SlideShare a Scribd company logo

Welcome to the #WannaCry Wine Club

•Download as PPTX, PDF•
•
Paul Dutot IEng MIET MBCS CITP OSCP CSTM
Paul Dutot IEng MIET MBCS CITP OSCP CSTM

A talk about WannaCry malware and the ShadowBrokers. Th e talk features a demo of the leaked NSA tool set.

Technology
1 of 18
Welcome to the #WannaCry Wine Club
Hello! I am Paul Dutot I am here because Paul Johnson asked me again. You all know me, you can find me at @cyberkryption on Twitter. It’s Sean’s turn next week….
What shall we talk about? #ShadowBrokers The story so far….. Fuzzbunch, Double Pulsar and EternalBlue. Demo Time #WanaCry Malware Impact. How it propagates? Defenses – Innoculation Demo #The Future What coming up in the next few months……
#ShadowBrokers A little known internet hacking group until recently… 1
2016 2017 Today Aug Sep Oct Nov Dec 2017 Feb Mar Apr May Shadow Brokers – Initial Leak 13/8/2016 Shadow Brokers Announce Auction on Pastebin 16/8/2016 Self Interview on Medium - Message 3 at https://medium.com/@shadowbrokerss/t heshadowbrokers-message-3-af1b181b481 1/10/2016 Shadow Brokers drop Unix exploits 31/10/2016 Shadow Brokers Dump Windows Toolsets after failed auction #2 1/12/2017 Shadow Brokers drop new Windows exploits 14/4/2017 #WannaCry Starts infecting systems 12/5/2017 Shadow Brokers start attempting to sell Windows exploits 14/12/2016 Shadow Brokers dump more Unix exploits 8/4/2017 ShadowBrokers - Timeline
ShadowBrokers - Realease Highlights DoublePulsar Windows kernel level implant, allows you to load a DLL of your choosing i.e reverse shell https://countercept.com/our- thinking/analyzing-the- doublepulsar-kernel-dll-injection- technique/ EternalBlue MS17-10 SMB v2 exploit ,works without authentication against Win 7 SP1. External Romance SMBv1 exploit over TCP port 445 which targets XP, 2003, Vista, 7, Windows 8, 2008, 2008 R2 https://github.com/adamcaudill/EquationGroupLeak / https://github.com/misterch0c/shadowbroker ExplodingCan IIS6.0 exploit which creates a remote backdoor. Fuzzbunch NSA exploitation framework similar to Metasploit
#WannaCry A global ransomware infection 2
WannaCry-Impact ◇ German Railway Network ◇ Renault and Nissan Car Plants ◇ 48 UK NHS Hospitals ◇ KPMG, Santander, Telefonica and FEDEX ◇ Chinese Cash Machines ◇ Russia – Interia Ministry ,VTB, RZD & Megafon Internet has taken to producing memes ======>
WannaCry - Information #WannaCry – Infection Vector ◇ Spreads via Server Message Block (SMB) a.k.a Windows File Sharing or open RDP sessions. ◇ Checks for DobulePulsar Implant and the uses that to load itself. ◇ If DoublePulsar is not present then use MS17-010 from the #ShadowBrokers to infect. ◇ Checks to see if it can contact kill switch domains, if so then malware becomes inert. ◇ Starts encryption routine and then beacons out to all machines on local subnet to infect.
WannaCry - Information #WannaCry – Technical II ◇ Main malware drops a zip archive with a hardcoded password of ’Wncry@2o17 after exploiation. ◇ Archive includes a number of files.Can you spot the zip archive? ◇ Encryption registers a service ‘ mssecsvc2.0’ in c:windowssystem32 with a display name of ‘Microsoft Security Center (2.0) Service’
WannaCry - Execution #WannaCry – Exeecution Detailed https://www.endgame.com/blog/wcrywanacry-ransomware-technical-analysis
WannaCry - Defense #WannaCry – Countermeasures $createdNew = $False; $mutex = New-Object -TypeName System.Threading.Mutex($true, "MsWinZonesCacheCounterMutexA", [ref]$createdNew); https://gist.github.com/N3mes1s ◇ Patch Ms17-010, obvious, but not always possibly within CNI environments such as NHS, air traffic control and power industry. ◇ Use router ACL’s and VLAN’s to limit access. ◇ Network Segmentation - Use router ACL’s and VLAN’s to limit access and host based firewalls to limit TCP/445 between workstations.
WannaCry - Mutex #WannaCry – Innoculation via Mutexes http://i.imgur.com/06EFCdS.gif
To Fuzzbench,EternalBlue ,DoublePulsar and Beyond
#The Future More global ransomware infections to come… 3
“ “In June, TheShadowBrokers is announcing "TheShadowBrokers Data Dump of the Month" service. TheShadowBrokers is launching new monthly subscription model. Is being like wine of month club. Each month peoples can be paying membership fee, then getting members only data dump each month. What members doing with data after is up to members.” https://steemit.com/shadowbrokers/@theshadowbrokers/oh-lordy-comey-wanna-cry-edition #The Future
“ “TheShadowBrokers Monthly Data Dump could be being: https://steemit.com/shadowbrokers/@theshadowbrokers/oh-lordy-comey-wanna-cry-edition #The Future - II ◇web browser, router, handset exploits and tools ◇select items from newer Ops Disks, including newer exploits for Windows 10 ◇compromised network data from more SWIFT providers and Central banks ◇compromised network data from Russian, Chinese, Iranian, or North Korean nukes and missile programs
Thanks! Any questions? You can find me at: ◇ @cyberkryption ◇ paul.dutot@je.logicalis.com ◇ All pictures are internet memes

