[Sean]: What steps have you taken to find out about this?
[Mike]: I, I ran it. On my machine.
Actually that's not quite true.
I ran it on a virtual machine.
So I installed a virtual XP machine, unpatched, from this current patch
it wasn't connected to the internet, I downloaded
the WannaCry.exe
and ran it
and my files are encrypted
and it popped up the warning message.
[Sean]: This isn't something the peeps should try at home right?
[Mike]: No I, I would advise against it right.
So there isn't anything inherently scary about the software
in the sense that if it's not connected to the net, it won't propagate.
And if you don't have anything valuable on your machine
you aren't gonna lose any files.
But on the other hand,
I'm not running it here
on the university network
because I don't want to be the first person to introduce it to Nottingham (laughs)
So, you know, just on the off chance, right?
Let's not, let's not open that door.
So where do we start on this mess?
(laughs)
[Sean]: What, what is it?
Okay first of all, what's it called?
[Mike]: So I called it WannaDecryptor
or Wanna Cryptor
[Sean]: So WannaCry WannaCryptor...?
[Mike]: WannaCry WannaCryptor WannaDecryptor WannaDecryptor Two
As far as I can tell, the source code has Wanna Decryptor in it
A lot of people shortened this to WannaCry
And there's a sort of WNCRY extension that it uses for its encrypted files...
which are, which kinda spell WannaCry so yeah okay
I'm calling it WannaCryptor
but I may not mention it by name again
cause we all know what we're talking about.
It's ransomware right?
So ransomware is any trojan or worm or virus
that, in essence, encrypts your files and then try to charge you money to reverse that process.
Without giving it too much credit, for obvious reasons,
it's a fairly smart way of performing crime.
because, if an antivirus is not immediately on the ball,
then, the damage is already done.
And a lot of the time, you won't get the key back unless you pay.
And so you have to then either restore from backup,
which a lot of people don't have,
and... or you have to accept that your files are gone
or you have to pay.
And so, it's no surprise that the biggest stuff in the news recently
in terms of attacks
have been ransomware,
because of the immediate impact it has on standard users.
There are lots and lots of other kinds of malwares
you know: banking fraud malware and key loggers and things
and, bot net code, which is also a really big problem
but perhaps it sees less news
because it doesn't attack the NHS.
For those of you that don't live in England [UK really]
you might, you know, not know a huge amount about the NHS.
The National Health Services is our taxpayer funded health service
right so we pay taxes, then those taxes contributed to health services
and we all get healthcare.
Perhaps we all need to calm the rhetoric down slightly
you know, the NHS itself is not under attack,
the nice thing for the media is if
is if you can have your headline say
"Attack on health service"
then you're gonna get a lot of hits.
So that's the first thing thats happened.
In fact, actually only a small subset of healthcare machines have been taken down by this ransomware,
and a lot of it has been precautionary.
So bring down the server, just on the off chance [the ransomware] gets it,
until we can be sure, that nothing the same network has the trojan or the worm on it.
So yeah, it's a big deal.
And it's infected a lot of machines.
But there are a lot of big ransomware out there, right?
like Cryptowall had made millions of dollars for its developers, for example
so, this isn't the only one, it's not the first, and regrettably, probably won't be the last.
Let's talk a bit about what happened, alright?
So on Friday,
various machines started being infected by this.
Now, the exact nature of the initial infection, I don't think is known right now
It might be by the time this video goes out, right, so
maybe I'll be out of date already, but
probably, emails, right?
Which makes it essentially a trojan.
Because an email goes out with a spear phising attack, or a phishing attack
that sort of says "You should click this" for whatever reasons
and tricks a user into doing it.
Now you don't have to trick many users to get returns on your investment, in some sense,
because once it got infected, that's a lot of money.
This um, trojan, or this worm is a little bit unusual, in that it actually carries a self-replicating payload.
Most ransomware doesn't do this.
Most ransomware, the idea is to email as many people as possible,
some of them, some small subset of them will be tricked into clicking it,
they will be the ones you hope will pay the ransom.
That's the logic of it.
This one, uses an exploit that was first found by the NSA, an exploit of Windows.
So this vulnerability has existed in Windows for quite a while,
it existed in Windows XP, that was around in 2001 and so on.
And it seems to have disappeared sometime around Windows 10, so it was patched in March,
So, we don't know if...
I think the vulnerability doesn't exist in Windows 10.
[Sean]: So it's patched in March in Windows 7?
[Mike]: Yes. So for any operating system that Microsoft is currently rolling out patches for
which is to say Windows 7, I don't think Windows Vista anymore.
There are plenty of copies of Windows rightly or wrongly that still have this vulnerability.
