SlideShare a Scribd company logo
WANNACRY / WANNACRYPT
RANSOMWARE
Prepared by:
- Ayoub Rouzi
- Abdelhakim Salama
PLAN
 Introduction
 What happened ?
 What is Wannacry / Wannacrypt ?
 How many Infections ?
 What happens to the victim?
 How to protect yourself ?
 Will Paying the Ransom Help Us?
 Conclusion
2
WHAT IS RANSOMWARE ?
 “Ransomware is a malware that encrypts contents on infected systems and demands payment in bitcoins.”
3
WHAT HAPPENED?
several organizations were affected by a new Ransomware strain.
The exploit ETERNALBLUE, was released in as part of a leak of NSA.
May 12th 2017
April 15th 2017
March 14th 2017
Apparition of WanaCrypt0r 2.0 who is more dangerious May 22th 2017
A young white hat hacker stopped wannacry attack
May 21th 2017
A "critical" patch had been issued by Microsoft
4
HOW MANY INFECTIONS?
Estimated > 200,000 victims
5
HOW MANY INFECTIONS?
6
HOW MANY INFECTIONS?
7
HOW DO SYSTEMS GET INFECTED?
• E-Mail.
• Infected websites.
• SMB (Server Message Block) :
vulnerable systems exposed via port 445.
8
WHAT HAPPENS TO THE VICTIM?
• Files with specific extensions will be encrypted.
• The victim will see a ransom message asking for approx. $300.
9
WHAT HAPPENS TO THE VICTIM?
• Once all the files are encrypted:
• Open a backdoor
10
WHAT HAPPENS TO THE VICTIM?
Wannacry warns the user of the encryption of these files by modificating the desktop wallpaper:
11
HOW TO PROTECT YOURSELF
12
WILL PAYING THE RANSOM HELP US?
• There is no public report from victims who paid the ransom.
• About a hundred victims paid so far.
13
WHAT’S THE UPDATES ?
14
• Windows, Linux, Mac
• More victims
• More data collection
CONCLUSION
• Availability
Affected organizations will loose access to the files encrypted by the malware. Recovery is
uncertain even after paying the ransom.
• Confidentiality
The malware does install a backdoor that could be used to leak data from affected machines,
but the malware itself does not exfiltrate data
• Integrity
Aside from encrypting the data, the malware does not alter data. But the backdoor could be
used by others to cause additional damage
15

More Related Content

Similar to Wannacry cyber attack.pptx

Wannacry Virus
Wannacry VirusWannacry Virus
Wannacry Virus
East West University
 
Crypto-Jacking, Ransomware & Worming Malware's Frightening Future (Keynote an...
Crypto-Jacking, Ransomware & Worming Malware's Frightening Future (Keynote an...Crypto-Jacking, Ransomware & Worming Malware's Frightening Future (Keynote an...
Crypto-Jacking, Ransomware & Worming Malware's Frightening Future (Keynote an...
Jay Beale
 
Defend Your Company Against Ransomware
Defend Your Company Against RansomwareDefend Your Company Against Ransomware
Defend Your Company Against Ransomware
Kevo Meehan
 
Get Smart about Ransomware: Protect Yourself and Organization
Get Smart about Ransomware: Protect Yourself and OrganizationGet Smart about Ransomware: Protect Yourself and Organization
Get Smart about Ransomware: Protect Yourself and Organization
Security Innovation
 
Zero day exploit
Zero day exploitZero day exploit
Zero day exploit
Aashiq Ahamed N
 
WannaCry ransomware outbreak - what you need to know
WannaCry ransomware outbreak - what you need to knowWannaCry ransomware outbreak - what you need to know
WannaCry ransomware outbreak - what you need to know
Symantec Security Response
 
Ransomware ly
Ransomware lyRansomware ly
Ransomware ly
Lisa Young
 
Ransomware
RansomwareRansomware
Ransomware
Chaitali Sharma
 
What is wanna cry ransomware attack
What is wanna cry ransomware attackWhat is wanna cry ransomware attack
What is wanna cry ransomware attack
i-engage
 
