Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WannaCry – New Variants Detected

blog.comae.io

Post reply on HN
Print view View original

91–100 of 164 posts

Re: WannaCry – New Variants Detected

#91

Post by guscost »

rhubarbcustard wrote: post #68

What's special about WannaCry that has made this such a widespread thing? I presume there's has been plenty of malware for a while that can propagate itself around a network of unpatched old Windows machines and people have been trying to get users to clicks on emails to infect themselves for years. So why now? What's so special now?

Basically, this is a successful old-fashioned computer worm, operating at a scale we've not seen for more than 10 years. On modern operating systems most attack surfaces that were easy to crack in the past have been locked down at least to the point where it is nearly impossible to find an exploit in a common protocol like this that doesn't require user interaction (hence the popularity of phishing). Apart from that we've just gotten lucky, really. Many of the most catastrophic bugs in recent years (Heartbleed, etc) were never successfully turned into exploits of this nature. Instead they were discovered and fixed quickly by researchers.

This worm targets older Windows versions that are installed (and use the exploited protocol) in a lot of critical infrastructure, and the worm was hoarded by the NSA all packaged up and ready to deploy (because it can propagate through SMB and therefore would be perfect for a future Stuxnet-like operation). So of course some criminals get their hands on it, and hey look it works. It's an absolutely bonkers story.

Re: WannaCry – New Variants Detected

#92

Post by throwaway91111 »

rhubarbcustard wrote: post #68

What's special about WannaCry that has made this such a widespread thing? I presume there's has been plenty of malware for a while that can propagate itself around a network of unpatched old Windows machines and people have been trying to get users to clicks on emails to infect themselves for years. So why now? What's so special now?

Well, this is in fact similar to botnets, but the virality was absolutely explosive compared to other ransomware—you typically need to target people.

Re: WannaCry – New Variants Detected

#93

Post by gerdesj »

guscost wrote: post #91
rhubarbcustard wrote: post #68

What's special about WannaCry that has made this such a widespread thing? I presume there's has been plenty of malware for a while that can propagate itself around a network of unpatched old Windows machines and people have been trying to get users to clicks on emails to infect themselves for years. So why now? What's so special now?

Basically, this is a successful old-fashioned computer worm, operating at a scale we've not seen for more than 10 years. On modern operating systems most attack surfaces that were easy to crack in the past have been locked down at least to the point where it is nearly impossible to find an exploit in a common protocol like this that doesn't require user interaction (hence the popularity of phishing). Apart from that…

"older Windows versions"

Win 10 is vulnerable without the patch that came out in march.

Re: WannaCry – New Variants Detected

#94

Post by guscost »

gerdesj wrote: post #93
guscost wrote: post #91

Earlier quoted context omitted.

Basically, this is a successful old-fashioned computer worm, operating at a scale we've not seen for more than 10 years. On modern operating systems most attack surfaces that were easy to crack in the past have been locked down at least to the point where it is nearly impossible to find an exploit in a common protocol like this that doesn't require user interaction (hence the popularity of phishing). Apart from that…

"older Windows versions" Win 10 is vulnerable without the patch that came out in march.

Wow, I've heard various rumors about the scope but that is pretty serious.

Re: WannaCry – New Variants Detected

#95

Post by johnmcd3 »

boomboomsubban wrote: post #89
rhubarbcustard wrote: post #68

What's special about WannaCry that has made this such a widespread thing? I presume there's has been plenty of malware for a while that can propagate itself around a network of unpatched old Windows machines and people have been trying to get users to clicks on emails to infect themselves for years. So why now? What's so special now?

It's not "old Windows machines," it's XP to Server 2012. It also isn't clear that it came from e-mails yet. It's widespread, easy to propagate, and is hitting the places most affected by Windows 10's advanced telemetry and hidden update.

> It's not "old Windows machines," it's XP to Server 2012.

This is incorrect or at least misleading.

Any machine still running Windows XP, is by any reasonable definition, an "old Windows machine." Windows XP was first released in 2001, and actively supported with updates for 12 years. Windows XP hasn't been supported with critical security patches for over 3 years.

