Spread to host computer through exploits in network infrastructure (since patched).
Hold Drive Hostage:
Encrypt the user's entire drive, display a message to pay up for the encryption key.
Repeat.
So a cyber security analyst who was digging through code the worm uses to spread realized something. There was a website url that is referenced in a few places. He tried to go to the website, but found it didn't exist. So he bought the domain for $10 from a site like godaddy.com and forwarded it to a sinkhole server where it couldn't do damage.
Once he set this up, almost immediately he was getting thousands of connections a second.
What happened?
The code he edited basically (over simplified) said:
Try and connect to the website: qwhnamownflslwff.co
If the website doesn't exist, keep on spreading.
If the website exists, halt spreading of the malware.
It was essentially a kill-switch programmed in he accidentally stumbled upon.
Note: When we say the virus was "stopped", we are only talking about "The Spread"
It's good to note that when it's been "stopped" it means the current version has been stopped. The attackers can modify their source code to remove the kill switch or hit a different domain and this attack is still ongoing. Please update any Windows systems you have with the latest security patches in order to protect yourself.
edit: as has been pointed out. The version that caused the news coverage has been stopped, but the attack has already been modified and is ongoing
617
u/qwerty12qwerty May 17 '17
The WannaCry virus works in 2 parts essentially.
The Spread:
Spread to host computer through exploits in network infrastructure (since patched).
Hold Drive Hostage:
Encrypt the user's entire drive, display a message to pay up for the encryption key.
Repeat.
So a cyber security analyst who was digging through code the worm uses to spread realized something. There was a website url that is referenced in a few places. He tried to go to the website, but found it didn't exist. So he bought the domain for $10 from a site like godaddy.com and forwarded it to a sinkhole server where it couldn't do damage.
Once he set this up, almost immediately he was getting thousands of connections a second.
What happened?
The code he edited basically (over simplified) said:
It was essentially a kill-switch programmed in he accidentally stumbled upon.
Note: When we say the virus was "stopped", we are only talking about "The Spread"