but valid domains? Wouldn't a non-existing TLD do exactly the same thing while being impossible to register by anyone trying to stop the malware?

shh

Re: WannaCry – New Variants Detected

#68

Post by rhubarbcustard » Sun, May 14, 2017, 9:09 PM UTC

What's special about WannaCry that has made this such a widespread thing? I presume there's has been plenty of malware for a while that can propagate itself around a network of unpatched old Windows machines and people have been trying to get users to clicks on emails to infect themselves for years.

So why now? What's so special now?

Re: WannaCry – New Variants Detected

#69

Post by mattmanser » Sun, May 14, 2017, 9:10 PM UTC

sonium wrote: post #65

I really am a bit puzzeled by the killswitches. Why does WannaCry have this functionality in the first place? It sounds almost ironically like a hollywood villain mistake.

In this thread or another someone said it was a kill switch for testing it in a sandbox, probably used while developing the code.

Re: WannaCry – New Variants Detected

#70

Post by Thrillington » Sun, May 14, 2017, 9:15 PM UTC

sonium wrote: post #65

I really am a bit puzzeled by the killswitches. Why does WannaCry have this functionality in the first place? It sounds almost ironically like a hollywood villain mistake.

They're more analysis defeaters than killswitches. Some testbeds will respond to all dns lookups as valid. If this is the case the binary assumes its in a testbed and exits to avoid analysis.