Now this is a vulnerability in the SMB protocol
which is mainly used for filesharing across networks.
Very common, because you imagine large organisations like to share files
from a central server to all their smaller machines
rather than having everyone store all the files all the time.
So, what happens when this worm lands?
So this worm would start, with an email probably,
or someone would deliver it by a USB, that seems less likely,
but, probably an email.
You only need one person on a network to click on it,
and they get the ransomware, and then it starts to sniff out on port 445, for other unpatched installations.
So this is a directed exploit, which would be able to run this same code, on the targeted machines,
and then they spread and so on.
And that's why it spread so quickly
This vulnerability, which was discovered by the NSA, quite a while ago.
5 or 6 years ago, we think. We don't know exactly because they don't tell us.
And rather to tell Microsoft about this exploit, they decided to sit on it,
with the idea, uh, with the idea that they can then use it in their own exploits.
So their exploit kit became EternalBlue.
That's the codename for this particular exploit.
In some sense, no more was heard about it, right?
For a while.
It probably got used,
by government agencies to perform their counter terrorism tasks and so on,
until they were themselves, hacked, by another group,
called the Shadow Brokers
who decided to try and sell some of these tools, and then just released it on the Internet.
So Microsoft patched this vulnerability in March,
and then in April, the Shadow Brokers released EternalBlue, the code of it, onto the net.
It's only a matter of time before someone put this onto a self-replicating piece of ransomware.
Because the quicker you do it, the more people who are still unpatched that you get and then damage ensues.
The key difference, really, with this, from this ransomware, to the previous ransomware we've seen
is the fact that it can self-propagate right?
Sometimes these things get built into, uh, self-replicating programs
but, in this one, um, this EternalBlue exploit, essentially means that your machine, if it's not patched,
you don't have to click yes, alright?
Another machine will upload the payload to it, and it will run it, no questions asked.
And it might, if you're running a server, which has shadow volume copies and things, and backups and restores
it might ask you for a yes-or-no response later in the process
but, a bit late, you know, after a lot of things have already been encrypted.
So, most trojans, if you're very very vigilant about running email attachments, you'll never get them
because you'd just see "Oh it's a trojan" or "I don't wanna go to that website, it looks malicious"
And so you don't get them even if you don't have an antivirus.
But if you haven't got this update, you can still get [the ransomware], despite the fact that you haven't done anything.
Apart for perhaps being a bit lazy about your updates...
Some time over the weekend, obviously lots of researchers are looking into this,
not... um so I was looking into it and running it purely for interest, right, so I don't, um
I'm not writing any tools to get rid of it or anything clever.
But there are a lot of researchers, and what they'll do is
they will run this in a virtual machine or a special sort of sandbox where it is isolated, find out what it does,
and try and work out how they can stop it,
try and work out how they can take the role of the command and control server, for example,
and tell it just to stop, or something like this.
Now, a researcher, MalwareTech,
whose blog is really interesting and we'll link to it in the bottom,
they basically stumbled upon a killswitch for this
because they were looking at what it did
and it polled this, it checked for the existence of this unregistered internet address.
So it basically says, it did a DNS lookup and says "Who is this? Who has got this internet address?" and no one had it.
So their first response was "So if we registered that internet address,
we'd then get communications from all the installations of this,
and we could sort of track how many people have got this.
It's interesting from a researcher's point of view, we can see how it's spread."
But in fact, what actually happened within the code was
if this web address existed, [the ransomware] just stops running.
The hypothesis is that
it's doing a kind of Volkswagen emissions situation,
where it realises it's running in some kind of lab environment and shuts down.
But, basically, as soon as they registered this web address,
all future installations of WannaCryptor, WannaDecryptor
shut down immediately upon starting up.
Which obviously was quite a good news.
So inadvertently they saved a lot of people
a lot of time and effort, and maybe money.
[Sean]: That isn't the end of this story, presumably...
people have seen that that... [Mike]: Yeah...
So there have been multiple versions of this with tweaked settings
where they ba... probably remov...
I think they've essentially tried to hex edit out the killswitch, and run it again.
And yes, that's not unexpected, MalwareTech said this was gonna come,
it's very uh... it's to be expected, because
the code is not difficult to change to avoid the whole killswitch right?
Obviously their attempt at circumventing some of these researchers' abilities has failed
and it has inadvertently reduced the impact of the virus, or the worm.
So, they'll just release it again.
And they'll send out another huge bunch of emails.
Now hopefully people are now aware that this exists and people are aggressively updating their systems,
and it will have its impact.
But some people are bound to get it again, I think China is being hit pretty hard today
it's going through China at the moment.