Case Study: Wannacry Ransomware attacks Telefónica
Case Study: Wannacry Ransomware attacks TelefónicaCase Study: Wannacry Ransomware attacks Telefónica
Case Study: Wannacry Ransomware attacks Telefónica
Sergio Renteria Nuñez
 
WannaCry: Autopsy of Ransomwar
WannaCry: Autopsy of RansomwarWannaCry: Autopsy of Ransomwar
WannaCry: Autopsy of Ransomwar
David Smith
 
Ransomware hostage rescue manual
Ransomware hostage rescue manualRansomware hostage rescue manual
Ransomware hostage rescue manual
Roel Palmaers
 
Ransomware: Wannacry
Ransomware: WannacryRansomware: Wannacry
Ransomware: Wannacry
Mikel Solabarrieta
 
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Roger Hagedorn
 
Your Guide to tackle the Ransomware threat "WannaCry" | Sysfore
Your Guide to tackle the Ransomware threat "WannaCry" | SysforeYour Guide to tackle the Ransomware threat "WannaCry" | Sysfore
Your Guide to tackle the Ransomware threat "WannaCry" | Sysfore
Sysfore Technologies
 
Ransomware by lokesh
Ransomware by lokeshRansomware by lokesh
Ransomware by lokesh
Lokesh Bysani
 
Ransomware all locked up book
Ransomware all locked up bookRansomware all locked up book
Ransomware all locked up book
Diego Souza
 
Ransomware - Rameez Shahzada
Ransomware - Rameez ShahzadaRansomware - Rameez Shahzada
Ransomware - Rameez Shahzada
RAMEEZ SHAHZADA
 
Ransomware
RansomwareRansomware
Ransomware
Akshita Pillai
 
Ransomware and email security ver - 1.3
Ransomware and email security   ver - 1.3Ransomware and email security   ver - 1.3
Ransomware and email security ver - 1.3
Denise Bailey
 

Similar to Wannacry cyber attack.pptx (20)

Wannacry Virus
Wannacry VirusWannacry Virus
Wannacry Virus
 
Crypto-Jacking, Ransomware & Worming Malware's Frightening Future (Keynote an...
Crypto-Jacking, Ransomware & Worming Malware's Frightening Future (Keynote an...Crypto-Jacking, Ransomware & Worming Malware's Frightening Future (Keynote an...
Crypto-Jacking, Ransomware & Worming Malware's Frightening Future (Keynote an...
 
Defend Your Company Against Ransomware
Defend Your Company Against RansomwareDefend Your Company Against Ransomware
Defend Your Company Against Ransomware
 
Get Smart about Ransomware: Protect Yourself and Organization
Get Smart about Ransomware: Protect Yourself and OrganizationGet Smart about Ransomware: Protect Yourself and Organization
Get Smart about Ransomware: Protect Yourself and Organization
 
Zero day exploit
Zero day exploitZero day exploit
Zero day exploit
 
WannaCry ransomware outbreak - what you need to know
WannaCry ransomware outbreak - what you need to knowWannaCry ransomware outbreak - what you need to know
WannaCry ransomware outbreak - what you need to know
 
Ransomware ly
Ransomware lyRansomware ly
Ransomware ly
 
Ransomware
RansomwareRansomware
Ransomware
 
What is wanna cry ransomware attack
What is wanna cry ransomware attackWhat is wanna cry ransomware attack
What is wanna cry ransomware attack
 
Case Study: Wannacry Ransomware attacks Telefónica
Case Study: Wannacry Ransomware attacks TelefónicaCase Study: Wannacry Ransomware attacks Telefónica
Case Study: Wannacry Ransomware attacks Telefónica
 
WannaCry: Autopsy of Ransomwar
WannaCry: Autopsy of RansomwarWannaCry: Autopsy of Ransomwar
WannaCry: Autopsy of Ransomwar
 
Ransomware hostage rescue manual
Ransomware hostage rescue manualRansomware hostage rescue manual
Ransomware hostage rescue manual
 
Ransomware: Wannacry
Ransomware: WannacryRansomware: Wannacry
Ransomware: Wannacry
 
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
 
Your Guide to tackle the Ransomware threat "WannaCry" | Sysfore
Your Guide to tackle the Ransomware threat "WannaCry" | SysforeYour Guide to tackle the Ransomware threat "WannaCry" | Sysfore
Your Guide to tackle the Ransomware threat "WannaCry" | Sysfore
 
