WannaCry – New Variants Detected • Hacker News Board

Re: WannaCry – New Variants Detected

#81

Post by ckaygusu » Sun, May 14, 2017, 9:58 PM UTC

Thrillington wrote: post #70

sonium wrote: post #65

I really am a bit puzzeled by the killswitches. Why does WannaCry have this functionality in the first place? It sounds almost ironically like a hollywood villain mistake.

They're more analysis defeaters than killswitches. Some testbeds will respond to all dns lookups as valid. If this is the case the binary assumes its in a testbed and exits to avoid analysis.

I understand that it serves to defeat analysis, but... it sounds like it could be trivially circumvented. Why bother in the first place?

Re: WannaCry – New Variants Detected

#82

Post by [deleted] » Sun, May 14, 2017, 10:00 PM UTC

lossolo wrote: post #59

kps wrote: post #51

Earlier quoted context omitted.

If you're talking about an MRI machine, and you put it on the goddamned internet, $300 is actually a pretty cheap security tutorial.

You do not need to put it on the Internet. It only needs to be connected to local network and it will be infected by someone connecting their laptop to it.

[deleted]

Re: WannaCry – New Variants Detected

#83

Post by tjohns » Sun, May 14, 2017, 10:04 PM UTC

TylerE wrote: post #80

rnhmjoj wrote: post #66

I don't get it: why are the using using many fake but valid domains? Wouldn't a non-existing TLD do exactly the same thing while being impossible to register by anyone trying to stop the malware?

If it's not registerable it's not functional as a kill switch?

It's not supposed to be a kill switch. (Even though it works as one.)

The domain check is there to detect whether the infection is running in a sandbox environment. If the domain check succeeds, it assumes it's being analyzed and aborts.

Or at least that's the prevailing theory.

Re: WannaCry – New Variants Detected

#84

Post by barrkel » Sun, May 14, 2017, 10:07 PM UTC

rnhmjoj wrote: post #66

I don't get it: why are the using using many fake but valid domains? Wouldn't a non-existing TLD do exactly the same thing while being impossible to register by anyone trying to stop the malware?

It's testing to see if its C&C servers are being MITM for analysis. It does this by checking a bunch of random domains and seeing if they all resolve to the same IP. A completely random domain, rather than a hard-coded random domain, would do just as well, but that's not what was coded in.

Re: WannaCry – New Variants Detected

#85

Post by toyg » Sun, May 14, 2017, 10:09 PM UTC

rhubarbcustard wrote: post #68

What's special about WannaCry that has made this such a widespread thing? I presume there's has been plenty of malware for a while that can propagate itself around a network of unpatched old Windows machines and people have been trying to get users to clicks on emails to infect themselves for years. So why now? What's so special now?

Most vulnerabilities are limited to old releases or new releases, whereas "EternalBlue" affected all Windows versions across the board. The patches are less than two months old, so there was a chance to exploit old machines and newer ones that slow IT might have left vulnerable. This is why someone invested a bit in making the exploit wormable and unleashed it, the potential pool of victims was bigger than usual.

Re: WannaCry – New Variants Detected

#86

Post by reitanqild » Sun, May 14, 2017, 10:13 PM UTC

sonium wrote: post #65

I really am a bit puzzeled by the killswitches. Why does WannaCry have this functionality in the first place? It sounds almost ironically like a hollywood villain mistake.

: Alternative:

It is not a ransomware operation but a counter-intel ooeration against security researchers.

This is starting to look dumb now, maybe researchers will let their guard down and blog even more about internal procedures?

Or maybe there is a hidden payload (Just a crazy idea based on the ovservation that there are multiple versions with corrupted payloads)

Re: WannaCry – New Variants Detected

#87

Post by nathan_f77 » Sun, May 14, 2017, 10:16 PM UTC

I think it's hilarious how these "kill switches" are supposedly meant to detect sandboxes, to make it harder for security researchers to analyze the malware. While actually making it easy for security researchers to completely disable all installations around the entire world.

That's just what I heard, but it makes sense. There are far more sane ways to implement a kill switch without using unregistered domains. (For instance, using a registered domain.)

Re: WannaCry – New Variants Detected

#88

Post by nathan_f77 » Sun, May 14, 2017, 10:18 PM UTC

kuschku wrote: post #73

rnhmjoj wrote: post #66

I don't get it: why are the using using many fake but valid domains? Wouldn't a non-existing TLD do exactly the same thing while being impossible to register by anyone trying to stop the malware?

Or even just sha256(unixtime().rand()).com Or a domain in a TLD that allows only second level TLDs (such as some of the commonwealth countries).

> sha256(unixtime().rand()).com

Yep, that's the way to do it.

Re: WannaCry – New Variants Detected

#89

Post by boomboomsubban » Sun, May 14, 2017, 10:32 PM UTC

rhubarbcustard wrote: post #68

What's special about WannaCry that has made this such a widespread thing? I presume there's has been plenty of malware for a while that can propagate itself around a network of unpatched old Windows machines and people have been trying to get users to clicks on emails to infect themselves for years. So why now? What's so special now?

It's not "old Windows machines," it's XP to Server 2012. It also isn't clear that it came from e-mails yet. It's widespread, easy to propagate, and is hitting the places most affected by Windows 10's advanced telemetry and hidden update.

Re: WannaCry – New Variants Detected

#90

Post by xj9 » Sun, May 14, 2017, 10:38 PM UTC

Sir_Cmpwn wrote: post #18

SXX wrote: post #9

Earlier quoted context omitted.

Do you seriously expect criminals are dumb enough to leave any useful information there?

Do you seriously expect most criminals are intelligent?

not criminals who get caught, no. a good "criminal" is invisible and manages to get away with their crime. these aren't people you hear about, because then they'd be failures.