Recommended

Cryptojacking - by Vishwaraj101
Cryptojacking - by Vishwaraj101Cryptojacking - by Vishwaraj101
Cryptojacking - by Vishwaraj101v_raj
 
Ransomware: Wannacry
Ransomware: WannacryRansomware: Wannacry
Ransomware: WannacryMikel Solabarrieta
 
Wannacry | Technical Insight and Lessons Learned
Wannacry | Technical Insight and Lessons LearnedWannacry | Technical Insight and Lessons Learned
Wannacry | Technical Insight and Lessons LearnedThomas Roccia
 
rensomware final ppt
rensomware final pptrensomware final ppt
rensomware final pptKomal Keshwer
 
Wannacry
WannacryWannacry
WannacryAravindVV
 
Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...
Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...
Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...HackIT Ukraine
 
WannaCry Ransomware
WannaCry Ransomware WannaCry Ransomware
WannaCry RansomwareZoho Corporation
 
Wannacry
WannacryWannacry
Wannacryemeka onuzuruike
 

Recommended

Cryptojacking - by Vishwaraj101
Cryptojacking - by Vishwaraj101Cryptojacking - by Vishwaraj101
Cryptojacking - by Vishwaraj101v_raj
 
Ransomware: Wannacry
Ransomware: WannacryRansomware: Wannacry
Ransomware: WannacryMikel Solabarrieta
 
Wannacry | Technical Insight and Lessons Learned
Wannacry | Technical Insight and Lessons LearnedWannacry | Technical Insight and Lessons Learned
Wannacry | Technical Insight and Lessons LearnedThomas Roccia
 
rensomware final ppt
rensomware final pptrensomware final ppt
rensomware final pptKomal Keshwer
 
Wannacry
WannacryWannacry
WannacryAravindVV
 
Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...
Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...
Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...HackIT Ukraine
 
WannaCry Ransomware
WannaCry Ransomware WannaCry Ransomware
WannaCry RansomwareZoho Corporation
 
Wannacry
WannacryWannacry
Wannacryemeka onuzuruike
 
Cryptolocker Ransomware Attack
Cryptolocker Ransomware AttackCryptolocker Ransomware Attack
Cryptolocker Ransomware AttackKeval Bhogayata
 
র‌্যানসমওয়্যার
র‌্যানসমওয়্যার র‌্যানসমওয়্যার
র‌্যানসমওয়্যার Titas Sarker
 
Shamoon attacks - Destructive malware targeting Middle East organizations
Shamoon attacks - Destructive malware targeting Middle East organizationsShamoon attacks - Destructive malware targeting Middle East organizations
Shamoon attacks - Destructive malware targeting Middle East organizationsSymantec Security Response
 
Ransomware the clock is ticking
Ransomware the clock is tickingRansomware the clock is ticking
Ransomware the clock is tickingManoj Kumar Mishra
 
Protecting Your organization from WannaCry Ransomware
Protecting Your organization from WannaCry RansomwareProtecting Your organization from WannaCry Ransomware
Protecting Your organization from WannaCry RansomwareQuick Heal Technologies Ltd.
 
TRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareTRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareThomas Roccia
 
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Roger Hagedorn
 
Blackhat USA 2014 - The New Scourge of Ransomware
Blackhat USA 2014 - The New Scourge of RansomwareBlackhat USA 2014 - The New Scourge of Ransomware
Blackhat USA 2014 - The New Scourge of RansomwareJohn Bambenek
 
Ransomware by lokesh
Ransomware by lokeshRansomware by lokesh
Ransomware by lokeshLokesh Bysani
 
Ransomeware
RansomewareRansomeware
RansomewareAbul Hossain Ripon
 
WannaCry ransomware outbreak - what you need to know
WannaCry ransomware outbreak - what you need to knowWannaCry ransomware outbreak - what you need to know
WannaCry ransomware outbreak - what you need to knowSymantec Security Response
 
Wannacry cyber attack.pptx
Wannacry cyber attack.pptxWannacry cyber attack.pptx
Wannacry cyber attack.pptxmachandi
 
The EternalBlue Exploit: how it works and affects systems
The EternalBlue Exploit: how it works and affects systemsThe EternalBlue Exploit: how it works and affects systems
The EternalBlue Exploit: how it works and affects systemsAndrea Bissoli
 
WannaCry / Wannacrypt Ransomware
WannaCry / Wannacrypt RansomwareWannaCry / Wannacrypt Ransomware
WannaCry / Wannacrypt RansomwareAyoub Rouzi
 
WannaCry ransomware attack
WannaCry ransomware attackWannaCry ransomware attack
WannaCry ransomware attackAbdelhakim Salama
 
WannaCry? No Thanks!
WannaCry? No Thanks!WannaCry? No Thanks!
WannaCry? No Thanks!Roberto Martelloni
 
Analysing Ransomware
Analysing RansomwareAnalysing Ransomware
Analysing RansomwareNapier University
 
Ransomware hostage rescue manual
Ransomware hostage rescue manualRansomware hostage rescue manual
Ransomware hostage rescue manualRoel Palmaers
 
ECrime presentation - A few bits about malware
ECrime presentation - A few bits about malwareECrime presentation - A few bits about malware
ECrime presentation - A few bits about malwareMichael Hendrickx
 
BlueHat v17 || Wannacrypt + Smbv1.0 Vulnerability = One of the Most Damaging ...
BlueHat v17 || Wannacrypt + Smbv1.0 Vulnerability = One of the Most Damaging ...BlueHat v17 || Wannacrypt + Smbv1.0 Vulnerability = One of the Most Damaging ...
BlueHat v17 || Wannacrypt + Smbv1.0 Vulnerability = One of the Most Damaging ...BlueHat Security Conference
 
Evolution of ransomware
Evolution of ransomwareEvolution of ransomware
Evolution of ransomwareCharles Steve
 
Wannacry Threat Brief
Wannacry Threat BriefWannacry Threat Brief
Wannacry Threat BriefDebra Baker, CISSP CSSP
 

More Related Content

What's hot

Cryptolocker Ransomware Attack
Cryptolocker Ransomware AttackCryptolocker Ransomware Attack
Cryptolocker Ransomware AttackKeval Bhogayata
 
র‌্যানসমওয়্যার
র‌্যানসমওয়্যার র‌্যানসমওয়্যার
র‌্যানসমওয়্যার Titas Sarker
 
Shamoon attacks - Destructive malware targeting Middle East organizations
Shamoon attacks - Destructive malware targeting Middle East organizationsShamoon attacks - Destructive malware targeting Middle East organizations
Shamoon attacks - Destructive malware targeting Middle East organizationsSymantec Security Response
 
Ransomware the clock is ticking
Ransomware the clock is tickingRansomware the clock is ticking
Ransomware the clock is tickingManoj Kumar Mishra
 
Protecting Your organization from WannaCry Ransomware
Protecting Your organization from WannaCry RansomwareProtecting Your organization from WannaCry Ransomware
Protecting Your organization from WannaCry RansomwareQuick Heal Technologies Ltd.
 
TRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareTRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareThomas Roccia
 
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Roger Hagedorn
 
Blackhat USA 2014 - The New Scourge of Ransomware
Blackhat USA 2014 - The New Scourge of RansomwareBlackhat USA 2014 - The New Scourge of Ransomware
Blackhat USA 2014 - The New Scourge of RansomwareJohn Bambenek
 
Ransomware by lokesh
Ransomware by lokeshRansomware by lokesh
Ransomware by lokeshLokesh Bysani
 

What's hot (10)

Cryptolocker Ransomware Attack
Cryptolocker Ransomware AttackCryptolocker Ransomware Attack
Cryptolocker Ransomware Attack
 
র‌্যানসমওয়্যার
র‌্যানসমওয়্যার র‌্যানসমওয়্যার
র‌্যানসমওয়্যার
 
Shamoon attacks - Destructive malware targeting Middle East organizations
Shamoon attacks - Destructive malware targeting Middle East organizationsShamoon attacks - Destructive malware targeting Middle East organizations
Shamoon attacks - Destructive malware targeting Middle East organizations
 
Ransomware the clock is ticking
Ransomware the clock is tickingRansomware the clock is ticking
Ransomware the clock is ticking
 
Protecting Your organization from WannaCry Ransomware
Protecting Your organization from WannaCry RansomwareProtecting Your organization from WannaCry Ransomware
Protecting Your organization from WannaCry Ransomware
 
TRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareTRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS Malware
 
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
 
Blackhat USA 2014 - The New Scourge of Ransomware
Blackhat USA 2014 - The New Scourge of RansomwareBlackhat USA 2014 - The New Scourge of Ransomware
Blackhat USA 2014 - The New Scourge of Ransomware
 
Ransomware by lokesh
Ransomware by lokeshRansomware by lokesh
Ransomware by lokesh
 
Ransomeware
RansomewareRansomeware
Ransomeware
 

Similar to Welcome to the #WannaCry Wine Club

WannaCry ransomware outbreak - what you need to know
WannaCry ransomware outbreak - what you need to knowWannaCry ransomware outbreak - what you need to know
WannaCry ransomware outbreak - what you need to knowSymantec Security Response
 
Wannacry cyber attack.pptx
Wannacry cyber attack.pptxWannacry cyber attack.pptx
Wannacry cyber attack.pptxmachandi
 
The EternalBlue Exploit: how it works and affects systems
The EternalBlue Exploit: how it works and affects systemsThe EternalBlue Exploit: how it works and affects systems
The EternalBlue Exploit: how it works and affects systemsAndrea Bissoli
 
WannaCry / Wannacrypt Ransomware
WannaCry / Wannacrypt RansomwareWannaCry / Wannacrypt Ransomware
WannaCry / Wannacrypt RansomwareAyoub Rouzi
 
Ransomware hostage rescue manual
Ransomware hostage rescue manualRansomware hostage rescue manual
Ransomware hostage rescue manualRoel Palmaers
 
ECrime presentation - A few bits about malware
ECrime presentation - A few bits about malwareECrime presentation - A few bits about malware
ECrime presentation - A few bits about malwareMichael Hendrickx
 
BlueHat v17 || Wannacrypt + Smbv1.0 Vulnerability = One of the Most Damaging ...
BlueHat v17 || Wannacrypt + Smbv1.0 Vulnerability = One of the Most Damaging ...BlueHat v17 || Wannacrypt + Smbv1.0 Vulnerability = One of the Most Damaging ...
BlueHat v17 || Wannacrypt + Smbv1.0 Vulnerability = One of the Most Damaging ...BlueHat Security Conference
 
Evolution of ransomware
Evolution of ransomwareEvolution of ransomware
Evolution of ransomwareCharles Steve
 
CSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
CSF18 - The Digital Threat of the Decade (Century) - Sasha KranjacCSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
CSF18 - The Digital Threat of the Decade (Century) - Sasha KranjacNCCOMMS
 
What’s the Difference Between Identity Fraud and Identity Theft?
What’s the Difference Between Identity Fraud and Identity Theft?What’s the Difference Between Identity Fraud and Identity Theft?
What’s the Difference Between Identity Fraud and Identity Theft?K7 Computing Pvt Ltd
 