Ransomware by lokesh
Ransomware by lokeshRansomware by lokesh
Ransomware by lokesh
 
Ransomware all locked up book
Ransomware all locked up bookRansomware all locked up book
Ransomware all locked up book
 
Ransomware - Rameez Shahzada
Ransomware - Rameez ShahzadaRansomware - Rameez Shahzada
Ransomware - Rameez Shahzada
 
Ransomware
RansomwareRansomware
Ransomware
 
Ransomware and email security ver - 1.3
Ransomware and email security   ver - 1.3Ransomware and email security   ver - 1.3
Ransomware and email security ver - 1.3
 

Recently uploaded

怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样
怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样
怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样
rtunex8r
 
快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样
快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样
快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样
3a0sd7z3
 
Bengaluru Dreamin' 24 - Personal Branding
Bengaluru Dreamin' 24 - Personal BrandingBengaluru Dreamin' 24 - Personal Branding
Bengaluru Dreamin' 24 - Personal Branding
Tarandeep Singh
 
办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理
办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理
办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理
uehowe
 
Ready to Unlock the Power of Blockchain!
Ready to Unlock the Power of Blockchain!Ready to Unlock the Power of Blockchain!
Ready to Unlock the Power of Blockchain!
Toptal Tech
 
Discover the benefits of outsourcing SEO to India
Discover the benefits of outsourcing SEO to IndiaDiscover the benefits of outsourcing SEO to India
Discover the benefits of outsourcing SEO to India
davidjhones387
 
办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理
办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理
办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理
uehowe
 
快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样
快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样
快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样
3a0sd7z3
 
成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理
成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理
成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理
ysasp1
 
一比一原版(USYD毕业证)悉尼大学毕业证如何办理
一比一原版(USYD毕业证)悉尼大学毕业证如何办理一比一原版(USYD毕业证)悉尼大学毕业证如何办理
一比一原版(USYD毕业证)悉尼大学毕业证如何办理
k4ncd0z
 
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
xjq03c34
 
HijackLoader Evolution: Interactive Process Hollowing
HijackLoader Evolution: Interactive Process HollowingHijackLoader Evolution: Interactive Process Hollowing
HijackLoader Evolution: Interactive Process Hollowing
Donato Onofri
 
Should Repositories Participate in the Fediverse?
Should Repositories Participate in the Fediverse?Should Repositories Participate in the Fediverse?
Should Repositories Participate in the Fediverse?
Paul Walk
 
manuaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaal
manuaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaalmanuaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaal
manuaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaal
wolfsoftcompanyco
 
留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理
留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理
留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理
uehowe
 
存档可查的(USC毕业证)南加利福尼亚大学毕业证成绩单制做办理
存档可查的(USC毕业证)南加利福尼亚大学毕业证成绩单制做办理存档可查的(USC毕业证)南加利福尼亚大学毕业证成绩单制做办理
存档可查的(USC毕业证)南加利福尼亚大学毕业证成绩单制做办理
fovkoyb
 

Recently uploaded (16)

怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样
怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样
怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样
 
快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样
快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样
快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样
 
Bengaluru Dreamin' 24 - Personal Branding
Bengaluru Dreamin' 24 - Personal BrandingBengaluru Dreamin' 24 - Personal Branding
Bengaluru Dreamin' 24 - Personal Branding
 
办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理
办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理
办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理
 
Ready to Unlock the Power of Blockchain!
Ready to Unlock the Power of Blockchain!Ready to Unlock the Power of Blockchain!
Ready to Unlock the Power of Blockchain!
 
