Earlier quoted context omitted.
Psst, downvoters - https://en.wikipedia.org/wiki/Reamde
Downvotes are appropriate. HN isn't the place for in-jokes or pop culture references.
"Don't tell me what I can't do!" - John Locke, LOST
WannaCry – New Variants Detected
71–80 of 164 posts
Re: WannaCry – New Variants Detected
#72What's special about WannaCry that has made this such a widespread thing? I presume there's has been plenty of malware for a while that can propagate itself around a network of unpatched old Windows machines and people have been trying to get users to clicks on emails to infect themselves for years. So why now? What's so special now?
This time you have to pay money. That perks people up.
Re: WannaCry – New Variants Detected
#73I don't get it: why are the using using many fake but valid domains? Wouldn't a non-existing TLD do exactly the same thing while being impossible to register by anyone trying to stop the malware?
Or even just sha256(unixtime().rand()).com
Or a domain in a TLD that allows only second level TLDs (such as some of the commonwealth countries).
Re: WannaCry – New Variants Detected
#74What's special about WannaCry that has made this such a widespread thing? I presume there's has been plenty of malware for a while that can propagate itself around a network of unpatched old Windows machines and people have been trying to get users to clicks on emails to infect themselves for years. So why now? What's so special now?
This time you have to pay money. That perks people up.
Hasn't that been a common thing in bitlocker malware for ages too?
Did they just manage to craft so really persuasive emails this time?
Re: WannaCry – New Variants Detected
#75Earlier quoted context omitted.
This time you have to pay money. That perks people up.
Hasn't that been a common thing in bitlocker malware for ages too? Did they just manage to craft so really persuasive emails this time?
WannaCry is a worm. It does not require people to click on anything in emails to be infected. It scans for vulnerable computers and infects them directly over the network.
Re: WannaCry – New Variants Detected
#76I really am a bit puzzeled by the killswitches. Why does WannaCry have this functionality in the first place? It sounds almost ironically like a hollywood villain mistake.
In this thread or another someone said it was a kill switch for testing it in a sandbox, probably used while developing the code.
Someone said it was to avoid behavior analysis by security researchers
Re: WannaCry – New Variants Detected
#77Earlier quoted context omitted.
Remember the guy which created Silk Road. People talked about him in mythical terms, that he probably has the op-sec of God, but afterwards facts pointed to major mistakes, like connecting identities to his real name, and suddenly everybody was like "how can he be so stupid, doing this while being the owner of a $100 mil criminal empire"
It's a classic asymmetry: the defender needs to defend all the time, the hacker just needs to get in once. Ditto op-sec, the hacker needs to keep their identity protected at all times, the security services only need to connect the dots once.
He kept his diary unlocked along with the rest of his operational assets. That's a far cry from one slip.
Was it ever released how they found and imaged his server though?
Re: WannaCry – New Variants Detected
#78> A new variant with no kill-switch recovered by Kaspersky as a virustotal.com upload — not detected in the Wild. Uploaded to virustotal MEANS found in the wild. That's what admins do when they discover things.
Maybe it was only caught by honeypots and turned in from there.
Re: WannaCry – New Variants Detected
#79I really am a bit puzzeled by the killswitches. Why does WannaCry have this functionality in the first place? It sounds almost ironically like a hollywood villain mistake.
From https://www.malwaretech.com/2017/05/how-to-accidentally-stop..., posted earlier:
In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen).
I believe they were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the domain responding, they know they’re in a sandbox the malware exits to prevent further analysis. This technique isn’t unprecedented and is actually used by the Necurs trojan (they will query 5 totally random domains and if they all return the same IP, it will exit); however, because WannaCrypt used a single hardcoded domain, my registration of it caused all infections globally to believe they were inside a sandbox and exit... thus we initially unintentionally prevented the spread and further ransoming of computers infected with this malware. Of course now that we are aware of this, we will continue to host the domain to prevent any further infections from this sample.
Re: WannaCry – New Variants Detected
#80I don't get it: why are the using using many fake but valid domains? Wouldn't a non-existing TLD do exactly the same thing while being impossible to register by anyone trying to stop the malware?
If it's not registerable it's not functional as a kill switch?