What’s the Difference Between Identity Fraud and Identity Theft.docx.pptx
What’s the Difference Between Identity Fraud and Identity Theft.docx.pptxWhat’s the Difference Between Identity Fraud and Identity Theft.docx.pptx
What’s the Difference Between Identity Fraud and Identity Theft.docx.pptxkesavanrachel
 
Thane Barnier MACE 2016 presentation
Thane Barnier MACE 2016 presentationThane Barnier MACE 2016 presentation
Thane Barnier MACE 2016 presentationJeff Zahn
 
Malwares Malwares Malwares Malwares Malwares
Malwares Malwares Malwares Malwares MalwaresMalwares Malwares Malwares Malwares Malwares
Malwares Malwares Malwares Malwares MalwaresNioLemuelLazatinConc
 
Bad Rabbit type of ransomeware
Bad Rabbit type of ransomewareBad Rabbit type of ransomeware
Bad Rabbit type of ransomewareSumit
 

Similar to Welcome to the #WannaCry Wine Club (20)

WannaCry ransomware outbreak - what you need to know
WannaCry ransomware outbreak - what you need to knowWannaCry ransomware outbreak - what you need to know
WannaCry ransomware outbreak - what you need to know
 
Wannacry cyber attack.pptx
Wannacry cyber attack.pptxWannacry cyber attack.pptx
Wannacry cyber attack.pptx
 
The EternalBlue Exploit: how it works and affects systems
The EternalBlue Exploit: how it works and affects systemsThe EternalBlue Exploit: how it works and affects systems
The EternalBlue Exploit: how it works and affects systems
 
WannaCry / Wannacrypt Ransomware
WannaCry / Wannacrypt RansomwareWannaCry / Wannacrypt Ransomware
WannaCry / Wannacrypt Ransomware
 
WannaCry ransomware attack
WannaCry ransomware attackWannaCry ransomware attack
WannaCry ransomware attack
 
WannaCry? No Thanks!
WannaCry? No Thanks!WannaCry? No Thanks!
WannaCry? No Thanks!
 
Analysing Ransomware
Analysing RansomwareAnalysing Ransomware
Analysing Ransomware
 
Ransomware hostage rescue manual
Ransomware hostage rescue manualRansomware hostage rescue manual
Ransomware hostage rescue manual
 
ECrime presentation - A few bits about malware
ECrime presentation - A few bits about malwareECrime presentation - A few bits about malware
ECrime presentation - A few bits about malware
 
BlueHat v17 || Wannacrypt + Smbv1.0 Vulnerability = One of the Most Damaging ...
BlueHat v17 || Wannacrypt + Smbv1.0 Vulnerability = One of the Most Damaging ...BlueHat v17 || Wannacrypt + Smbv1.0 Vulnerability = One of the Most Damaging ...
BlueHat v17 || Wannacrypt + Smbv1.0 Vulnerability = One of the Most Damaging ...
 
Evolution of ransomware
Evolution of ransomwareEvolution of ransomware
Evolution of ransomware
 
Wannacry Threat Brief
Wannacry Threat BriefWannacry Threat Brief
Wannacry Threat Brief
 
CSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
CSF18 - The Digital Threat of the Decade (Century) - Sasha KranjacCSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
CSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
 
What’s the Difference Between Identity Fraud and Identity Theft?
What’s the Difference Between Identity Fraud and Identity Theft?What’s the Difference Between Identity Fraud and Identity Theft?
What’s the Difference Between Identity Fraud and Identity Theft?
 
What’s the Difference Between Identity Fraud and Identity Theft.docx.pptx
What’s the Difference Between Identity Fraud and Identity Theft.docx.pptxWhat’s the Difference Between Identity Fraud and Identity Theft.docx.pptx
What’s the Difference Between Identity Fraud and Identity Theft.docx.pptx
 
Network security
Network securityNetwork security
Network security
 
Thane Barnier MACE 2016 presentation
Thane Barnier MACE 2016 presentationThane Barnier MACE 2016 presentation
Thane Barnier MACE 2016 presentation
 
Malwares Malwares Malwares Malwares Malwares
Malwares Malwares Malwares Malwares MalwaresMalwares Malwares Malwares Malwares Malwares
Malwares Malwares Malwares Malwares Malwares
 