Discover the benefits of outsourcing SEO to India
Discover the benefits of outsourcing SEO to IndiaDiscover the benefits of outsourcing SEO to India
Discover the benefits of outsourcing SEO to India
 
办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理
办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理
办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理
 
快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样
快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样
快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样
 
成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理
成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理
成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理
 
一比一原版(USYD毕业证)悉尼大学毕业证如何办理
一比一原版(USYD毕业证)悉尼大学毕业证如何办理一比一原版(USYD毕业证)悉尼大学毕业证如何办理
一比一原版(USYD毕业证)悉尼大学毕业证如何办理
 
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
 
HijackLoader Evolution: Interactive Process Hollowing
HijackLoader Evolution: Interactive Process HollowingHijackLoader Evolution: Interactive Process Hollowing
HijackLoader Evolution: Interactive Process Hollowing
 
Should Repositories Participate in the Fediverse?
Should Repositories Participate in the Fediverse?Should Repositories Participate in the Fediverse?
Should Repositories Participate in the Fediverse?
 
manuaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaal
manuaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaalmanuaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaal
manuaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaal
 
留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理
留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理
留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理
 
存档可查的(USC毕业证)南加利福尼亚大学毕业证成绩单制做办理
存档可查的(USC毕业证)南加利福尼亚大学毕业证成绩单制做办理存档可查的(USC毕业证)南加利福尼亚大学毕业证成绩单制做办理
存档可查的(USC毕业证)南加利福尼亚大学毕业证成绩单制做办理
 

Wannacry cyber attack.pptx

  • 1. WANNACRY / WANNACRYPT RANSOMWARE Prepared by: - Ayoub Rouzi - Abdelhakim Salama
  • 2. PLAN  Introduction  What happened ?  What is Wannacry / Wannacrypt ?  How many Infections ?  What happens to the victim?  How to protect yourself ?  Will Paying the Ransom Help Us?  Conclusion 2
  • 3. WHAT IS RANSOMWARE ?  “Ransomware is a malware that encrypts contents on infected systems and demands payment in bitcoins.” 3
  • 4. WHAT HAPPENED? several organizations were affected by a new Ransomware strain. The exploit ETERNALBLUE, was released in as part of a leak of NSA. May 12th 2017 April 15th 2017 March 14th 2017 Apparition of WanaCrypt0r 2.0 who is more dangerious May 22th 2017 A young white hat hacker stopped wannacry attack May 21th 2017 A "critical" patch had been issued by Microsoft 4
  • 5. HOW MANY INFECTIONS? Estimated > 200,000 victims 5
  • 8. HOW DO SYSTEMS GET INFECTED? • E-Mail. • Infected websites. • SMB (Server Message Block) : vulnerable systems exposed via port 445. 8
  • 9. WHAT HAPPENS TO THE VICTIM? • Files with specific extensions will be encrypted. • The victim will see a ransom message asking for approx. $300. 9
  • 10. WHAT HAPPENS TO THE VICTIM? • Once all the files are encrypted: • Open a backdoor 10
  • 11. WHAT HAPPENS TO THE VICTIM? Wannacry warns the user of the encryption of these files by modificating the desktop wallpaper: 11
  • 12. HOW TO PROTECT YOURSELF 12
  • 13. WILL PAYING THE RANSOM HELP US? • There is no public report from victims who paid the ransom. • About a hundred victims paid so far. 13
  • 14. WHAT’S THE UPDATES ? 14 • Windows, Linux, Mac • More victims • More data collection
  • 15. CONCLUSION • Availability Affected organizations will loose access to the files encrypted by the malware. Recovery is uncertain even after paying the ransom. • Confidentiality The malware does install a backdoor that could be used to leak data from affected machines, but the malware itself does not exfiltrate data • Integrity Aside from encrypting the data, the malware does not alter data. But the backdoor could be used by others to cause additional damage 15

Editor's Notes

  1. Several large organizations world wide are known to be affected. Estimated > 200,000 victims according to various anti virus vendors
  2. Several large organizations world wide are known to be affected. Estimated > 200,000 victims according to various anti virus vendors
  3. Several large organizations world wide are known to be affected.
  4. Some organizations suggest that the initial infection originated from e-mail attachments Affected organizations may have had
  5. Ransomware demands will increase to $600 after 3 days. After 7 days, the files may not longer be recoverable. The ransomware will also install a backdoor to access the system remotely via port 445 (Double Pulsar, also part of the NSA tool set).
  6. Wannacry uses the discrete anonymity network to communicate with its Command & Control server:
  7. Wannacry uses the discrete anonymity network to communicate with its Command & Control server:
  8. Deploy antivirus protection Block spam Perform regular backups of all critical information Don't open attachments in unsolicited e-mails Disable opened SMB port in Microsoft Office products.