Researcher Accidentally Thwarts 'WannaCry' Ransomware

Ransomware that ripped through hundreds of thousands of Windows PCs worldwide on Friday was hobbled over the weekend, just could see a resurgence this week if patches are not deployed.

SecurityWatch A UK-based researcher known equally MalwareTech managed to cease the spread of ransomware, dubbed WannaCry or WannaCrypt, quite by accident. As he explained in a blog post, MalwareTech acquired a sample of the malware on Friday and ran information technology a virtual environs.

"I instantly noticed information technology queried an unregistered domain, which I promptly registered," MalwareTech writes.

This was not uncommon for him. "My task is to look for means we can rail and potentially stop botnets (and other kinds of malware), so I'm always on the lookout to option up unregistered malware control server (C2) domains. In fact I registered several g of such domains in the past twelvemonth."

This time, even so, the motion—known as sinkholing—thwarted WannaCry.

WannaCry looks to connect to the domain mentioned in the lawmaking. If it can't connect, "it ransoms the system," MalwareTech explains. If information technology connects to the domain, though, "the malware exits" and the organisation is non compromised.

"This technique isn't unprecedented and is actually used by the Necurs trojan," according to MalwareTech. "Still, because WannaCrypt used a single hardcoded domain, my registartion [sic] of it caused all infections globally to believe they were inside a sandbox and exit.

"Thus we initially unintentionally prevented the spread and and further ransoming of computers infected with this malware," he writes.

That'southward skilful news for those unfortunate enough to meet WannaCry, but MalwareTech warns that his sinkhole "only stops this sample and in that location is nothing stopping them removing the domain check and trying once more, so it'due south incredibly importiant [sic] that any unpatched systems are patched as quickly equally possible."

Microsoft released a patch for the vulnerability beingness targeted past WannaCry in March. On Friday, it extended that back up to aging versions of Windows that Microsoft no longer supports but many businesses still utilise.

"Given the potential bear upon to customers and their businesses, nosotros made the decision to brand the Security Update for platforms in custom support but, Windows XP, Windows viii, and Windows Server 2003, broadly available for download," Redmond said in a weblog post.

Every bit the Wall Street Periodical reports, any lag time on organizations installing these updates could result in more than infections come Monday morning time.

"It is important to understand that the way these attacks work means that compromises of machines and networks that have already occurred may not all the same accept been detected, and that existing infections from the malware can spread within networks," the UK'south National Cyber Security Centre said in a statement. "This means that as a new working week begins it is likely, in the U.k. and elsewhere, that further cases of ransomware may come up to low-cal, maybe at a significant scale."

While WannaCry infected targets in at to the lowest degree 150 countries, the United kingdom of great britain and northern ireland was particularly difficult hitting. The state's wellness organization, the NHS, was crippled, preventing staff from looking up patient records, dispensing medicine, and fifty-fifty performing surgeries.

"The NHS is working difficult to ensure that every bit few patients as possible are affected," the agency said in a Sun statement that outlined how patients should proceed.

About Chloe Albanesius

Chloe Albanesius

Chloe has led PCMag'south news coverage for more than than 10 years, editing and writing stories about the innovations that accept shaped the last decade and the companies behind them. She too oversees the site'southward how-to coverage. Before joining PCMag.com, Chloe was a reporter roofing tech policy on Capitol Colina for The National Journal's Technology Daily and fiscal It for Incisive Media in NYC. She's held internships at NBC's Meet the Press, washingtonpost.com, the Tate Gallery press office in London, Roll Call, and Congressional Quarterly. She graduated with a available's degree in journalism from American University in Washington, D.C.