The global WannaCry Ransomware pandemic is still making headline news and has been well covered by news and tech media outlets. The security teams at Integrity360 have been following analysis & updates closely, from both our industry partners and the wider security community, and working with our customers around the clock to improve their security posture and close any avenues of attack in light of WannaCry.
This update provides a summary of the pertinent details, new developments, our short term expectations and the current recommendations.
Current Status
As detailed in our initial advisory progress of the original variant was slowed drastically when a malware researcher registered the kill switch domain and sinkholed the traffic. It is very important to note that this action would only have an impact in your network as long as the infected devices have free access to the domain. The malware is not Proxy aware and in networks where an explicit proxy is used, it will not be able to connect to the sinkhole without additional changes (killswitch and proxy). For this reason we expect the infection numbers to continue to rise come Monday morning, once users start opening their inboxes.
At the time of writing almost 200,000 infections had been detected in 150+ countries, and 66,000 new infections in the last 24 hours:
New Strains
A number of new strains of WannaCry have been detected and reverse engineered by malware researchers. There new strains attempt to circumvent the sinkhole by changing the kill switch URL. Presently these are considered patched or modified versions of the original, by copycat attackers using hex editors, rather than being completely re-written by the original authors. The newly detected URLs have been added to the current sink hole. In one case the kill switch check has been completely removed via hex editor but this sample provided to be corrupt and failed to encrypt files.
As it is relatively easy for an experienced hacker to modify the binary there is a very real fear multiple attackers may take advantage of the situation over the coming days whilst systems are still unpatched.
Although at this stage we have only seen altered versions of the original malware, it is highly expected that the original authors will release an entirely new version of the malware with the kill switch removed in the coming days. It is expected that this version will be modified to avoid newly created anti-virus signatures, allowing it to exploit vulnerable systems and repeat the “success” of the original version. There is also concern other NSA leaked exploits may be combined with WannaCry or other forms of ransomware in near future.
Payment
It is strongly recommend that you do not pay the ransom. Analysis of the malware, and its payment method, show it is either not created with decryption in mind, or the payment & decryption process is simply poorly written. Unlike other ransomware there is no automated association of payment to a unique host ID to allow the decryption keys to be provided automatically on payment. One piece of analysis also indicated decryption would potentially be a manual process, interacting with the attackers, via the Tor network, which would be impossible for all 200,000 infected hosts. https://modexp.wordpress.com/2017/05/15/wanacryptor/
At the time of writing there have been $33,000 sent to the 3 bitcoin wallets used in the attacks and no successful payment/decryptions have been reported.
Current Recommendations:
Please email info@integrity360.com if you would like further advice on protecting against this threat.
References
We would like to acknowledge our partners, Check Point for their information, analysis and assistance in compiling this article.