The WannaCry ransomware attack was a worldwide
cyberattack
A cyberattack is any offensive maneuver that targets computer information systems, computer networks, infrastructures, or personal computer devices. An attacker is a person or process that attempts to access data, functions, or other restricted ...
in May 2017 by the WannaCry
ransomware
Ransomware is a type of malware from cryptovirology that threatens to publish the victim's personal data or permanently block access to it unless a ransom is paid off. While some simple ransomware may lock the system without damaging any files, ...
cryptoworm, which targeted computers running the
Microsoft Windows
Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...
operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also in ...
by encrypting data and demanding ransom payments in the
Bitcoin
Bitcoin ( abbreviation: BTC; sign: ₿) is a decentralized digital currency that can be transferred on the peer-to-peer bitcoin network. Bitcoin transactions are verified by network nodes through cryptography and recorded in a public distr ...
cryptocurrency
A cryptocurrency, crypto-currency, or crypto is a digital currency designed to work as a medium of exchange through a computer network that is not reliant on any central authority, such as a government or bank, to uphold or maintain it. It i ...
. It propagated by using
EternalBlue
EternalBlue is a computer exploit developed by the U.S. National Security Agency (NSA). It was leaked by the Shadow Brokers hacker group on April 14, 2017, one month after Microsoft released patches for the vulnerability.
On May 12, 2017, the ...
, an exploit developed by the United States
National Security Agency
The National Security Agency (NSA) is a national-level intelligence agency of the United States Department of Defense, under the authority of the Director of National Intelligence (DNI). The NSA is responsible for global monitoring, collecti ...
(NSA) for Windows systems. EternalBlue was stolen and leaked by a group called
The Shadow Brokers
The Shadow Brokers (TSB) is a hacker group who first appeared in the summer of 2016. They published several leaks containing hacking tools, including several zero-day exploits, from the "Equation Group" who are widely suspected to be a branch of ...
a month prior to the attack. While
Microsoft
Microsoft Corporation is an American multinational technology corporation producing computer software, consumer electronics, personal computers, and related services headquartered at the Microsoft Redmond campus located in Redmond, Washing ...
had released patches previously to close the exploit, much of WannaCry's spread was from organizations that had not applied these, or were using older Windows systems that were past their
end-of-life. These patches were imperative to organizations' cyber security but many were not implemented due to ignorance of their importance. Some have claimed a need for 24/7 operation, aversion to risking having formerly working applications breaking because of patch changes, lack of personnel or time to install them, or other reasons.
The attack began at 07:44 UTC on 12 May 2017 and was halted a few hours later at 15:03 UTC by the registration of a
kill switch
A kill switch, also known as an emergency stop (E-stop), emergency off (EMO) and as an emergency power off (EPO), is a safety mechanism used to shut off machinery in an emergency, when it cannot be shut down in the usual manner. Unlike a normal ...
discovered by
Marcus Hutchins
Marcus Hutchins (born 1994), also known online as MalwareTech, is a British computer security researcher known for stopping the WannaCry ransomware attack. He is employed by cybersecurity firm Kryptos Logic. Hutchins is from Ilfracombe in Dev ...
. The kill switch prevented already infected computers from being encrypted or further spreading WannaCry. The attack was estimated to have affected more than 300,000 computers
across 150 countries,
with total damages ranging from hundreds of millions to billions of
dollars
Dollar is the name of more than 20 currencies. They include the Australian dollar, Brunei dollar, Canadian dollar, Hong Kong dollar, Jamaican dollar, Liberian dollar, Namibian dollar, New Taiwan dollar, New Zealand dollar, Singapore dollar, U ...
. Security experts believed from preliminary evaluation of the worm that the attack originated from North Korea or agencies working for the country.
In December 2017, the
United States
The United States of America (U.S.A. or USA), commonly known as the United States (U.S. or US) or America, is a country primarily located in North America. It consists of 50 states, a federal district, five major unincorporated territorie ...
and
United Kingdom
The United Kingdom of Great Britain and Northern Ireland, commonly known as the United Kingdom (UK) or Britain, is a country in Europe, off the north-western coast of the continental mainland. It comprises England, Scotland, Wales and North ...
formally asserted that
North Korea
North Korea, officially the Democratic People's Republic of Korea (DPRK), is a country in East Asia. It constitutes the northern half of the Korea, Korean Peninsula and shares borders with China and Russia to the north, at the Yalu River, Y ...
was behind the attack.
A new variant of WannaCry forced
Taiwan Semiconductor Manufacturing Company
Taiwan Semiconductor Manufacturing Company Limited (TSMC; also called Taiwan Semiconductor) is a Taiwanese multinational semiconductor contract manufacturing and design company. It is the world's most valuable semiconductor company, the world' ...
