This document discusses the WannaCry ransomware attack of May 2017. It provides an overview of how WannaCry worked, including that it infected over 300,000 Windows machines worldwide by encrypting their contents until a ransom was paid in bitcoin. It spread using vulnerabilities in Microsoft SMB and EternalBlue/DoublePulsar exploits. The document advocates for securing networks and applications to manage risks from these types of attacks and focuses on quality and security practices across the software development lifecycle.

1. © 2017 Synopsys, Inc. 1
Don’t WannaCry?
How Stop Those Ransomware Blues
Robert Vamosi CISSP, Security Strategist, Synopsys
Steve Cohen, Product Marketing Manager, Synopsys

2. © 2017 Synopsys, Inc. 2
Robert Vamosi Steven Cohen
Security Strategist at
Synopsys
Product Marketing
Manager at Synopsys

3. © 2017 Synopsys, Inc. 3
WannaCry Ransomware: An Overview

4. © 2017 Synopsys, Inc. 4 Confidential
The WannaCry Pandemic
• Infected 300,000
Windows machines
worldwide at its peak
(May 12, 2017).
• Encrypted contents of
compromised Windows
machines until a ransom
was paid via BitCoin.

5. © 2017 Synopsys, Inc. 5 Confidential
How does WannaCry work?
• Encrypts the contents of a
compromised machine.
• Uses a private key/public
key.
• Once ransom is paid,
unlocks contents with the
private key.

6. © 2017 Synopsys, Inc. 6 Confidential
What is WannaCry?
A computer worm

7. © 2017 Synopsys, Inc. 7 Confidential
Classic computer worms
Examples include:
• Morris worm (1988)
• ILOVEYOU (2000)
• Code Red (2001)
• SQLSlammer (2003)
• MSBlaster (2005)

8. © 2017 Synopsys, Inc. 8 Confidential
Securing the Network Layer

9. © 2017 Synopsys, Inc. 9 Confidential
Who is affected?
•Mostly Windows 7 systems that
have not installed the MS17-010
update
•Potentially all Windows systems
that have not installed the MS17-
010 update

10. © 2017 Synopsys, Inc. 10 Confidential
How does WannaCry spread?
•Uses a vulnerability in
Microsoft SMB (now patched
MS17-010)
•Uses an exploit called
EternalBlue to establish a
remote access
•Uses an exploit called
DoublePulsar to download
ransomware package

11. © 2017 Synopsys, Inc. 11 Confidential
Securing the Application layer

12. © 2017 Synopsys, Inc. 12 Confidential
Managing risk by focusing on quality and security
Risk
Mgmt.
Software
Quality
Software
Security
Other

13. © 2017 Synopsys, Inc. 13 Confidential
Penetrate and then pivot across attack surfaces
WannaCry demonstrates how incredibly
important it is for firms to focus on their
network attack surface, and to extend that
same rigor to their software attack surface to
avoid unnecessary risk.

14. © 2017 Synopsys, Inc. 14 Confidential
The evolving landscape of software development
Embedded devices
Cloud (private,
hybrid, public)
Languages, open source
and frameworks
New tech stacks
and attack surfaces
Agile, DevOpsSec, CI/CD
Fit into toolchain eco-systems
Automation through toolchain
integration
New development
philosophies
and approaches
Comprehensive view into risk
Accuracy and speed of quality
defects and security
vulnerability feedback
Focus
Lack visibility into
evolving application
portfolio
Align with workflow timeframes
Security as a core component
of quality
Testing coverage and depth
Changing
testing
demands

15. © 2017 Synopsys, Inc. 15 Confidential
Comprehensive portfolio to manage risk
Program Design and Development
Define, implement and measure a SSI to reflect your evolving development and deployment environments
Managing Risk Across your SDLC with Diverse Products
Build in security and quality through automation at every step during development and across the supply chain
Managed Services Offerings
Get the testing capacity you need, at the depth you need, to rapidly respond to changing testing requirements and evolving
threats
Professional Services Offerings
Adopt quality and security best practices, tools, and strategies to your technology stack
Education Offerings
Prepares developers and security professionals to build security and quality into their software development process and remediate
found vulnerabilities and defects

16. © 2017 Synopsys, Inc. 16 Confidential
Improving the quality and security of your SDLC

17. © 2017 Synopsys, Inc. 17 Confidential
Complete support across your SDLC
REQUIREMENTS
& DESIGN
Architecture Risk
Analysis
Security Code
Design Analysis
Threat Modeling
TRAINING
Core Security
Training
Secure Coding
Training
eLearning
SAST (IDE)
SAST (Build)
SCA (Source)
IAST
IMPLEMENTATION
SAST (Managed)
Fuzz Testing
SCA (Binary)
Mobile Testing
VERIFICATION
DAST (Managed)
Pen Testing
Network Pen Testing
RELEASE
Agile DevOpsCI/CD
ANY DEVELOPMENT APPROACH ANY DEPLOYMENT ENVIRONMENT
Embedded Cloud Mobile

18. © 2017 Synopsys, Inc. 18 Confidential
Address changing risk management requirements
Any test…
SAST, DAST, IAST, Source Code Analysis,
business logic testing
…on any software…
Web, mobile, legacy, cloud, IoT,
embedded systems
...at any depth...
From fully automated to comprehensive
manual testing
...with complete flexibility...
On-premises, managed services or a blend of
both to cover your entire portfolio
...at any stage in the SDLC…
Architecture and design to real-time in the IDE
to production application testing
…with services and programs

19. © 2017 Synopsys, Inc. 19 Confidential
Q&A

20. Thank You