Ransomware may be mostly thought of as a (sometimes costly) nuisance, but when it hinders the ability of doctors and nurses to help people with an emergency medical problems, that qualifies as armed robbery.
Photo: Getty
On Friday, a quickly spreading, nasty piece of malware crossed mountains and oceans to infect more than 70,000 machines around the world in its first few hours. Among those infected were more than a dozen hospitals in England, a telecom in Spain, FedEx‘s offices in the United Kingdom, and apparently, the Russian Interior Ministry. Within half a day, there were instances detected on six continents.
[referenced url=”https://gizmodo.com.au/2017/05/theres-a-massive-ransomware-attack-spreading-globally-right-now/” thumb=”https://i.kinja-img.com/gawker-media/image/upload/t_ku-large/u5ecpcfiltnjxnfa0k7g.jpg” title=”There’s A Massive Ransomware Attack Spreading Globally Right Now” excerpt=”A ransomware attack is quickly spreading across the globe rendering vital systems inaccessible.”]
What’s sad is that this was all largely preventable, had more Windows users simply installed the security patch Microsoft released for it two months ago. (Unless you’re one of the 8.45 per cent of users still running Windows XP, which hasn’t been supported for three years.)
Here’s what happened: Unknown attackers deployed a virus targeting Microsoft servers running the file sharing protocol Server Message Block (SMB). Only servers that weren’t updated after March 14 with the MS17-010 patch were affected; this patch resolved an exploit known as ExternalBlue, once a closely guarded secret of the National Security Agent, which was leaked last month by ShadowBrokers, a hacker group that first revealed itself last winter.
The ransomware, aptly named WannaCry, did not spread because of people clicking on bad links. The only way to prevent this attack was to have already installed the update.
Through the ExternalBlue exploit, the malware installed an NSA backdoor payload called DoublePulsar, and through it went WannaCry, spreading rapidly and automatically to other computers on the same network — potentially hundreds at a time.
Unfortunately, it looks like attacks might make some serious bread for their efforts. Researchers combing through samples of the ransomware have already discovered several bitcoin wallets in which thousands of dollars have been deposited. It’s fine to say we shouldn’t negotiate with hackers demanding ransom — though the people who say that almost always do — but when the target is an emergency room, and lives are at stake, there’s really no choice.
[referenced url=”https://gizmodo.com.au/2017/05/hospitals-across-england-infected-with-ransomware-leaving-patients-without-care/” thumb=”https://i.kinja-img.com/gawker-media/image/upload/t_original/wolmsyxfauytvjkybjyr.jpg” title=”Hospitals Across England Infected With Ransomware, Leaving Patients Without Care” excerpt=”England’s healthcare system fell victim to a massive cyberattack on Friday afternoon, forcing several hospitals to divert emergency patients to other facilities. Ransomware appears to be the cause.”]
If you think you might be vulnerable to WannaCry, or you don’t remember installing any updates over the past month, your first step is to address that issue immediately. As Sean Dillon, the RiskSense security analyst who reverse engineered DoublePulsar, told ThreatPost: “This is the most critical Windows patch since [Conficker],” which is one the largest similar infections to date.
Despite having been patch nearly a decade ago, the Conficker worm is still in circulation. “I find it everywhere,” says Dillon, adding that WannaCry, too, “is going to be on networks for years.”
The importance of downloading and installing security updates (as opposed to just clicking “remind me tomorrow” for several weeks in a row) cannot be overstated. Just ask the patients of the 16 hospitals in England whose delay in care could have been easily avoided.
Still not patched? I guess you #WannaCry 😉#Patch #MS17-010 #Windows
— Hardik Mehta (@hardw00t) May 12, 2017