(TSMC) to temporarily shut down several of its chip-fabrication factories in August 2018. The virus spread onto 10,000 machines in TSMC's most advanced facilities.
Description
WannaCry is a
ransomware
Ransomware is a type of malware from cryptovirology that threatens to publish the victim's personal data or permanently block access to it unless a ransom is paid off. While some simple ransomware may lock the system without damaging any files, ...
cryptoworm, which targeted computers running the
Microsoft Windows
Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...
operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also in ...
by encrypting (locking) data and demanding ransom payments in the
Bitcoin
Bitcoin ( abbreviation: BTC; sign: ₿) is a decentralized digital currency that can be transferred on the peer-to-peer bitcoin network. Bitcoin transactions are verified by network nodes through cryptography and recorded in a public distr ...
cryptocurrency
A cryptocurrency, crypto-currency, or crypto is a digital currency designed to work as a medium of exchange through a computer network that is not reliant on any central authority, such as a government or bank, to uphold or maintain it. It i ...
. The worm is also known as WannaCrypt,
Wana Decrypt0r 2.0, WanaCrypt0r 2.0,
and Wanna Decryptor.
It is considered a network worm because it also includes a transport mechanism to automatically spread itself. This transport code scans for vulnerable systems, then uses the
EternalBlue
EternalBlue is a computer exploit developed by the U.S. National Security Agency (NSA). It was leaked by the Shadow Brokers hacker group on April 14, 2017, one month after Microsoft released patches for the vulnerability.
On May 12, 2017, the ...
exploit to gain access, and the
DoublePulsar
DoublePulsar is a backdoor implant tool developed by the U.S. National Security Agency's (NSA) Equation Group that was leaked by The Shadow Brokers in early 2017. The tool infected more than 200,000 Microsoft Windows computers in only a fe ...
tool to install and execute a copy of itself.
WannaCry versions 0, 1, and 2 were created using
Microsoft Visual C++ 6.0.
EternalBlue is an
exploit
Exploit means to take advantage of something (a person, situation, etc.) for one's own end, especially unethically or unjustifiably.
Exploit can mean:
*Exploitation of natural resources
*Exploit (computer security)
* Video game exploit
*Exploitat ...
of Microsoft's implementation of their
Server Message Block
Server Message Block (SMB) is a communication protocol originally developed in 1983 by Barry A. Feigenbaum at IBM and intended to provide shared access to files and printers across nodes on a network of systems running IBM's OS/2. It also provides ...
(SMB) protocol released by
The Shadow Brokers
The Shadow Brokers (TSB) is a hacker group who first appeared in the summer of 2016. They published several leaks containing hacking tools, including several zero-day exploits, from the "Equation Group" who are widely suspected to be a branch of ...
. Much of the attention and comment around the event was occasioned by the fact that the U.S.
National Security Agency
The National Security Agency (NSA) is a national-level intelligence agency of the United States Department of Defense, under the authority of the Director of National Intelligence (DNI). The NSA is responsible for global monitoring, collecti ...
(NSA) (from whom the exploit was likely stolen) had already discovered the vulnerability, but used it to create an exploit for its own
offensive work, rather than report it to Microsoft.
Microsoft eventually discovered the vulnerability, and on
Tuesday
Tuesday is the day of the week between Monday and Wednesday. According to international standard ISO 8601, Monday is the first day of the week; thus, Tuesday is the second day of the week. According to some commonly used calendars, however, ...
, 14 March 2017, they issued security bulletin MS17-010, which detailed the flaw and announced that
patches had been released for all Windows versions that were currently supported at that time, these being
Windows Vista
Windows Vista is a major release of the Windows NT operating system developed by Microsoft. It was the direct successor to Windows XP, which was released five years before, at the time being the longest time span between successive releases of ...
,
Windows 7
Windows 7 is a major release of the Windows NT operating system developed by Microsoft. It was released to manufacturing on July 22, 2009, and became generally available on October 22, 2009. It is the successor to Windows Vista, released nearly ...
,
Windows 8.1
Windows 8.1 is a release of the Windows NT operating system developed by Microsoft. It was released to manufacturing on August 27, 2013, and broadly released for retail sale on October 17, 2013, about a year after the retail release of its pre ...
,
Windows 10
Windows 10 is a major release of Microsoft's Windows NT operating system. It is the direct successor to Windows 8.1, which was released nearly two years earlier. It was released to manufacturing on July 15, 2015, and later to retail on J ...
,
Windows Server 2008
Windows Server 2008 is the fourth release of the Windows Server operating system produced by Microsoft as part of the Windows NT family of the operating systems. It was released to manufacturing on February 4, 2008, and generally to retail on Fe ...
