101–110 of 164 posts
> A new variant with no kill-switch recovered by Kaspersky as a virustotal.com upload — not detected in the Wild. Uploaded to virustotal MEANS found in the wild. That's what admins do when they discover things.
Earlier quoted context omitted.
I suppose that might be interesting just to see if they're stupid enough to register with traceable info.
The whole point of this "kill switch" is that it’s NOT registered. The malware uses it to detect if it runs in the sandbox, as researchers often make all DNS requests succeed in their sandbox. Checking for an domain known to be unregistered is one way of checking that.
Earlier quoted context omitted.
In this thread or another someone said it was a kill switch for testing it in a sandbox, probably used while developing the code.
Someone said it was to avoid behavior analysis by security researchers
Earlier quoted context omitted.
> It's not "old Windows machines," it's XP to Server 2012. This is incorrect or at least misleading. Any machine still running Windows XP, is by any reasonable definition, an "old Windows machine." Windows XP was first released in 2001, and actively supported with updates for 12 years. Windows XP hasn't been supported with critical security patches for over 3 years. Windows Server 2012 is under active support until O…
An XP computer is old, Windows 8.1 is one generation back. Both are vulnerable to this exploit. Yes, patches have been available for supported versions, I don't know how that makes anything I said wrong or misleading.
I replied to your comment because the "old" Windows XP having no patch available was significant here, and I read your comment as saying "old" windows versions were not proportionally more responsible for WannaCry's rapid spread.
Windows XP is still the third largest version of Windows by current installed base (after Windows 10 and Windows 7).
The fact that Windows XP remained unpatched was significant, as there is notable overlap between Windows machines that aren't getting new security updates (at least within a month or two of their release) and Windows machines still running Windows XP.
This vulnerability was, in fact, unusually dangerous, relative to other Windows XP vulnerabilities that have come to light in the last 5 years, and the install base of the "older" Windows XP machines made a big difference in the ransomware's ability to spread.
Earlier quoted context omitted.
I suppose that might be interesting just to see if they're stupid enough to register with traceable info.
The whole point of this "kill switch" is that it’s NOT registered. The malware uses it to detect if it runs in the sandbox, as researchers often make all DNS requests succeed in their sandbox. Checking for an domain known to be unregistered is one way of checking that.
I don't get it: why are the using using many fake but valid domains? Wouldn't a non-existing TLD do exactly the same thing while being impossible to register by anyone trying to stop the malware?
How does 'Patient A' get wcry2? Phishing? Via internet facing open 445/3389?
My guess is this is why we're seeing multiple bitcoin addresses: The original authors first released it with their own bitcoin address. It then spreads p2p around the world wherever it can to front-facing PCs. Then 3rd-party spearfishers are sending it to corporate networks with their own bitcoin address so they can get the credit for getting past/through firewalls.
Two researchers said they found a variant with a kill switch. https://motherboard.vice.com/en_us/article/round-two-wannacr...
Earlier quoted context omitted.
Basically, this is a successful old-fashioned computer worm, operating at a scale we've not seen for more than 10 years. On modern operating systems most attack surfaces that were easy to crack in the past have been locked down at least to the point where it is nearly impossible to find an exploit in a common protocol like this that doesn't require user interaction (hence the popularity of phishing). Apart from that…
"older Windows versions" Win 10 is vulnerable without the patch that came out in march.
Microsoft clearly disputes this in their own posts on the subject.
https://blogs.technet.microsoft.com/msrc/2017/05/12/customer...
"Customers running Windows 10 were not targeted by the attack today."
What's your source?