It's interesting to see how trusting another criminal with your address opens you up to serious blackmail... maybe I should set up a PO Box for Bitcoin business :)
Confessions of Marcus Hutchins, the hacker who stopped the WannaCry attack
51–60 of 69 posts
Re: Confessions of Marcus Hutchins, the hacker who stopped the WannaCry attack
#52Earlier quoted context omitted.
He didn't know it was the kill-switch domain. He expected it would enable him to kill the malware, though, and was trying to figure out how to send the kill command before it turned out that simply sitting a server behind the domain was enough to kill it.
What a pointlessly flippant argument. Hutchins discovered, and engaged, the WannaCry killswitch. Irrevocable fact.
The question is, what would he have done if it wasn't a kill switch, but happened to be a server that received bitcoin payments from ransomware victims?
He was still selling banking trojans the year before, so who knows?
Re: Confessions of Marcus Hutchins, the hacker who stopped the WannaCry attack
#53Ah that explains his tweet this morning
Re: Confessions of Marcus Hutchins, the hacker who stopped the WannaCry attack
#54Re: Confessions of Marcus Hutchins, the hacker who stopped the WannaCry attack
#55This is a bit over the top. He is not a master hacker who "saved the Internet"; He accidentally neutered WannaCry by registering a domain he found in the binary, which as it turned out, acted as a kill switch.
> He accidentally neutered he did not "accidentally neuter WannaCry". He stopped WannaCry by registering the kill-switch domain. Nothing accidental about that. > He is not a master hacker he is a kid. what makes his experience interesting, and his story worth listening to is that he had first-hand experience with the legal system as a hacker that went too far (because he is/was a kid). that is worth more than the arm…
He named his own blogpost of the incident "How to Accidentally Stop a Global Cyber Attacks". He thought it was trying to spread like a worm, and they followed standard procedure to register the domain and black hole the traffic.
https://www.malwaretech.com/2017/05/how-to-accidentally-stop...
Re: Confessions of Marcus Hutchins, the hacker who stopped the WannaCry attack
#56Earlier quoted context omitted.
>Nothing accidental about that. He didn’t know it was the kill-switch domain, seems pretty accidental to me.
His goal was to kill the malware. Registering the (unclaimed) domain in the binary was supposed to be step 0 to this. Such a domain would almost certainly act as a control center of some sort. You can claim it while it's still available and analyze the malware or even just the traffic reaching your domain to try and neuter it. Even if there's no killswitch, maybe sending invalid data will cause the malware to malfunc…
"Would almost certainly", yeah, in most cases. But, and this is something that didn't get talked about enough, what if registering the domain actually caused the malware to nuke the host system instead? Think of it as a kill-switch to deter malware researchers that only superficially reverse-engineered a sample before jumping to action. Viewed from that light, just registering the domain because you saw your sandbox talk to it looks more than reckless...
Re: Confessions of Marcus Hutchins, the hacker who stopped the WannaCry attack
#57This is a bit over the top. He is not a master hacker who "saved the Internet"; He accidentally neutered WannaCry by registering a domain he found in the binary, which as it turned out, acted as a kill switch.
> He accidentally neutered he did not "accidentally neuter WannaCry". He stopped WannaCry by registering the kill-switch domain. Nothing accidental about that. > He is not a master hacker he is a kid. what makes his experience interesting, and his story worth listening to is that he had first-hand experience with the legal system as a hacker that went too far (because he is/was a kid). that is worth more than the arm…
It is 100% accidental. He registered a domain he observed being queried from his analysis system. He did not figure out what the purpose of this domain was before registering it. One of three options:
- Act as a centralised C2.
- Act as a kill-switch (this is what happened)
- Act as a dead-man-trigger, destroying the host system.
Even if the third option is not as likely as the first one, the repercussions had he been wrong would have been severe.
Re: Confessions of Marcus Hutchins, the hacker who stopped the WannaCry attack
#58Why wouldn’t the wannacry malware writers register the domain first? Should be possible to simply update the name servers or dns records should the kill switch need to be engaged?
Re: Confessions of Marcus Hutchins, the hacker who stopped the WannaCry attack
#59Earlier quoted context omitted.
His goal was to kill the malware. Registering the (unclaimed) domain in the binary was supposed to be step 0 to this. Such a domain would almost certainly act as a control center of some sort. You can claim it while it's still available and analyze the malware or even just the traffic reaching your domain to try and neuter it. Even if there's no killswitch, maybe sending invalid data will cause the malware to malfunc…
"Would almost certainly", yeah, in most cases. But, and this is something that didn't get talked about enough, what if registering the domain actually caused the malware to nuke the host system instead? Think of it as a kill-switch to deter malware researchers that only superficially reverse-engineered a sample before jumping to action. Viewed from that light, just registering the domain because you saw your sandbox…
We're talking about WannaCry here. It's a ransomware that already more or less nukes the host system. It encrypts the files with strong encryption, which is the same as shredding them if you don't have the ransom money. Sure, the malware author could go further and harm the system physically (e.g. forcefully overheat the CPU or something), but that's actually surprisingly hard to do reliably ^^.
Besides, history tells us that those malwares won't really have such "nuking" functionality. Gating it on the presence of a server is ridiculous, and would be found out eventually when the virus runs in a weird environment where, for instance, every DNS queries resolve (e.g. hotel WiFi).
Re: Confessions of Marcus Hutchins, the hacker who stopped the WannaCry attack
#60It's a long piece, and quite interesting. Thanks for sharing @Malwaretech.
It is very similar to the one on Silkroad and Ross Ulbricht that Wired had previously done. I can easily see either/both/combined into a movie script.