How One Security Reseacher Stopped WannaCry Ransomware Attack

A security researcher was able to disable the ‘WannaCry’ ransomware attack that crippled numerous NHS systems and impacted organisations around the world on Friday simply by registering a domain referenced by the malware.

As many as 48 NHS trusts in England and 13 in Scotland were affected, including St Barts, as disclosed to Silicon by a source who said staff were told to shut down Wi-Fi networks to stop the spread of the attack, which was installing ransomware and encrypting files.

Operations were cancelled and ambulances were redirected from A&E departments at affected hospitals to locations free of the attack’s grasp. Infected computers demanded users pay $300 (£230) in Bitcoin to retrieve the encrypted documents.

WannaCry killswitch

The health service was the most high profile victim of WannaCry but this was not a targeted attack. There were more than 100,000 victims in 100 countries at large organisations like Telefonica, but security deficiencies, not least the continued use of Windows XP on five percent of NHS devices, meant conditions at several Trusts were ripe for the ransomware to wreak havoc.

And it was because of the NHS that one cybersecurity researcher, who wished to remain anonymous and goes under the name of ‘MalwareTech’, was alerted to the attack on their day off and decided to investigate.

The researcher in question become aware of the campaign at 14:30 on Friday and although they were not surprised by a public sector system being hit – hospitals are regular targets for ransomware – but the simultaneous nature of the attack suggested it was huge.

After obtaining a sample of the malware from a fellow researcher, MalwareTech tested it in a virtual environment and discovered it queried an unregistered domain. The researcher noted the malware was connecting to multiple IP addresses targeting a server message block (SMB) vulnerability.

This made them wonder if the ransomware assault was using an exploit disclosed in the ShadowBroker leak of vulnerabilities known to the NSA. The researcher had no proof and Tweeted his theory at 16:30.

It was at this point MalwareTech registered the domain, an action which ultimately resulted in the botnet being terminated. However this was unknown at the time.

“Now one thing that’s important to note is the actual registration of the domain was not on a whim,” the researcher said in a blog. “My job is to look for ways we can track and potentially stop botnets (and other kinds of malware), so I’m always on the lookout to pick up unregistered malware control server (C2) domains. In fact I registered several thousand of such domains in the past year.”

Find out how WannaCry was conquered… for now on page 2