,
Windows Server 2008 R2
Windows Server 2008 R2 is the fifth version of the Windows Server operating system produced by Microsoft and released as part of the Windows NT family of operating systems. It was released to manufacturing on July 22, 2009, and became General av ...
,
Windows Server 2012
Windows Server 2012, codenamed "Windows Server 8", is the sixth version of the Windows Server operating system by Microsoft, as part of the Windows NT family of operating systems. It is the server version of Windows based on Windows 8 and succe ...
, and
Windows Server 2016
Windows Server 2016 is the eighth release of the Windows Server server operating system developed by Microsoft as part of the Windows NT family of operating systems. It was developed concurrently with Windows 10 and is the successor to the Wind ...
.
DoublePulsar is a
backdoor
A back door is a door in the rear of a building. Back door may also refer to:
Arts and media
* Back Door (jazz trio), a British group
* Porta dos Fundos (literally “Back Door” in Portuguese) Brazilian comedy YouTube channel.
* Works so title ...
tool, also released by
The Shadow Brokers
The Shadow Brokers (TSB) is a hacker group who first appeared in the summer of 2016. They published several leaks containing hacking tools, including several zero-day exploits, from the "Equation Group" who are widely suspected to be a branch of ...
on 14 April 2017. Starting from 21 April 2017, security researchers reported that there were tens of thousands of computers with the DoublePulsar backdoor installed. By 25 April, reports estimated that the number of infected computers could be up to several hundred thousand, with numbers increasing every day. The WannaCry code can take advantage of any existing DoublePulsar infection, or installs it itself.
On 9 May 2017, private cybersecurity company RiskSense released code on
GitHub
GitHub, Inc. () is an Internet hosting service for software development and version control using Git. It provides the distributed version control of Git plus access control, bug tracking, software feature requests, task management, continuous ...
with the stated purpose of allowing legal
white hat
White hat, white hats, or white-hat may refer to:
Art, entertainment, and media
* White hat, a way of thinking in Edward de Bono's book ''Six Thinking Hats''
* White hat, part of black and white hat symbolism in film
Other uses
* White hat (compu ...
penetration testers to test the CVE-2017-0144 exploit on unpatched systems.
When executed, the WannaCry
malware
Malware (a portmanteau for ''malicious software'') is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, depri ...
first checks the
kill switch
A kill switch, also known as an emergency stop (E-stop), emergency off (EMO) and as an emergency power off (EPO), is a safety mechanism used to shut off machinery in an emergency, when it cannot be shut down in the usual manner. Unlike a normal ...
domain name; if it is not found, then the ransomware
encrypts
In cryptography, encryption is the process of encoding information. This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext. Ideally, only authorized parties can deci ...
the computer's data,
then attempts to exploit the SMB vulnerability to spread out to random computers on the Internet,
and laterally to computers on the same network.
As with other modern ransomware, the
payload
Payload is the object or the entity which is being carried by an aircraft or launch vehicle. Sometimes payload also refers to the carrying capacity of an aircraft or launch vehicle, usually measured in terms of weight. Depending on the nature of ...
displays a message informing the user that their files have been encrypted, and demands a payment of around US$300 in
bitcoin
Bitcoin ( abbreviation: BTC; sign: ₿) is a decentralized digital currency that can be transferred on the peer-to-peer bitcoin network. Bitcoin transactions are verified by network nodes through cryptography and recorded in a public distr ...
within three days, or US$600 within seven days,
warning that "you have not so enough time.
ic Three
hardcoded
Hard coding (also hard-coding or hardcoding) is the software development practice of embedding data directly into the source code of a computer program, program or other executable object, as opposed to obtaining the data from external sources or ...
bitcoin addresses, or wallets, are used to receive the payments of victims. As with all such wallets, their transactions and balances are publicly accessible even though the
cryptocurrency wallet
A cryptocurrency wallet is a device, physical medium, program or a service which stores the public and/or private keys for cryptocurrency transactions. In addition to this basic function of storing the keys, a cryptocurrency wallet more often a ...
owners remain unknown.
Several organizations released detailed technical write-ups of the malware, including a senior security analyst at RiskSense, Microsoft,
Cisco
Cisco Systems, Inc., commonly known as Cisco, is an American-based multinational digital communications technology conglomerate corporation headquartered in San Jose, California. Cisco develops, manufactures, and sells networking hardware, ...
,
Malwarebytes
Malwarebytes Inc. is an American Internet security company that specializes in protecting home computers, smartphones, and companies from malware and other threats. It has offices in Santa Clara, California; Clearwater, Florida; Tallinn, Estonia ...
,
Symantec and
McAfee
McAfee Corp. ( ), formerly known as McAfee Associates, Inc. from 1987 to 1997 and 2004 to 2014, Network Associates Inc. from 1997 to 2004, and Intel Security Group from 2014 to 2017, is an American global computer security software company head ...
