WannaCry, the keys to the ransomware that shook the world

The danger that companies face today is invisible and knows no borders. History has wanted us to become aware of this threat so we can start acting now. Awareness of how dependent we are on the technology we have created; aware of how vulnerable we have become because of this dependency.

Last Friday, May 12, a cyberattack occurred on a global scale that affected the teams of dozens of large and medium-sized companies, sowing uncertainty and alarmism wherever they were confirmed to be affected.

"Ramsonware" was the word that was repeated the most that morning. A type of virus that acts hijacking computers and encrypting files that it contains. In exchange for the release, the cybercriminals who have released the virus ask for payment of an amount that normally must be made in Bitcoins, the virtual currency whose transactions are difficult to trace.

Within this type of worms, the virus that was used for this large-scale cyberattack was WannaCry or Wcry, a variant of WannaCrypt0r 2.0. On this occasion, the ransom amount ranged from $300-600.

When we talk about How ransomware attacks affect businesses, we saw that your payment does not guarantee the return of the files. Even so, there are those who, in panic and not knowing how to act in these cases, heeded the ransom request and ended up paying.

How the WannaCry ransomware attack emerged

There are still many conjectures about what is currently known as the cyberattack of the year. Many of the questions raised today are likely to remain unanswered in public opinion.

First of all, No one has claimed responsibility for the attack. Sources of Guardian They point out that the authors of this ransomware were Lazarus Group, a North Korean organization that would be working on the creation of this virus. This hypothesis is joined The New York Times which points out that there are similarities between the WannaCry code and other attacks launched from North Korea.

In reference to this theory, other sources suggest that a hacker group called Shadow Brokers published on the ETERNALBLUE network, an exploit that was supposedly developed by the United States Security Agency (NSA). The goal of the exploit was to get into Windows computers by taking advantage of a vulnerability in the network protocol, Server Message Blog (SMB), and take control of the computers.

At the same time, a Windows vulnerability was leaked by Wikileaks through a document called Vault 7. In it, the techniques used by the CIA to spy on devices with this operating system were revealed, taking advantage of security gaps unknown to Microsoft (what is known as a zero-day attack).

All this information was useful to cybercriminals when developing the worm. The creators of WannaCry used the exploit to break into computers that were not updated, and introduce the virus that infected computers connected to a local network. In turn, it reproduced different IPs to spread over the Internet, hence its virulence.

Microsoft had done its homework as soon as Wikileaks made this leak. On March 14, it released a security update to resolve these vulnerabilities. According to the more than 300,000 computers affected worldwide, most users did not update their machines as soon as the patch was released. A clear example that keeping equipment up to date is a security measure that is easy to apply.

Who were those affected?

According to the Europol, more than 150 countries were affected by the WannaCry virus, including Russia, Ukraine, China, India, the United Kingdom, and Spain. In fact, Spain was one of the first countries to sound the alarm. He National Cybersecurity Institute (INCIBE) points out that up to 600 Spanish companies had to paralyze their activity due to the computer attack, including Telefónica.

The multinational launched its security protocol when the virus appeared on the screens of some of the company's computers. Employees then had to turn off the computers and disconnect them from the network until further notice. A fact that affected part of the company's productivity, although clients were able to continue using its services.

Internationally, Russia was the most affected country. However, the media highlighted what happened in United Kingdom: National Health Service (NHS) computers were also infected by the virus. This meant that appointments had to be delayed, ambulances diverted and surgical interventions cancelled, unless it was an emergency.

Other companies affected by the company was Renault, which suspended the activity of some of its plants located in France. The railway operator German, Deutsche Bahn, acknowledged that its systems had also been attacked after the virus appeared on some of the train station panels.

How was the spread of the virus stopped?

That May 12, nervousness reigned among companies and individuals around the world, as victims of WannaCry were confirmed. However, as if it were the plot of a movie, the person who could stop the spread of the virus appeared.

Marcus Hutchins, known by his Twitter account as @MalwareTechBlog, is a 22-year-old boy, residing in the coastal city of Devon (England). In one interview given to Associated Press, this cybersecurity expert explains that he was on vacation when he began to analyze the way in which the virus infected computers. He noticed that every time a new infection occurred, WannaCry was trying to connect to a domain name (gwea.com) which was not registered.

He thought that if he bought this domain he could stop the reproduction of the virus taking advantage of this connection, something that in computer slang is known as a "kill switch". And so it was.

After purchasing it for $10.69, he pointed the domain to servers in Los Angeles to which Hutchins had access. As soon as he did so, he realized the power of the attack, as there were more than 5,000 connections per second. Finally, the ransomware went into a loop and shut down.

There are those who point out that this flaw in the WannaCry code was left on purpose in order to be able to turn it off in case the virus got out of hand. Although WannaCry was stopped, several sources, including Europol, warn that there is still a danger that the virus will return with more virulence.

Adylkuzz, Uiwix… this is just the beginning

There are those who at this point will wonder what the objective of WannaCry was. The truth is that there are many theories about it, but the most mentioned is that the motivation was economic. According to statements made by our analysts to The Confidential; "someone was creating the virus and it escaped." Furthermore, they added that the code was not very well done and unfinished.

These details indicate that we could face more studied and sophisticated attacks and therefore, more aggressive than the one we have experienced. In fact, security experts are already considering names of the next viruses that could spread across the network. Adylkuzz is one of them.

Adylkuzz, the botnet that creates virtual money

Computer experts say that since last April 24, a virus similar to WannaCry called Adylkuss has been detected. This is installed on several computers creating a network (botnet) to turn them into cryptocurrency generating machines similar to bitcoins.

Through this activity, known as "cryptocurrency mining," hackers make money since benefits that botnets bring They transfer them to a banking network. This virus is considered to be much more dangerous than WannaCry, not only because it steals money from the computers it takes control, but it also exploits the same vulnerability as WannaCry.

Uiwix, the ransomware that self-destructs upon discovery

Another more dangerous variant than WannaCry is Uiwix. It is a virus that runs from the computer's memory. By not needing to create any files in it, It is difficult for antivirus to detect it. Despite this, it is also designed to self-destruct if discovered.

Although it also exploits the same vulnerability found in the Windows SMB protocol, this time we find a virus that does not include "kill switch", That is, no bugs have been found in its code that would allow it to be turned off in the same way as was done with WannaCry. According to Heimdal Security, the procedure of this ransomware is the best known: hijack the computer, encrypt the files and demand a ransom in bitcoins.

Are we prepared for another cyber attack like WannaCry?

The attack made it clear that the world is not yet prepared to face this type of cybercrime. On the one hand, computer attacks do not understand borders, so it becomes more difficult to pursue them, as well as apply laws and punishments.

On the other hand, companies and individuals must assume part of the responsibility for the damages by not taking the security measures that the times require. Furthermore, the revelations of organizations such as Wikileaks, as well as the theft and dissemination of tools developed by the secret services of the world's governments do nothing more than worsen the situation.

Updating equipment is a security measure, but it is also important train employees so they know how to act in the event of a threat. Shield the networks so much as the servers of a company, are also issues that cannot be left for another time. In the links you will find the way to improve the security of each component.

The lesson that WannaCry leaves behind is that Cybersecurity is not a whim of the companies that decide to invest in it. Failure to do so puts productivity and customer trust at risk. In the end, all this translates into numbers and accounts that no company would want to have to present.