Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WannaCry – New Variants Detected

blog.comae.io

Post reply on HN
Print view View original

121–130 of 164 posts

Re: WannaCry – New Variants Detected

#121

Post by sillysaurus3 »

TheSpiceIsLife wrote: post #30
Sir_Cmpwn wrote: post #18

Earlier quoted context omitted.

Do you seriously expect most criminals are intelligent?

In this context criminals are a person or persons who have created ransomware which, in less than three days has infecting more than 230,000 computers in 150 countries, demanding ransom payments in bitcoin in 28 languages. The meth dealer two houses down who serves people out his front window probably isn't thinking straight. What we're dealing with here is a different category of thinking.

For perspective, they've netted a measly $39,000 / 21 BTC so far.

https://www.reddit.com/r/Bitcoin/comments/6axuzs/wannacry_wc...

Re: WannaCry – New Variants Detected

#122

Post by fian »

Thrillington wrote: post #70
sonium wrote: post #65

I really am a bit puzzeled by the killswitches. Why does WannaCry have this functionality in the first place? It sounds almost ironically like a hollywood villain mistake.

They're more analysis defeaters than killswitches. Some testbeds will respond to all dns lookups as valid. If this is the case the binary assumes its in a testbed and exits to avoid analysis.

Which makes me think there might be utility in always running Windows (or other OSes) in a VM. If the malware assumes VMs are bad and self exit in response, then it should be safer to run everthing in a VM. A side benefit would be you can perform snapshot backups and easily migrate your main environment to new hardware.

Re: WannaCry – New Variants Detected

#123

Post by [deleted] »

ibic wrote: post #120
kristofferR wrote: post #115

Earlier quoted context omitted.

WannaCry ("the attack") didn't target Windows 10 installations (probably since most Win10 users have updates enabled), but Windows 10 is still vulnerable without the patch.

Again, where is the source? I seriously doubt that the worm author would let go such a profitable target if they can infect Windows 10. According to this: https://www.netmarketshare.com/operating-system-market-share... Windows 10 has almost 4 times users than XP (and supposedly the gap is growing larger)

[deleted]

Re: WannaCry – New Variants Detected

#124

Post by codehusker »

criley2 wrote: post #109
gerdesj wrote: post #93

Earlier quoted context omitted.

"older Windows versions" Win 10 is vulnerable without the patch that came out in march.

>Win 10 is vulnerable without the patch that came out in march Microsoft clearly disputes this in their own posts on the subject. https://blogs.technet.microsoft.com/msrc/2017/05/12/customer... "Customers running Windows 10 were not targeted by the attack today." What's your source?

From your source:

"Customers who are running supported versions of the operating system (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows 10, Windows Server 2012 R2, Windows Server 2016) will have received the security update MS17-010 in March. If customers have automatic updates enabled or have installed the update, they are protected. For other customers, we encourage them to install the update as soon as possible."

If you don't have the update, you are not protected, you are vulnerable.

Re: WannaCry – New Variants Detected

#125

Post by ytpete »

Scoundreller wrote: post #44
nthcolumn wrote: post #2

How does 'Patient A' get wcry2? Phishing? Via internet facing open 445/3389?

My guess is this is why we're seeing multiple bitcoin addresses: The original authors first released it with their own bitcoin address. It then spreads p2p around the world wherever it can to front-facing PCs. Then 3rd-party spearfishers are sending it to corporate networks with their own bitcoin address so they can get the credit for getting past/through firewalls.

If the payment goes to them instead of the original authors, how could the new hijackers of the virus offer to decrypt the data? I'd assume only the original authors have access to the private keys needed for that.

If someone was really clever they could change the Tor addresses it talks to for command & control and write their own complete replacement backend, but at that point it seems like you'd be looking at people capable enough to just write their own malware from scratch anyway...

Re: WannaCry – New Variants Detected

#126

Post by Scoundreller »

ytpete wrote: post #125
Scoundreller wrote: post #44

Earlier quoted context omitted.

My guess is this is why we're seeing multiple bitcoin addresses: The original authors first released it with their own bitcoin address. It then spreads p2p around the world wherever it can to front-facing PCs. Then 3rd-party spearfishers are sending it to corporate networks with their own bitcoin address so they can get the credit for getting past/through firewalls.

If the payment goes to them instead of the original authors, how could the new hijackers of the virus offer to decrypt the data? I'd assume only the original authors have access to the private keys needed for that. If someone was really clever they could change the Tor addresses it talks to for command & control and write their own complete replacement backend, but at that point it seems like you'd be looking at peop…

It could be one back-end, with the malware authors paying a cut to the spearfishers. The spearfishers could monitor the bitcoin address to ensure they get the right cut.

Some level of trust would be involved.

I think the spearfishing industry and the malware writing industry aren't one and the same. The former is the marketing department, the latter is the tech department.

Re: WannaCry – New Variants Detected

#127

Post by nebula »

I am trying to understand impact of crypto currency. Sorry for my ignorance, and or impertinence. 1. Is it possible to run such large scale ransom demands without cryptocurrency? 2. Do we know if the attacker is using a single BTC wallet, or if ransoms are being collected in a distributed fashion. 3. Is it possible for BTC n/w to hijack BTCs going to the ransom wallet(s). That is to say collectively overwrite/override the transactions and may be reroute the coins to some non-profit wallet? I know it will be a very bad precedent, but I am trying to understand if it is technically possible.

Re: WannaCry – New Variants Detected

#128

Post by simcop2387 »

nebula wrote: post #127

I am trying to understand impact of crypto currency. Sorry for my ignorance, and or impertinence. 1. Is it possible to run such large scale ransom demands without cryptocurrency? 2. Do we know if the attacker is using a single BTC wallet, or if ransoms are being collected in a distributed fashion. 3. Is it possible for BTC n/w to hijack BTCs going to the ransom wallet(s). That is to say collectively overwrite/overrid…

> 3. Is it possible for BTC n/w to hijack BTCs going to the ransom wallet(s).

No, by design that's not allowed as part of the protocol for bitcoin. Every transaction must be signed by the private key for that address in order to be valid. You could in theory do it if you can get a majority of the miners to agree to the change in the protocol but it wouldn't happen since it'd require forking the whole blockchain to insert new transactions without the private key. And then you'd have to get everyone to agree on where those would go.

Re: WannaCry – New Variants Detected

#129

Post by nebula »

simcop2387 wrote: post #128
nebula wrote: post #127

I am trying to understand impact of crypto currency. Sorry for my ignorance, and or impertinence. 1. Is it possible to run such large scale ransom demands without cryptocurrency? 2. Do we know if the attacker is using a single BTC wallet, or if ransoms are being collected in a distributed fashion. 3. Is it possible for BTC n/w to hijack BTCs going to the ransom wallet(s). That is to say collectively overwrite/overrid…

> 3. Is it possible for BTC n/w to hijack BTCs going to the ransom wallet(s). No, by design that's not allowed as part of the protocol for bitcoin. Every transaction must be signed by the private key for that address in order to be valid. You could in theory do it if you can get a majority of the miners to agree to the change in the protocol but it wouldn't happen since it'd require forking the whole blockchain to in…

Thanks for the response. I should have been more explicit, but when I said BTC n/w I meant a consensus sort of thing from users/miners. Thanks for your explanation regarding the need of a fork to achieve this even with consensus.

Re: WannaCry – New Variants Detected

#130

Post by kul_ »

Is there analysis on what encryption algorithm was being used? And how the payment confirmation switch works on the malware.

Is it possible instead of patching the OS, to release a patch which patches the malware binary to no-op the payment switch?

Post reply on HN