Random thoughts about WannaCry
Propagation
The propagation of the WannaCry attack was massive and mostly due to the fact it infected computers via SMB1, an old Windows file-sharing network protocol. Some security experts complained that Ransomware has been massive for two years already and this event is only a one big hype wave though I think there is a difference here and it is the magnitude of propagation. There is a big difference when attack distribution relies solely on people unintentionally clicking on a malicious link or document and get infected vs. this attack propagation patterns. This is the first attack as far as I remember where an attack propagates both across the internet and inside organizations using the same single vulnerability. Very efficient propagation scheme apparently.
Vulnerabilities
The attack unveiled the explosive number?of?computers globally?that are outdated?and non-patched. Some of them?are outdated since?patches did not exist – for example, Windows XP which does not have an active updates support. The rest?of the victims were not up-to-date with the latest patches since it is highly cumbersome to constantly keep computers up-to-date – truth needs to be told. Keeping everything patched?in an organization reduces productivity eventually as there are many disruptions to work – for instance, many applications running on an old system stop working when?the underlying operating system?is?updated. I heard of a large organization that was hurt deeply by the attack and not because the Ransomware hit them, they had to stop working for a full day across the organization?since the security updates delivered by the IT department ironically made all the computers unusable.
Another thing to take into account is the magnitude of vulnerability. The magnitude of vulnerability has a tight correlation to its prevalence and the ease of accessing it. This EternalBlue vulnerability has massive magnitude as it is apparently highly popular. It is the first time I think that an exploit for a vulnerability feels like a weapon. Maybe it is time to create some dynamic risk ranking for vulnerabilities beyond the rigid CVE classification. Vulnerabilities by definition are software bugs and there are different classes of software. There are operating systems and inside the category of the operating system, there are drivers, kernel, and user-mode processes. Also within the world of the kernel, there are different areas such as the networking stack, the display drivers, interprocess mechanisms, etc.. Besides operating systems, we have user applications as well as user services which are pieces of software that provide services in the back to user applications. A vulnerability can reside in each one of those areas where fixing a vulnerability or protecting against exploitation of it has a whole different magnitude of complexity. For example kernel vulnerabilities are the hardest to fix compared to vulnerabilities in user applications. In correspondence their impact once exploited is always measurably severer in terms of what an attacker can do post-exploitation due to the level of freedom such software class allows.
The massive impact of WannaCry was not due to the sophistication of its ransomware component, it was due to the SMB1 vulnerability which turned out to be highly popular. Actually, the ransomware itself was quite naive in terms of the way it operated. The funny turn of events was that many advanced defense products did not capture the attack since they assume some level of sophistication while plain signature-based anti-viruses which search for digital signatures were quite efficient. This case is enforcement of the layered defense thesis which means signatures are here to stay and should be layered with more advanced defense tools.
As for the sheer luck, we had with this?naive ransomware, just imagine what would happen if the payload of the attack was at least as sophisticated as other advanced attacks we see nowadays. It could have been devastating and unfortunately, we are not our of danger yet as it can happen – this attack was a lesson not only for defenders but also for attackers.
Monetization
Very quickly law enforcement authorities found?the target bitcoin accounts used for collecting the ransomware and started watching for?someone that withdraws the money. The amount of money collected was quite low even though the distribution was massive and some attribute it to the novice ransomware backend that as I read?in some cases it won’t even decrypt the files even if you pay.
The successful distribution did?something that the attackers did not take into account and that is the high visibility of the campaign. It is quite obvious that such a mass scale attack would wake up all law enforcement authorities to search for the money which makes withdrawing the money impossible.
Final Thoughts
Something about this attack does not make sense – on one hand, the distribution was highly successful in a magnitude not seen before for such attacks while at the same time the payload, hence the ransomware, was naive, the monetization scheme was not planned properly and even the backend for collecting money and decrypting the user files was unstable. So either it was a demonstration of power and not really a ransomware campaign like launching a ballistic missile towards the ocean or just a real amateur attacker.
Another thought is that I don’t have yet a solid?recommendation on how to be more prepared for the next time. There are a multitude of open vulnerabilities out there, some with patches available and some not and even if you patch like crazy still it won’t provide a full?guarantee. Of course, my baseline must recommendation is to use advanced prevention security products and do automatic patching.
The final thought is that a discussion about regulatory intervention in the level of protection in the private sector should start. I can really see the effectiveness of mandatory security provisions required from organizations similar to what is done in the accounting world. Very similar to getting vaccinated. The private sector and especially the small medium-size businesses are currently highly vulnerable.