A security researcher was able to disable the ‘WannaCry’ ransomware attack that crippled numerous NHS systems and impacted organisations around the world on Friday simply by registering a domain referenced by the malware.
As many as 48 NHS trusts in England and 13 in Scotland were affected, including St Barts, as disclosed to Silicon by a source who said staff were told to shut down Wi-Fi networks to stop the spread of the attack, which was installing ransomware and encrypting files.
Operations were cancelled and ambulances were redirected from A&E departments at affected hospitals to locations free of the attack’s grasp. Infected computers demanded users pay $300 (£230) in Bitcoin to retrieve the encrypted documents.
And it was because of the NHS that one cybersecurity researcher, who wished to remain anonymous and goes under the name of ‘MalwareTech’, was alerted to the attack on their day off and decided to investigate.
The researcher in question become aware of the campaign at 14:30 on Friday and although they were not surprised by a public sector system being hit – hospitals are regular targets for ransomware – but the simultaneous nature of the attack suggested it was huge.
After obtaining a sample of the malware from a fellow researcher, MalwareTech tested it in a virtual environment and discovered it queried an unregistered domain. The researcher noted the malware was connecting to multiple IP addresses targeting a server message block (SMB) vulnerability.
This made them wonder if the ransomware assault was using an exploit disclosed in the ShadowBroker leak of vulnerabilities known to the NSA. The researcher had no proof and Tweeted his theory at 16:30.
It was at this point MalwareTech registered the domain, an action which ultimately resulted in the botnet being terminated. However this was unknown at the time.
“Now one thing that’s important to note is the actual registration of the domain was not on a whim,” the researcher said in a blog. “My job is to look for ways we can track and potentially stop botnets (and other kinds of malware), so I’m always on the lookout to pick up unregistered malware control server (C2) domains. In fact I registered several thousand of such domains in the past year.”
Page: 1 2
Tesla lays off software, service, engineering staff after disbanding Supercharger team, as major cull continues
Dominant Bitcoin ETF Grayscale Bitcoin Trust shows first net inflow since January as investors flock…
US campaign funding groups backed by cryptocurrency sector raise more than $102m as firms seek…
Explore the cutting-edge realm of cybersecurity with 'A New Age of Cybersecurity' podcast. Learn how…
Robinhood Markets says it received SEC enforcement notice over cryptocurrency trading platform amidst ongoing crackdown
Chip designer Synopsys to sell software integrity unit to private investors to create new independent…