WannaCry ransomware outbreak - what you need to know
•Download as PPTX, PDF•
3 likes•1,633 views
The WannaCry ransomware outbreak shook the world when it occured in May 2017. This slidedeck looks at the attack, how it was carried out, and its success rate. It also attempts to figure out who was likely to have been behind this devastating cyber attack. For more information on this outbreak, take a look at these additional resources: What you need to know about the WannaCry Ransomware: https://www.symantec.com/connect/blogs/wannacry-3 WannaCry: Ransomware attacks show strong links to Lazarus group: https://www.symantec.com/connect/blogs/wannacry-ransomware-attacks-show-strong-links-lazarus-group Can files locked by WannaCry be decrypted: A technical analysis: https://medium.com/threat-intel/wannacry-ransomware-decryption-821c7e3f0a2b
Recommended
More Related Content
What's hot
What's hot (20)
Similar to WannaCry ransomware outbreak - what you need to know
Similar to WannaCry ransomware outbreak - what you need to know (20)
More from Symantec Security Response
More from Symantec Security Response (9)
Recently uploaded
Recently uploaded (20)
WannaCry ransomware outbreak - what you need to know
- 1. 1Copyright © 2017 Symantec Corporation WannaCry: The computer worm that disrupted the world
- 2. 2Copyright © 2017 Symantec Corporation August 11, 2003 Blaster 16 million
- 3. 3Copyright © 2017 Symantec Corporation Conficker 15 million November 21, 2008
- 4. 4Copyright © 2017 Symantec Corporation WannaCry 300,000 May 12, 2017
- 5. 5Copyright © 2017 Symantec Corporation
- 6. 6Copyright © 2017 Symantec Corporation JANUARY 16 US-CERT issues advisory on new SMB vulnerability. FEBRUARY 10 First infection of WannaCry in the wild. Tools associated with Lazarus group found on infected computers. MARCH 14 Microsoft releases patch for CVE- 2017-0144. MAY 10 CVE-2017-0144 exploit is added to Exploit.DB. APRIL 14 Shadow Brokers releases EternalBlue exploit code. MAY 12 New wave of WannaCry attacks begin. This campaign uses EternalBlue exploit to spread. MAY 13 A new version of WannaCry surfaces. MARCH 27 Second wave of attacks. Backdoors used in campaign share code and infrastructure with Lazarus tools. MAY 17 Notice displayed on infected computers claiming files will be decrypted if ransom is paid. APRIL 24 Symantec releases IPS sig to block exploit attempts. MAY 12 Microsoft releases CVE-2017-0144 patch for Windows XP. MAY 12 Kill switch domain #1 is sinkholed. MAY 14 Kill switch domain #2 is sinkholed. MAY 12 Symantec observes increased attempts to exploit CVE- 2017-0144. MAYJAN FEB MAR APR WannaCry Ransomware Timeline 2017 A timeline of key events in the WannaCry ransomware attacks
- 7. 7Copyright © 2017 Symantec Corporation
- 8. 8Copyright © 2017 Symantec Corporation WannaCry Distribution Initial surge after WannaCry is released into wild. Drops over the weekend but resurgence when people return to work. 0 20,000 40,000 60,000 80,000 100,000 120,000
- 9. 9Copyright © 2017 Symantec Corporation WannaCry - Distribution
- 10. 10Copyright © 2017 Symantec Corporation Wannacry Spreading Spreads via MS17-010 (EternalBlue) *No Email vector* Enumerates All Network Adapters1 Generates list of all IP addresses within subnet • IP address + subnet mask • 192.168.0.1 + 255.255.255.0 => 192.168.0.1 – 192.168.0.255 • 192.168.0.1 + 255.255.0.0 => 192.168.0.1 – 192.168.255.255 2 Generates random IP addresses • Uses CryptGenRandom() so truly pseudorandom • Generates up to 128 • If one has port 445 open, then generates IPs a.b.c.1 – a.b.c.d.255 3
- 11. 11Copyright © 2017 Symantec Corporation WannaCry – MS17-010 Exploit SRV.SYS / SRVNET.SYS 10010011 10001101 00101010 10101010 10101010 10101010 10101000 11101010 00100111 01011011 01010111 10101011 01000111 00001010 10100101 01010101 01010101 01010101 01010101 00010101 10010011 10001101 00101010 10101010 10101010 10101010 10101000 11101010 00100111 01011011 01010111 10101011 01000111 00001010 10100101 01010101 01010101 01010101 01010101 00010101 10010011 10001101 00101010 10101010 10101010 10101010 10101000 11101010 00100111 01011011 01010111 10101011 01000111 00001010 10100101 01010101 01010101 01010101 01010101 00010101 10010011 10001101 00101010 10101010 10101010 10101010 10101000 11101010 00100111 01011011 01010111 10101011 01000111 00001010 10100101 01010101 01010101 01010101 01010101 00010101 10010011 10001101 00101010 10101010 10101010 10101010 10101000 11101010 00100111 01011011 01010111 10101011 01000111 00001010 10100101 01010101 01010101 01010101 01010101 00010101 negotiate_proto_request session_setup_andx_request tree_connect_andx_request peeknamedpipe_request SMB1
