How One Security Reseacher Stopped WannaCry Ransomware Attack

A security researcher was able to disable the ‘WannaCry’ ransomware attack that crippled numerous NHS systems and impacted organisations around the world on Friday simply by registering a domain referenced by the malware.

As many as 48 NHS trusts in England and 13 in Scotland were affected, including St Barts, as disclosed to Silicon by a source who said staff were told to shut down Wi-Fi networks to stop the spread of the attack, which was installing ransomware and encrypting files.

Operations were cancelled and ambulances were redirected from A&E departments at affected hospitals to locations free of the attack’s grasp. Infected computers demanded users pay $300 (£230) in Bitcoin to retrieve the encrypted documents.

WannaCry killswitch

The health service was the most high profile victim of WannaCry but this was not a targeted attack. There were more than 100,000 victims in 100 countries at large organisations like Telefonica, but security deficiencies, not least the continued use of Windows XP on five percent of NHS devices, meant conditions at several Trusts were ripe for the ransomware to wreak havoc.

And it was because of the NHS that one cybersecurity researcher, who wished to remain anonymous and goes under the name of ‘MalwareTech’, was alerted to the attack on their day off and decided to investigate.

The researcher in question become aware of the campaign at 14:30 on Friday and although they were not surprised by a public sector system being hit – hospitals are regular targets for ransomware – but the simultaneous nature of the attack suggested it was huge.

After obtaining a sample of the malware from a fellow researcher, MalwareTech tested it in a virtual environment and discovered it queried an unregistered domain. The researcher noted the malware was connecting to multiple IP addresses targeting a server message block (SMB) vulnerability.

This made them wonder if the ransomware assault was using an exploit disclosed in the ShadowBroker leak of vulnerabilities known to the NSA. The researcher had no proof and Tweeted his theory at 16:30.

It was at this point MalwareTech registered the domain, an action which ultimately resulted in the botnet being terminated. However this was unknown at the time.

“Now one thing that’s important to note is the actual registration of the domain was not on a whim,” the researcher said in a blog. “My job is to look for ways we can track and potentially stop botnets (and other kinds of malware), so I’m always on the lookout to pick up unregistered malware control server (C2) domains. In fact I registered several thousand of such domains in the past year.”

Find out how WannaCry was conquered… for now on page 2

Page: 1 2

Steve McCaskill

Steve McCaskill is editor of TechWeekEurope and ChannelBiz. He joined as a reporter in 2011 and covers all areas of IT, with a particular interest in telecommunications, mobile and networking, along with sports technology.

Recent Posts

Generative AI Not Replacing UK Jobs, Study Finds

Study finds UK organisations broadly deploying generative AI to support existing jobs, but execs say…

7 hours ago

Google Must Face Trial In Ad Tech Monopoly Case

Google loses bid for summary judgement as judge says 'too many facts in dispute' as…

20 hours ago

Silicon In Focus Podcast: Feeding the Machine

Learn how your business can meet the challenges associated with managing data across multiple platforms…

20 hours ago

Apple, Meta Likely To Face EU Antitrust Charges

Apple, Facebook parent Meta reportedly likely to face EU antitrust charges before August under new…

20 hours ago

Adobe Shares Jump On AI Success

Adobe shares post biggest gains in more than four years after it reports user take-up…

21 hours ago

Winklevoss’ Gemini To Pay $50m In Crypto Fraud Settlement

Winklevoss twins' Gemini Trust to pay $50m to settle cypto fraud claims over failed Gemini…

21 hours ago