So it tends to hit networks and spread about,
until people realise what's going on and put a stop to it.
Not everyone's got this, alright? I haven't got it.
You haven't got it, no one in [University of] Nottingham, as far as we know, have got it.
And that's because these SMB ports are blocked internally by our firewall.
As they're coming in, they're blocked.
So, you... an infected NHS machine
can't target a University of Nottingham computer,
because the ports are blocked.
Many of the networks that have been compromised
are networks where a machine inside the network has been compromised
and it's spread around the internals of the network.
And the majority of ransomware is a trojan
in the sense that it masquerades as something else,
and appears on your computer usually through an email attachment.
This one is both a trojan in that sense because that's probably what happened here,
but it's also a worm, in the sense that it can propagate itself out using that exploit.
So this EternalBlue exploit,
already exists, and was known by the NSA for some time,
it's already been patched, but a lot of people aren't,
installing updates as vigorously as they should be,
and also, Microsoft aren't routinely putting out updates for Windows XP
so, anyone running Windows XP and/or now also Windows Vista and so on
won't have that update
because that's not what happens.
Now in an unusual move, Microsoft has pushed an update for Windows XP
because of the severity of this.
But that's unusual.
If you're running XP, the first thing you should do is turn off your machine
because you've got no business running XP.
But, you aren't gonna get many updates
because that's not what Microsoft are doing.
[Sean]: This is like a car that nobody makes parts for anymore...
[Mike]: It's exactly like that.
In fact, a good analogy I think is...
So people have been blaming Microsoft for this,
there's a lot of blame to go around,
Microsoft shares some of the blame,
but, in some ways, what's happening is we're all driving around in 1940s Fords,
and then when we have an accident we're complaining that the airbag didn't go off
well, there isn't an airbag IN those 1940s Fords, that's why, right?
So unless you take it to the garage and have one installed, you know?
It's that kind of principle, so.
Yes, Microsoft wrote an operating system with a bug in, right?
All operating systems have bugs in, all softwares have bugs in.
They patched it quickly,
they found it, they patched it in March, it's not
in Windows 10 anyway,
and they've aggressively put out patches for legacy operating systems to try and combat it.
So they've at least taken all the steps they can,
to solve this.
The problem is that,
big organisations like the NHS,
have legacy softwares, let's say like drivers for scanners,
and you know, MRI machines and so on,
that maybe they bought 10, 20 years ago,
that are still running XP because the software isn't compatible with the modern versions of Windows.
That's a whole political issue that I don't, you know, that I don't have all the answers for.
So the CIA leaks, a few months ago,
showed that the CIA also has, this sort of, shall we say
a back catalogue of exploits that they keep a hold of.
So the NSA and the CIA will disclose some problems they find,
but if they find a bug,
a normal security researcher will privately disclose it to the company
for them to release a patch,
and then will publicise it later.
Partly for the media purposes, and partly because then it encourages people to install the update.
The NSA and other government agencies don't operate this policy all the time,
because they view some of these exploits as useful for combating terrorism and other criminal activities.
Now that may or may not be the case.
But what's happening in this case,
is, they've allowed themselves to be hacked,
by another group,
who has had no ethical concerns in just releasing all of it.
So, this actually goes back to our end-to-end encryption talk,
because what I said about introducing a backdoor,
is introducing a very big point of failure,
well that's exactly what happened here, alright?
The NSA didn't tell anyone about this because they felt they could privately use it for the good of their country,
and that may have been the case.
But it's not the case anymore, because someone hacked them and released it.
So that's a huge problem when that sort of thing happens.
So, there're already people, I mean Microsoft themselves in their blog,
have mentioned this already,
And Ross Anderson mentioned it in his blog,
and we'll link both of those in the bottom,
that,
you know, you can't, they can't wipe their hands of this entirely
they can, you know, they can say "Well we're doing this to counter terrorism."
but in some ways, this is also their fault, because it was their exploit being used.
The headline today all said it's a wakeup call.
Really, people like Ross Anderson and other security experts have been saying this for years.
This isn't the first time we've noticed that old machines are vulnerable to attacks.
So yeah, maybe it's a wakeup call, but people need to be aggressively installing the latest operating systems
and updating.
As far as I know, you can't turn off updates on Windows 10.
And, that strikes me as quite a good idea,
because people WILL turn them off.
"Ah I don't want it to update right now, I'll turn it off and I'll resume it later."
And that's when they get hit by a piece of ransomware.
So in the future,
the robot chauffeur which will actually drive you to work while you're sitting there, hacking some code.
And so, you've then got the technical problems and the business problems of how do you produce software upgrades...