- 12. 12Copyright © 2017 Symantec Corporation Resource WannaCry - Install PlayGame() W/101 .DLL Execute Resource R mssecsvc.exe C:Windowsmssecsvc.exe
- 13. 13Copyright © 2017 Symantec Corporation Wannacry Install R resource copied to • C:WINDOWStasksche.exe • C:WINDOWSqeriuwjhrf tasksche.exe • C:Intel[random]tasksche.exe • %PROGRAMDATA%[Random Characters][3 digit number]tasksche.exe 1 Creates mutexes • GlobalMsWinZonesCacheCounterMutexA0 • GlobalWINDOWS_TASKOSHT_MUTEX0 • GlobalWINDOWS_TASKCST_MUTEX 2 Creates registry keys • HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunMicrosoft Update Task Scheduler • HKEY_LOCAL_MACHINESOFTWAREWannaCryptorwd • HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun[random] • HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices[random] 3
- 14. 14Copyright © 2017 Symantec Corporation PASSWORD PROTECTED XIA.ZIP WannaCry - Install Resource R mssecsvc.ex e Resource PlayGame() W/101 .DLL Wncry@2ol7
- 15. 15Copyright © 2017 Symantec Corporation WannaCry – Install (XIA) o msg - folder containing ransomware messages in 28 different languages o Data - folder containing Tor installation originating from s.wnry o c.wnry - configuration file with Tor domains o b.wnry - Background image of ransom note o r.wnry - @Please_Read_Me@.txt notes o t.wnry - encryption routine (DLL) o u.wnry - @WanaDecryptor@.exe executable that displays payment UI o taskse.exe - starts @WanaDecryptor@.exe o taskdl.exe - deletes temporary files created during encryption process o Kills mysqld.exe, sqlwriter.exe, sqlserver.exe, MSExchange*, Microsoft.Exchange.* o Deletes volume shadow files
- 16. 16Copyright © 2017 Symantec Corporation WannaCry – Encryption Begins encrypting files if they match a large list of extensions o Includes removable drives o Includes shared folders/drives o Includes files in the cloud with local folder integration Uses AES-128 and RSA-2048, highly secure encryption implementation
- 17. 17Copyright © 2017 Symantec Corporation AES-128 AES-128 AES-128 RSA-2048 Public Key Private KeyRSA-2048 WannaCry - Encryption
- 18. 18Copyright © 2017 Symantec Corporation WannaCry - Decryption AES-128 AES-128 AES-128 RSA-2048 Public Key Private KeyRSA-2048 gx7ekbenv2riucmf.onion 57g7spgrzlojinas.onion xxlvbrloxvriy2c5.onion 76jdd2i r2embyv47.onion cwwnhwhlz52maqm7.onion
- 19. 19Copyright © 2017 Symantec Corporation WannaCry - Weaknesses AES-128 AES-128 AES-128 RSA-2048 Public Key Private KeyRSA-2048 RSA-2048
- 20. 20Copyright © 2017 Symantec Corporation WannaCry - Weaknesses o Removable drives o Desktop o My Documents
- 21. 21Copyright © 2017 Symantec Corporation WannaCry Killswitch • Explicit proxy users should create DNS entry for killswitch domain • Set up webserver to respond • Best practice for all is to create internal sinkhole to prevent future exposure CREATING AN INTERNAL SINKHOLE TIP o Attempts to reach an unregistered site and if it succeeds, exits o Likely used to evade sandboxing o Researchers sinkholed domain, preventing further infections o Multiple hex edited samples with different killswitch domains
- 22. 22Copyright © 2017 Symantec Corporation WannaCry Payment o Calls “@WanaDecryptor@.exe fi” to contact Tor servers for unique Bitcoin address o Fails because exe is not yet created o Bug is fixed 13 hours after original release but fix is too late
- 23. 23Copyright © 2017 Symantec Corporation WannaCry - Payment o Without unique Bitcoin address defaults to 3 hardcoded values o 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw o 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn o 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 o Demands $300, doubles after 3 days o After 7 days claims files will be lost o Files are not deleted or modified after 7 days o Have made approximately $135,000
- 24. 24Copyright © 2017 Symantec CorporationCopyright © 2015 Symantec Corporation 24
- 25. 25Copyright © 2017 Symantec Corporation WannaCry - Attribution o Two weak links o Code similarity in code that historically has only been seen in Lazarus tools o Lazarus tools have been found on machines just prior to WannaCry o Lazarus was responsible for: o Sony wiping attacks o South Korean wiping attacks o Bangladesh bank heist ($81m was stolen) o Polish bank attacks o US government has claimed North Korea responsible for Sony attacks o South Korea government has claimed North Korea responsible for South Korean wiping attacks o Even if this can be attributed to Lazarus, that does not mean it is a state operation