Windows Server 2012 is under active support until Oct. 10, 2023, and was patched against this vulnerability in MS17-010. See the middle of the page here: https://technet.microsoft.com/en-us/library/security/ms17-01... If your Windows Server 2012 machine fell victim to this ransomware, it was for the same reason as those running the newer Windows Server 2016 (also vulnerable to WannaCry): because someone didn't apply security patches in a timely manner.

This ransomware was particularly damaging because of it's unusually wormable nature. (Ring 0, commonly enabled networking protocol, no user interaction required.)

Re: WannaCry – New Variants Detected

#96

Post by cschmittiey »

gerdesj wrote: post #93
guscost wrote: post #91

Earlier quoted context omitted.

Basically, this is a successful old-fashioned computer worm, operating at a scale we've not seen for more than 10 years. On modern operating systems most attack surfaces that were easy to crack in the past have been locked down at least to the point where it is nearly impossible to find an exploit in a common protocol like this that doesn't require user interaction (hence the popularity of phishing). Apart from that…

"older Windows versions" Win 10 is vulnerable without the patch that came out in march.

Any chance you've got a source on that? Most everything I've read said Win10 was protected since March.

Edit: I'm dumb, misread the above comment as saying "Win10 was affected even with the patch in March."

Re: WannaCry – New Variants Detected

#97

Post by rl3 »

boomboomsubban wrote: post #89
rhubarbcustard wrote: post #68

What's special about WannaCry that has made this such a widespread thing? I presume there's has been plenty of malware for a while that can propagate itself around a network of unpatched old Windows machines and people have been trying to get users to clicks on emails to infect themselves for years. So why now? What's so special now?

It's not "old Windows machines," it's XP to Server 2012. It also isn't clear that it came from e-mails yet. It's widespread, easy to propagate, and is hitting the places most affected by Windows 10's advanced telemetry and hidden update.

>...and is hitting the places most affected by Windows 10's advanced telemetry and hidden update.

Can you elaborate on this?

Re: WannaCry – New Variants Detected

#98

Post by boomboomsubban »

johnmcd3 wrote: post #95
boomboomsubban wrote: post #89

Earlier quoted context omitted.

It's not "old Windows machines," it's XP to Server 2012. It also isn't clear that it came from e-mails yet. It's widespread, easy to propagate, and is hitting the places most affected by Windows 10's advanced telemetry and hidden update.

> It's not "old Windows machines," it's XP to Server 2012. This is incorrect or at least misleading. Any machine still running Windows XP, is by any reasonable definition, an "old Windows machine." Windows XP was first released in 2001, and actively supported with updates for 12 years. Windows XP hasn't been supported with critical security patches for over 3 years. Windows Server 2012 is under active support until O…

An XP computer is old, Windows 8.1 is one generation back. Both are vulnerable to this exploit. Yes, patches have been available for supported versions, I don't know how that makes anything I said wrong or misleading.

Re: WannaCry – New Variants Detected

#99

Post by rl3 »

sowbug wrote: post #79
sonium wrote: post #65

I really am a bit puzzeled by the killswitches. Why does WannaCry have this functionality in the first place? It sounds almost ironically like a hollywood villain mistake.

From https://www.malwaretech.com/2017/05/how-to-accidentally-stop... , posted earlier: In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen). I believe they were…

>I believe they were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the domain responding, they know they’re in a sandbox the malware exits to prevent further analysis.

On the face of it, that sounds like amateur hour. At the end of the day virtual environments can be configured to fool the malware in whatever fashion is required.

However, I can see that method buying small amounts of time for the worm to continue infecting targets, which I suppose has utility.

Re: WannaCry – New Variants Detected

#100

Post by boomboomsubban »

rl3 wrote: post #97
boomboomsubban wrote: post #89

Earlier quoted context omitted.

It's not "old Windows machines," it's XP to Server 2012. It also isn't clear that it came from e-mails yet. It's widespread, easy to propagate, and is hitting the places most affected by Windows 10's advanced telemetry and hidden update.

> ...and is hitting the places most affected by Windows 10's advanced telemetry and hidden update. Can you elaborate on this?

Places where uptime is vital were bothered by the 10 rollout and may have altered their patching method after. And places with serious privacy concerns must be wary of Windows updates. Enterprise is supposed to allow everyone to be shut off, but mistakes can be very expensive.
Post reply on HN