Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WannaCry – New Variants Detected

blog.comae.io

Post reply on HN
Print view View original

141–150 of 164 posts

Re: WannaCry – New Variants Detected

#141

Post by Moru »

rl3 wrote: post #99
sowbug wrote: post #79

Earlier quoted context omitted.

From https://www.malwaretech.com/2017/05/how-to-accidentally-stop... , posted earlier: In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen). I believe they were…

> I believe they were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the domain responding, they know they’re in a sandbox the malware exits to prevent further analysis. On the face of it, that sounds like amateur hour. At the end of the day virtual environments can be configured to fool the malware in whatever fashion is required…

As they say, the guard has to see everything, every time. The burglar only has to succeed once.

Re: WannaCry – New Variants Detected

#142

Post by yardstick »

Anyone know someone at the Tor Project? Based on a breakdown I read, it downloads the Tor client from https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9...

It would be simple to rename this link (or perform a referer check or something else to stop automated downloads), at least temporarily.

Yes, the malware authors will release an update with the different URL (or another hosting site entirely, or embedded), but at least it would provide time for vulnerable users to install patches. Especially now that Microsoft has released a patch for XP.

(I'm basing this URL info on the breakdown found at https://www.bleepingcomputer.com/news/security/wannacry-wana...)

Re: WannaCry – New Variants Detected

#143

Post by nolok »

btown wrote: post #132

Could a grey hat create a self propagating but non-ransoming variant that inoculated target machines against its more malicious brethren? Seems like something a state actor might want to do.

Yeah then some bugs in your code or unplanned set of conditions amongst the bazillion xp computers out there lead your code to kill someone by failure of some critical NHS equipment, or worse, to lose a lot of money!

"but I meant good "is totally going to save you then.

Re: WannaCry – New Variants Detected

#144

Post by rjbwork »

codehusker wrote: post #124
criley2 wrote: post #109

Earlier quoted context omitted.

>Win 10 is vulnerable without the patch that came out in march Microsoft clearly disputes this in their own posts on the subject. https://blogs.technet.microsoft.com/msrc/2017/05/12/customer... "Customers running Windows 10 were not targeted by the attack today." What's your source?

From your source: "Customers who are running supported versions of the operating system (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows 10, Windows Server 2012 R2, Windows Server 2016) will have received the security update MS17-010 in March. If customers have automatic updates enabled or have installed the update, they are protected. For other custome…

If you or your IT dept is not installing updates, especially security patches, over 2 months after they come out, somethings horribly wrong.

Re: WannaCry – New Variants Detected

#145

Post by kchr »

fian wrote: post #122
Thrillington wrote: post #70

Earlier quoted context omitted.

They're more analysis defeaters than killswitches. Some testbeds will respond to all dns lookups as valid. If this is the case the binary assumes its in a testbed and exits to avoid analysis.

Which makes me think there might be utility in always running Windows (or other OSes) in a VM. If the malware assumes VMs are bad and self exit in response, then it should be safer to run everthing in a VM. A side benefit would be you can perform snapshot backups and easily migrate your main environment to new hardware.

You might wanna take a look at Qubes OS, which tries to provide such workflow in a nicely packaged distribution: https://www.qubes-os.org/

Re: WannaCry – New Variants Detected

#146

Post by gruturo »

ComodoHacker wrote: post #136
btown wrote: post #132

Could a grey hat create a self propagating but non-ransoming variant that inoculated target machines against its more malicious brethren? Seems like something a state actor might want to do.

You mean bundle and forcefully install MS patches? This would require reboot which AFAIK can't be done without user's action (if not using undocumented APIs).

> You mean bundle and forcefully install MS patches? This would require reboot which AFAIK can't be done without user's action (if not using undocumented APIs).

Considering you're using a vulnerability to forcefully inoculate systems, and you gained admin if not Ring0 privileges, you could trivially "reboot" the box by just crashing it, no APIs required. You could even be nice and check if there are applications with open files, or schedule it only when the user has been idle for a while, and only do it during the usual hours of inactivity (Windows 10 even has a control panel section to choose them).

Or, you could just open a dialog box, masquerade as a legitimate update and ask for user consent. You are an important security update after all, just a fairly unconventional one.

Re: WannaCry – New Variants Detected

#147

Post by unpatchedyay »

rjbwork wrote: post #144
codehusker wrote: post #124

Earlier quoted context omitted.

From your source: "Customers who are running supported versions of the operating system (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, Windows 10, Windows Server 2012 R2, Windows Server 2016) will have received the security update MS17-010 in March. If customers have automatic updates enabled or have installed the update, they are protected. For other custome…

If you or your IT dept is not installing updates, especially security patches, over 2 months after they come out, somethings horribly wrong.

Posting from a throwaway for obvious reasons, but the place where I work still hasn't applied these patches after I warned their IT dept about the NSA vulns a month ago... luckily I'm at least able to apply the patch to my own system manually. If it hits us I'm pretty sure we're screwed on the order of a few thousand systems.

Re: WannaCry – New Variants Detected

#148

Post by andygates »

btown wrote: post #132

Could a grey hat create a self propagating but non-ransoming variant that inoculated target machines against its more malicious brethren? Seems like something a state actor might want to do.

When the vendor does that, everyone complains about forced updates. And the vendor's patch is likely to be better than a grey-hat hack, by virtue of having perfect knowledge of the systems they're patching.

Re: WannaCry – New Variants Detected

#149

Post by globile »

rhubarbcustard wrote: post #68

What's special about WannaCry that has made this such a widespread thing? I presume there's has been plenty of malware for a while that can propagate itself around a network of unpatched old Windows machines and people have been trying to get users to clicks on emails to infect themselves for years. So why now? What's so special now?

The thing that scares me most is that while this has been a public facing issue, many of these computers at Telefonica, the NHS, and others, have been silently accesible via the exploit for a while.

Nobody seems to be talking about this, but we can only guess that a lot of stuff has been compromised and still is.

What really worries me is the huge amount of non-patched computers that have not fallen with this specific WannaCry issue and are sitting idly waiting for their glory day.

Re: WannaCry – New Variants Detected

#150

Post by user5994461 »

ComodoHacker wrote: post #136
btown wrote: post #132

Could a grey hat create a self propagating but non-ransoming variant that inoculated target machines against its more malicious brethren? Seems like something a state actor might want to do.

You mean bundle and forcefully install MS patches? This would require reboot which AFAIK can't be done without user's action (if not using undocumented APIs).

    shutdown -f -r -t 60
force reboot in 60 seconds. A very well documented windows command available for more than 15 years.

Bonus: Also works remotely, there is a flag to give a remote computer name.

Post reply on HN