The Anti-virus Times

Tuesday, May 30, 2017

Recall, if you will, that WannaCry relies on the use of tools and exploits that were made publicly available by The Shadow Brokers who stole them from Equation Group which is suspected of having ties to the US National Security Agency.

The WannaCry “epidemic” (yes, in quotation marks) looks rather strange:

1. Unlike ordinary encryption ransomware programs, which spread with spam mailings and whose impact is proportional to the quantity of unsolicited mailings involved, WannaCry gets into machines a different way. In contrast to other programs, WannaCry resembles a pyramid scheme: every newly infected machine attempts to infect other hosts on both the local network and the Internet. It very much resembles the outbreaks that occurred in the early 2000s. But the outcome! Melissa infected 20% of computers worldwide. I Love You! compromised millions of PCs in just hours. Perhaps, the Internet has become a more secure place since then?

   Over 18% of PCs run pirated versions of Windows, while 23% of machines have Windows Update disabled.

   But what about WannaCry? According to various estimates 200,000 to 400,000 computers have been infected.

   According to MalwareHunter, on May 19 XData infected four times as many machines in the Ukraine as the notorious WannaCry did in an entire week.

   http://www.securitylab.ru/news/486205.php

   Have you read about XData (a.k.a. Trojan.Encoder.11526 under the Dr.Web classification system) in the media? It’s an odd case.

2. The attack affected almost exclusively large companies and private individuals; the number of small and medium businesses impacted was insignificant.

   Here’s how Doctor Web's partners replied to the question about whether the small and medium-size businesses among their customers had been affected (company names have been removed):

   M..:not yet А..:no А..:no В..:no В..:no one was affected, but everyone is scared :)

   Isn’t that strange given the fact that the malware uses a sophisticated technique to infect targeted computers? Meanwhile, the publicity was enormous.

   What do you think—why was this particular encryption ransomware species so widely discussed in the media? Conspiracy theories?

   A question to Doctor Web's partners during a webinar

3. Decryption is not guaranteed because the encryption keys that are used to show users that recovery is feasible differ from the keys that are used to compromise their other files.
4. The ransom amount (from 300 USD in bitcoins) is quite affordable for most of the companies that have been affected. Many of them have refused to pay it in order to preserve their reputation.

All in all, the WannaCry outbreak spawned a huge number of media reports, a small number of infections, and meagre earnings for the criminals. Who profits the most? It’s unclear.

However, the minimum takeaway on this is that people wanting to make money observed the following:

1. There’s a way to attack at least a quarter of the world’s computers.
2. There is a guaranteed way to penetrate targeted machines—no need to rely on users clicking on links because once a Trojan gets inside, it automatically acquires administrator privileges.

WannaCry is far from being a complex malicious program, and its shortcomings have been discussed by media organisations around the world:

1. It doesn't use re-encryption.
2. It doesn't conceal its presence from anti-viruses.
3. It uses a vulnerable procedure to communicate with its command and control (C&C) server.

One doesn't need to be a fortune teller to predict what’s going to happen next:

One:

It is apparent that the malware (detected by Dr.Web as Trojan.EternalRocks.1) enjoys more sophisticated code–as many as 7 hacking tools!

Two:

Three (the most advanced option):

Dr.Web detects this ransomware program as Trojan.Encoder.11536. It evades detection by anti-viruses and detects virtual machines and sandboxes.

Will exploiting vulnerabilities become a popular means of infection? Time will tell.