A security researcher was able to disable the ‘WannaCry’ ransomware attack that crippled numerous NHS systems and impacted organisations around the world on Friday simply by registering a domain referenced by the malware.
As many as 48 NHS trusts in England and 13 in Scotland were affected, including St Barts, as disclosed to Silicon by a source who said staff were told to shut down Wi-Fi networks to stop the spread of the attack, which was installing ransomware and encrypting files.
Operations were cancelled and ambulances were redirected from A&E departments at affected hospitals to locations free of the attack’s grasp. Infected computers demanded users pay $300 (£230) in Bitcoin to retrieve the encrypted documents.
And it was because of the NHS that one cybersecurity researcher, who wished to remain anonymous and goes under the name of ‘MalwareTech’, was alerted to the attack on their day off and decided to investigate.
The researcher in question become aware of the campaign at 14:30 on Friday and although they were not surprised by a public sector system being hit – hospitals are regular targets for ransomware – but the simultaneous nature of the attack suggested it was huge.
After obtaining a sample of the malware from a fellow researcher, MalwareTech tested it in a virtual environment and discovered it queried an unregistered domain. The researcher noted the malware was connecting to multiple IP addresses targeting a server message block (SMB) vulnerability.
This made them wonder if the ransomware assault was using an exploit disclosed in the ShadowBroker leak of vulnerabilities known to the NSA. The researcher had no proof and Tweeted his theory at 16:30.
It was at this point MalwareTech registered the domain, an action which ultimately resulted in the botnet being terminated. However this was unknown at the time.
“Now one thing that’s important to note is the actual registration of the domain was not on a whim,” the researcher said in a blog. “My job is to look for ways we can track and potentially stop botnets (and other kinds of malware), so I’m always on the lookout to pick up unregistered malware control server (C2) domains. In fact I registered several thousand of such domains in the past year.”
Page: 1 2
AI push sees Alphabet's Google saying it will consolidate its AI teams in its Research…
Beijing orders Apple to pull Meta's WhatsApp and Threads from its Chinese App Store over…
Key milestone sees Intel Foundry assemble ASML's new “High NA EUV” lithography tool, to begin…
Oracle's huge AI, Cloud investment in Japan will meet growing local demand and address digital…
People who create sexually explicit ‘deepfakes’ of adults will face prosecution under a new law…
Protest at cloud contract with Israel results in staff firings, in addition to layoffs of…