- 26. 26Copyright © 2017 Symantec Corporation o Evidence points to Lazarus, the group responsible for: o Sony wiping attacks o South Korean wiping attacks o Bangladesh $81m bank heist o Polish banking attacks o Links include o Known Lazarus tools observed installing earlier WannaCry versions o Shared infrastructure o Code similarity between WannaCry and Lazarus tools WannaCry Attribution
- 27. 27Copyright © 2017 Symantec Corporation Links Lazarus tools WannaCry Network Infrastructure (Hard) • Destover: 87.101.243.252 • Cruprox: 196.45.177.52 • Trojan.Bravonc: 87.101.243.252 • Trojan.Branvonc installs WannaCry • Lazarus dropper connects to 184.74.243.67 and 196.45.177.52 • Trojan.Alphanc connects to 184.74.243.67 Infiltration (Hard) • Backdoor.Duuzer • W32.Brambul • Trojan.Alphanc (Duuzer evolved) was seen installing WannaCry 1.0 • Trojan.Bravonc was also seen installing WannaCry 1.0 • W32.Brambul and shared network infrastructure as above Shared code (Medium to Weak => Hard) • Contopee 'FakeSSL’ • Duuzer network code • Duuzer strings • Brambul • Obfuscated code • WannaCry 'FakeSSL’ • Trojan.Alphanc network code • Trojan.Alphanc strings • Bravonc (evolved Brambul) • Obfuscated code Tool co-occurence (Medium to Weak) • Volgmer, Brambul • Volgmer and Brambul both found in a WannaCry victim on the same machine • Alphanc (Duuzer evolved) present on multiple machines with WannaCry Techniques (Weak) • Joanap use of hardcoded credentials to spread over SMB • Trojan.Bravonc use of hard coded credentials to spread over SMB WannaCry Attribution
- 28. 28Copyright © 2017 Symantec Corporation WannaCry - Mitigations o Allow killswitch domain or setup DNS and webserver sinkhole o Create mutexes, registry entries, and ACL’d files o Patch o Security products - Validate against MS17-010 o Network segmentation o Disable SMBv1 o Block 445 at perimeter (internally if possible as well)
- 29. 29Copyright © 2017 Symantec Corporation WannaCry – Lessons Learned o We are still bad at patching o OEM equipment o Legal/certification reasons o Rogue devices o We are still bad at performing backups o Prepare for when the restoration server and dependencies are down o There is no such thing as your perimeter o Blocking port 445 at your firewall is not the same as at your perimeter o Cloud applications are not in the cloud, but inside your perimeter o Security policies and procedures and continuity planning works
- 30. 30Copyright © 2017 Symantec Corporation 30Copyright © 2017 Symantec Corporation Thank You. @threatintel https://www.symantec.com/connect/symantec-blogs/sr Medium.com/threatintel
Editor's Notes
- Before we talk about WannaCry, let’s talk a little about context: In August 2003, the Blaster worm infected 16 million machines in 24 hours
- In 2008, the infamous Conficker worm infected 15 million in a day
- And then WannaCry infected around 300,000, which is tiny number in relative terms. So, why did it make such a splash?
- Because of this. This is what you would see when you started your computer if it was infected with WannaCry. Quantity or prevalence isn’t as important as impact: WannaCry would trash your machine whereas Conficker and Blaster both did nothing.
- WannaCry affected huge companies like FedEx, the National Health Service in the UK, and the train system in Germany, among many others.
- Chart shows attempts to exploit the MS17-010 vulnerability that was used to spread WannaCry
- Countries with good internet access that were using unpatched machines were most heavily affected by WannaCry
- Left is the infected machine Right is the victim SRV.SYS/SRVNET.SYS is the SMB service on the victim machine The vulnerability is actually a straightforward buffer overflow, the buffer is too small, and the exploit code overflows it and gains control The exploit portion is what is known as EternalBlue from the ShadowBrokers dump It sets up just a small piece of code that then opens a listening backdoor channel within the SMB process This just listens and accepts any file, and then will load and execute that file. This backdoor is called DoublePulsar by ShadowBrokers Note that the exploit is delivered via SMB1, but the backdoor channel happens over SMB2. So, there was some confusion if the exploit happened via SMB1 or SMB2, but it is both. However, if you block one, you prevent the thing from working. So, many organizations disable SMB1 because, even if you use SMB in your environment, it is highly unlikely you are using SMB1 and can safely block it.