Ransomware
RansomwareRansomware
Ransomware
 
Bad Rabbit type of ransomeware
Bad Rabbit type of ransomewareBad Rabbit type of ransomeware
Bad Rabbit type of ransomeware
 

More from Paul Dutot IEng MIET MBCS CITP OSCP CSTM

More from Paul Dutot IEng MIET MBCS CITP OSCP CSTM (10)

Scanning Channel Islands Cyberspace
Scanning Channel Islands Cyberspace Scanning Channel Islands Cyberspace
Scanning Channel Islands Cyberspace
 
Incident Response in the wake of Dear CEO
Incident Response in the wake of Dear CEOIncident Response in the wake of Dear CEO
Incident Response in the wake of Dear CEO
 
Logicalis Security Conference
Logicalis Security ConferenceLogicalis Security Conference
Logicalis Security Conference
 
Letter anonymous-II
Letter anonymous-IILetter anonymous-II
Letter anonymous-II
 
Exploiting buffer overflows
Exploiting buffer overflowsExploiting buffer overflows
Exploiting buffer overflows
 
Practical Cyber Defense
Practical Cyber DefensePractical Cyber Defense
Practical Cyber Defense
 
A Letter from Anonymous to the Jersey Finance Industry
A Letter from Anonymous to the Jersey Finance IndustryA Letter from Anonymous to the Jersey Finance Industry
A Letter from Anonymous to the Jersey Finance Industry
 
Infosec lecture-final
Infosec lecture-finalInfosec lecture-final
Infosec lecture-final
 
Path to Surfdroid
Path to SurfdroidPath to Surfdroid
Path to Surfdroid
 
WI-FI Security in Jersey 2011
WI-FI Security in Jersey 2011WI-FI Security in Jersey 2011
WI-FI Security in Jersey 2011
 

Recently uploaded

Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountPuma Security, LLC
 
Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101Paola De la Torre
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Drew Madelung
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationSafe Software
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...apidays
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesSinan KOZAK
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j
 
IAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI SolutionsIAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI SolutionsEnterprise Knowledge
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Scriptwesley chun
 
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...gurkirankumar98700
 
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfThe Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfEnterprise Knowledge
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking MenDelhi Call girls
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Enterprise Knowledge
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilV3cube
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processorsdebabhi2
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationMichael W. Hawkins
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Neo4j
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024The Digital Insurer
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityPrincipled Technologies
 

Recently uploaded (20)

Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path Mount
 
Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen Frames
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
 
IAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI SolutionsIAC 2024 - IA Fast Track to Search Focused AI Solutions
IAC 2024 - IA Fast Track to Search Focused AI Solutions
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
 
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfThe Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of Brazil
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 

