Latest news of the domain name industry

Recent Posts

Massive ransomware attack hits 150 countries, brought down by a domain reg

Kevin Murphy, May 15, 2017, 09:12:30 (UTC), Domain Tech

A massive outbreak of malware on Friday hit thousands of organizations in an estimated 150 countries and had a big impact on the UK National Health Service before being temporarily thwarted by a single domain name registration.

WannaCry, as the malware has been called, targets Windows boxes that have not installed a March security patch. It encrypts files on the hosts it infects and demands money for the decryption key.

The attack is Big News for several reasons.

First, it spread ransomware over the network using a remotely exploitable vulnerability that required no user error or social engineering to install itself.

Second, it hit an estimated quarter-million machines, including thousands at big organizations such as Telefonica, the NHS, Deutsche Bahn and FedEx.

Third, it posed a real risk to human life. A reported 70,000 NHS machines, including medical devices, were said to be infected. Reportedly, some non-critical patients had to be turned away from UK hospitals and operations were cancelled due to the inability of doctors to access medical records.

Fourth, WannaCry appears to have been based on code developed by the US National Security Agency and leaked last month.

All in all, it was an attack the scale of which we have not seen for many years.

But it seems to have been “accidentally” prevented from propagating further on Friday, at least temporarily, with the simple act of registering a domain name.

A young British security researcher who goes by the online handle MalwareTech said he was poring over the WannaCry code on Friday afternoon when he came across an unregistered domain name.

On the assumption that the malware author perhaps planned to use the domain as a command and control center, MalwareTech spent the ten bucks to register it.

MalwareTech discovered that after the domain was registered, the malware stopped encrypting the hard drives it infected.

He first thought it was a fail-safe or kill-switch, but he later came to the conclusion that the author had included the domain lookup as a way to thwart security researchers such as himself, who run malware code in protected sandbox environments.

MalwareTech wrote:

In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as [if] it were registered

Once the domain was registered, WannaCry iterations on newly infected machines assume they were running in sandboxes and turned themselves off before causing additional damage.

MalwareTech was naturally enough proclaimed the hero of the day by many news outlets, but it appears that versions of the malware without the DNS query kill-switch already started circulating over the weekend.

Many are warning that the start of the work week today may see a new rash of infections.

The researcher’s account of the incident can be read in full here.

Tagged: , , , ,

Add Your Comment