- The file that is transferred over is a DLL It has a single function in it, PlayGame, which basically extracts an embedded file inside called W/101 and saves and executes it as mssecsvc.exe Inside that file is another embedded file in a resource called R
- Now the R resource is also extracted and, within the R resource, like Russian dolls, is a password-protected ZIP file. That password-protected ZIP file is extracted to the drive with the password Wncry@2ol7 Note that this is not the password to decrypt your files, as some people mistakenly thought. This is the password that is used internally by the threat to decrypt the password-protected ZIP it carries inside of itself
- Listed above are the files contained inside the ZIP Files that are inside the ZIP: Also kill certain processes that often have files in use that can disrupt WannaCry’s encryption process Deletes volume shadow files. This is typical of ransomware because Windows by default keeps shadow (or backup) copies of your files and, if the ransomware doesn’t do this, you can actually easily restore your files. Languages are: Bulgarian, Chinese (Simplified & Traditional), Croatian, Czech, Danish, Dutch, English, Filipino, Finnish, French, German, Greek, Indonesian, Italian, Japanese, Korean, Latvian, Norwegian, Polish, Portuguese, Romanian, Russian, Slovak, Spanish, Swedish, Turkish, and Vietnamese
- WannaCry generates a unique encryption key for each file It uses that to encrypt the files using AES-128 Then, it encrypts all of those keys together using RSA-2048 The attacker has generated a public and private key pair. Now, people who aren’t familiar with PKI sometimes get scared when they start hearing public and private keys, but just a simple explanation to remember is the public key can encrypt and the private key can decrypt. The public key can only be used for encryption and you need the private key if you want to decrypt. So, the final key on your machine is then encrypted by the attacker’s public key So now all your files are encrypted
- So, how does decryption work? The single small master key blob of data on your machine is sent to the attacker and the attacker uses their private key to decrypt it and send you back your key. This happens over Tor via a bunch of domains. Once you have your decrypted key, you can decrypt all the individual keys and those keys then can decrypt each of your files
- Are there any weaknesses? Well, unfortunately, the math here is secure. The attackers behind WannaCry are using Windows-supplied Crypto APIs rather than rolling their own crypto schemes. However, there are some potential weaknesses. The first is that, often, when keys are generated, a copy of them is made in memory to do your work. And sometimes those copies in memory don’t get wiped properly. So, if you can recover such a copy, you can use it to then decrypt your files. In the case of WannaCry, we see this happen on XP, but unfortunately it doesn’t infect XP via SMB, so this is useless for the vast majority of those affected. In a lab setting, it seems sometimes you may also see this in Win7 and 2008, but we have been unable to reproduce this at all in any real world environment. In the real world, these memory buffers get overwritten, so it isn’t possible. You may have seen a tool that tries to do this. You have nothing to lose if you want to try it, but it is unlikely to work.
- However, WannaCry did do something weird when encrypting files For removable drives, desktop, and My Documents, WannaCry would encrypt in place But for all other areas on the drive, it would first copy over the file, encrypt it, and then delete the original. As many of you probably know, when you delete a file it can often remain behind in slack space. The entry that the file exists is removed, but the actual file data remains on disk. So, using any well known undelete disk recovery tool, you can recover many of these files.
- A security researcher found a killswitch for WannaCry relatively early in its campaign. If the researcher had not found this killswitch, WannaCry would have caused a lot more trouble than it did.
- In the original version (which was the one that infected the majority of machines), WannaCry calls a dropped executable to generate the unique bitcoin addresses, but that dropped executable hasn’t been created yet, so it doesn’t work. 13 hours later, you can see the attacker moves the creation of the dropped executable before the code to call it, fixing his bug. However, this fix was too late in most cases.
- Interestingly at the deadline the attackers sent out a last plea for payment
- Backups – the problem is even those who believe they have a good restoration plan in place often aren’t prepared for a situation like WannaCry. Make sure your restoration plans work in adverse situations. Perimeter – In the real world, it is rare that your firewall is your perimeter, whether it is laptops coming in and out, vendor networks connected to yours, or things like cloud services. The perimeter today is an ambiguous thing, so don’t just think because something is blocked on your firewall you are safe. Cloud – services like Dropbox have local file integration, so, even though your data is in cloud, you have a file on your local machine that looks local and data in there will get encrypted This means your files on the cloud also get encrypted Finally, security policies, procedures and continuity planning works. For those orgnizations that got hit but had good processes in place, we saw them recover quickly and easily.