Introduction What happened ? What is Wannacry / Wannacrypt ? How many Infections ? What happens to the victim? How to protect yourself ? Will Paying the Ransom Help Us? Conclusion

1. WANNACRY / WANNACRYPT
RANSOMWARE
Prepared by:
- Ayoub Rouzi
- Abdelhakim Salama

2. PLAN
 Introduction
 What happened ?
 What is Wannacry / Wannacrypt ?
 How many Infections ?
 What happens to the victim?
 How to protect yourself ?
 Will Paying the Ransom Help Us?
 Conclusion
2

3. WHAT IS RANSOMWARE ?
 “Ransomware is a malware that encrypts contents on infected systems and demands payment in bitcoins.”
3

4. WHAT HAPPENED?
several organizations were affected by a new Ransomware strain.
The exploit ETERNALBLUE, was released in as part of a leak of NSA.
May 12th 2017
April 15th 2017
March 14th 2017
Apparition of WanaCrypt0r 2.0 who is more dangerious May 22th 2017
A young white hat hacker stopped wannacry attackMay 21th 2017
A "critical" patch had been issued by Microsoft
4

5. HOW MANY INFECTIONS?
Estimated > 200,000 victims
5

6. HOW MANY INFECTIONS?
6

7. HOW MANY INFECTIONS?
7

8. HOW DO SYSTEMS GET INFECTED?
• E-Mail.
• Infected websites.
• SMB (Server Message Block) :
vulnerable systems exposed via port 445.
8

9. WHAT HAPPENS TO THE VICTIM?
• Files with specific extensions will be encrypted.
• The victim will see a ransom message asking for approx. $300.
9

10. WHAT HAPPENS TO THE VICTIM?
• Once all the files are encrypted:
• Open a backdoor
10

11. WHAT HAPPENS TO THE VICTIM?
Wannacry warns the user of the encryption of these files by modificating the desktop wallpaper:
11

12. HOW TO PROTECT YOURSELF
12

13. WILL PAYING THE RANSOM HELP US?
• There is no public report from victims who paid the ransom.
• About a hundred victims paid so far.
13

14. WHAT’S THE UPDATES ?
14
• Windows, Linux, Mac
• More victims
• More data collection

15. CONCLUSION
15