Welcome to the #WannaCry Wine Club

  • 2. Hello! I am Paul Dutot I am here because Paul Johnson asked me again. You all know me, you can find me at @cyberkryption on Twitter. It’s Sean’s turn next week….
  • 3. What shall we talk about? #ShadowBrokers The story so far….. Fuzzbunch, Double Pulsar and EternalBlue. Demo Time #WanaCry Malware Impact. How it propagates? Defenses – Innoculation Demo #The Future What coming up in the next few months……
  • 4. #ShadowBrokers A little known internet hacking group until recently… 1
  • 5. 2016 2017 Today Aug Sep Oct Nov Dec 2017 Feb Mar Apr May Shadow Brokers – Initial Leak 13/8/2016 Shadow Brokers Announce Auction on Pastebin 16/8/2016 Self Interview on Medium - Message 3 at https://medium.com/@shadowbrokerss/t heshadowbrokers-message-3-af1b181b481 1/10/2016 Shadow Brokers drop Unix exploits 31/10/2016 Shadow Brokers Dump Windows Toolsets after failed auction #2 1/12/2017 Shadow Brokers drop new Windows exploits 14/4/2017 #WannaCry Starts infecting systems 12/5/2017 Shadow Brokers start attempting to sell Windows exploits 14/12/2016 Shadow Brokers dump more Unix exploits 8/4/2017 ShadowBrokers - Timeline
  • 6. ShadowBrokers - Realease Highlights DoublePulsar Windows kernel level implant, allows you to load a DLL of your choosing i.e reverse shell https://countercept.com/our- thinking/analyzing-the- doublepulsar-kernel-dll-injection- technique/ EternalBlue MS17-10 SMB v2 exploit ,works without authentication against Win 7 SP1. External Romance SMBv1 exploit over TCP port 445 which targets XP, 2003, Vista, 7, Windows 8, 2008, 2008 R2 https://github.com/adamcaudill/EquationGroupLeak / https://github.com/misterch0c/shadowbroker ExplodingCan IIS6.0 exploit which creates a remote backdoor. Fuzzbunch NSA exploitation framework similar to Metasploit
  • 8. WannaCry-Impact ◇ German Railway Network ◇ Renault and Nissan Car Plants ◇ 48 UK NHS Hospitals ◇ KPMG, Santander, Telefonica and FEDEX ◇ Chinese Cash Machines ◇ Russia – Interia Ministry ,VTB, RZD & Megafon Internet has taken to producing memes ======>
  • 9. WannaCry - Information #WannaCry – Infection Vector ◇ Spreads via Server Message Block (SMB) a.k.a Windows File Sharing or open RDP sessions. ◇ Checks for DobulePulsar Implant and the uses that to load itself. ◇ If DoublePulsar is not present then use MS17-010 from the #ShadowBrokers to infect. ◇ Checks to see if it can contact kill switch domains, if so then malware becomes inert. ◇ Starts encryption routine and then beacons out to all machines on local subnet to infect.
  • 10. WannaCry - Information #WannaCry – Technical II ◇ Main malware drops a zip archive with a hardcoded password of ’Wncry@2o17 after exploiation. ◇ Archive includes a number of files.Can you spot the zip archive? ◇ Encryption registers a service ‘ mssecsvc2.0’ in c:windowssystem32 with a display name of ‘Microsoft Security Center (2.0) Service’
  • 11. WannaCry - Execution #WannaCry – Exeecution Detailed https://www.endgame.com/blog/wcrywanacry-ransomware-technical-analysis
  • 12. WannaCry - Defense #WannaCry – Countermeasures $createdNew = $False; $mutex = New-Object -TypeName System.Threading.Mutex($true, "MsWinZonesCacheCounterMutexA", [ref]$createdNew); https://gist.github.com/N3mes1s ◇ Patch Ms17-010, obvious, but not always possibly within CNI environments such as NHS, air traffic control and power industry. ◇ Use router ACL’s and VLAN’s to limit access. ◇ Network Segmentation - Use router ACL’s and VLAN’s to limit access and host based firewalls to limit TCP/445 between workstations.
  • 13. WannaCry - Mutex #WannaCry – Innoculation via Mutexes http://i.imgur.com/06EFCdS.gif
  • 15. #The Future More global ransomware infections to come… 3
  • 16. “ “In June, TheShadowBrokers is announcing "TheShadowBrokers Data Dump of the Month" service. TheShadowBrokers is launching new monthly subscription model. Is being like wine of month club. Each month peoples can be paying membership fee, then getting members only data dump each month. What members doing with data after is up to members.” https://steemit.com/shadowbrokers/@theshadowbrokers/oh-lordy-comey-wanna-cry-edition #The Future
  • 17. “ “TheShadowBrokers Monthly Data Dump could be being: https://steemit.com/shadowbrokers/@theshadowbrokers/oh-lordy-comey-wanna-cry-edition #The Future - II ◇web browser, router, handset exploits and tools ◇select items from newer Ops Disks, including newer exploits for Windows 10 ◇compromised network data from more SWIFT providers and Central banks ◇compromised network data from Russian, Chinese, Iranian, or North Korean nukes and missile programs
  • 18. Thanks! Any questions? You can find me at: ◇ @cyberkryption ◇ paul.dutot@je.logicalis.com ◇ All pictures are internet memes

Editor's Notes

  1. Before #WannaCry , there was ADYLKUZZ malware as detailed by Proofpoint reasearcher Kafeine at https://www.proofpoint.com/us/threat-insight/post/adylkuzz-cryptocurrency-mining-malware-spreading-for-weeks-via-eternalblue-doublepulsar The attack turned off vulnerable SMB hosts after exploiting them, this lessened the effects of WannaCry