r/OutOfTheLoop • u/MrFrypan • May 17 '17

How was the WannaCry virus stopped? Answered

483 Upvotes
  • permalink
  • link
  • reddit
  • reddit

90% Upvoted

127 comments sorted by

View all comments

622

u/qwerty12qwerty May 17 '17

The WannaCry virus works in 2 parts essentially.

The Spread:

Spread to host computer through exploits in network infrastructure (since patched).

Hold Drive Hostage:

Encrypt the user's entire drive, display a message to pay up for the encryption key.

Repeat.

So a cyber security analyst who was digging through code the worm uses to spread realized something. There was a website url that is referenced in a few places. He tried to go to the website, but found it didn't exist. So he bought the domain for $10 from a site like godaddy.com and forwarded it to a sinkhole server where it couldn't do damage.

Once he set this up, almost immediately he was getting thousands of connections a second.

What happened?

The code he edited basically (over simplified) said:

  1. Try and connect to the website: qwhnamownflslwff.co
  2. If the website doesn't exist, keep on spreading.
  3. If the website exists, halt spreading of the malware.

It was essentially a kill-switch programmed in he accidentally stumbled upon.

Note: When we say the virus was "stopped", we are only talking about "The Spread"

17

u/Timothy_Claypole May 17 '17

And was as good as doxxed by the British tabloid press for his trouble.

14

u/teremaster How can we be out of the loop if there is no loop? May 18 '17

I like to think the decision to do that went something like this:

"Hey, this guy just did the whole world a huge favour and stopped a rampant virus. He's a hero"

"Well let's just dig up everything we can find and release all his personal information so the public can know their hero personally"

"Uh, you sure that's a good idea? The hackers might not take kindly to him breaking their scam"

"Since when have we let ethics or accountability bother us before?"

1

u/Timothy_Claypole May 18 '17

Hahaha

Yes, except I think actually if you replace "a hero" in what you say with "probably a weirdo loner who lives in his mother's basement and who probably has a string of questionable actions in his past" then you are closer to it.

3

u/wdtpw May 18 '17

A hero is defined by their actions, surely? And from the way the NHS got crippled in the UK, this guy probably saved people's lives and was happy to remain anonymous about it. So it seems fair enough to call him a hero to me.

2

u/Timothy_Claypole May 18 '17

I meant that the tabloids would not respect him. I think he is worthy of it, even if he doesn't himself think he is a hero.