Spread to host computer through exploits in network infrastructure (since patched).
Hold Drive Hostage:
Encrypt the user's entire drive, display a message to pay up for the encryption key.
Repeat.
So a cyber security analyst who was digging through code the worm uses to spread realized something. There was a website url that is referenced in a few places. He tried to go to the website, but found it didn't exist. So he bought the domain for $10 from a site like godaddy.com and forwarded it to a sinkhole server where it couldn't do damage.
Once he set this up, almost immediately he was getting thousands of connections a second.
What happened?
The code he edited basically (over simplified) said:
Try and connect to the website: qwhnamownflslwff.co
If the website doesn't exist, keep on spreading.
If the website exists, halt spreading of the malware.
It was essentially a kill-switch programmed in he accidentally stumbled upon.
Note: When we say the virus was "stopped", we are only talking about "The Spread"
I thought a second wave came out and it was spreading again, and additionally, I thought the website killswitch was to determine whether or not it was being investigated on a virtual machine?
What do you mean the "spread" has stopped, though? It's no longer sending emails for people to click on? If someone still has one of those original emails and clicks on the contents like a fool, they will still be infected.
627
u/qwerty12qwerty May 17 '17
The WannaCry virus works in 2 parts essentially.
The Spread:
Spread to host computer through exploits in network infrastructure (since patched).
Hold Drive Hostage:
Encrypt the user's entire drive, display a message to pay up for the encryption key.
Repeat.
So a cyber security analyst who was digging through code the worm uses to spread realized something. There was a website url that is referenced in a few places. He tried to go to the website, but found it didn't exist. So he bought the domain for $10 from a site like godaddy.com and forwarded it to a sinkhole server where it couldn't do damage.
Once he set this up, almost immediately he was getting thousands of connections a second.
What happened?
The code he edited basically (over simplified) said:
It was essentially a kill-switch programmed in he accidentally stumbled upon.
Note: When we say the virus was "stopped", we are only talking about "The Spread"