.
Attack
The attack began on Friday, 12 May 2017,
with evidence pointing to an initial infection in Asia at 07:44 UTC.
The initial infection was likely through an exposed
vulnerable SMB port, rather than email phishing as initially assumed.
Within a day the code was reported to have infected more than 230,000 computers in over 150 countries.
Organizations that had not installed Microsoft's security update from March were affected by the attack.
Those still running
unsupported versions of
Microsoft Windows
Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...
, such as
Windows XP
Windows XP is a major release of Microsoft's Windows NT operating system. It was released to manufacturing on August 24, 2001, and later to retail on October 25, 2001. It is a direct upgrade to its predecessors, Windows 2000 for high-end and ...
and
Windows Server 2003
Windows Server 2003 is the sixth version of Windows Server operating system produced by Microsoft. It is part of the Windows NT family of operating systems and was released to manufacturing on March 28, 2003 and generally available on April 24, 2 ...
were at particularly high risk because no security patches had been released since May 2014 for Windows XP and July 2015 for Windows Server 2003.
A
Kaspersky Lab
Kaspersky Lab (; Russian: Лаборатория Касперского, tr. ''Laboratoriya Kasperskogo'') is a Russian multinational cybersecurity and anti-virus provider headquartered in Moscow, Russia, and operated by a holding company in th ...
study reported, however, that less than 0.1 percent of the affected computers were running Windows XP, and that 98 percent of the affected computers were running Windows 7.
In a controlled testing environment, the cybersecurity firm Kryptos Logic found that it was unable to infect a Windows XP system with WannaCry using just the exploits, as the payload failed to load, or caused the operating system to crash rather than actually execute and encrypt files. However, when executed manually, WannaCry could still operate on Windows XP.
Defensive response
Experts quickly advised affected users against paying the ransom due to no reports of people getting their data back after payment and as high revenues would encourage more of such campaigns.
As of 14 June 2017, after the attack had subsided, a total of 327 payments totaling US$130,634.77 (51.62396539 BTC) had been transferred.
The day after the initial attack in May, Microsoft released out-of-band security updates for end-of-life products
Windows XP
Windows XP is a major release of Microsoft's Windows NT operating system. It was released to manufacturing on August 24, 2001, and later to retail on October 25, 2001. It is a direct upgrade to its predecessors, Windows 2000 for high-end and ...
,
Windows Server 2003
Windows Server 2003 is the sixth version of Windows Server operating system produced by Microsoft. It is part of the Windows NT family of operating systems and was released to manufacturing on March 28, 2003 and generally available on April 24, 2 ...
and
Windows 8
Windows 8 is a major release of the Windows NT operating system developed by Microsoft. It was Software release life cycle#Release to manufacturing (RTM), released to manufacturing on August 1, 2012; it was subsequently made available for downl ...
; these patches had been created in February of that year following a tip-off about the vulnerability in January of that year.
Organizations were advised to patch Windows and plug the vulnerability in order to protect themselves from the cyber attack. The head of Microsoft's Cyber Defense Operations Center, Adrienne Hall, said that "Due to the elevated risk for destructive cyber-attacks at this time, we made the decision to take this action because applying these updates provides further protection against potential attacks with characteristics similar to WannaCrypt
lternative name to WannaCry.
Researcher
Marcus Hutchins
Marcus Hutchins (born 1994), also known online as MalwareTech, is a British computer security researcher known for stopping the WannaCry ransomware attack. He is employed by cybersecurity firm Kryptos Logic. Hutchins is from Ilfracombe in Dev ...
discovered the kill switch domain
hardcoded
Hard coding (also hard-coding or hardcoding) is the software development practice of embedding data directly into the source code of a computer program, program or other executable object, as opposed to obtaining the data from external sources or ...
in the malware. Registering a
domain name
A domain name is a string that identifies a realm of administrative autonomy, authority or control within the Internet. Domain names are often used to identify services provided through the Internet, such as websites, email services and more. As ...
for a
DNS sinkhole
A DNS sinkhole, also known as a sinkhole server, Internet sinkhole, or Blackhole DNS is a DNS server that has been configured to hand out non-routable addresses for a certain set of domain names. Computers that use the sinkhole fail to access the ...
stopped the attack spreading as a worm, because the ransomware only encrypted the computer's files if it was unable to connect to that domain, which all computers infected with WannaCry before the website's registration had been unable to do. While this did not help already infected systems, it severely slowed the spread of the initial infection and gave time for defensive measures to be deployed worldwide, particularly in North America and Asia, which had not been attacked to the same extent as elsewhere. On 14 May, a first variant of WannaCry appeared with a new and second kill-switch registered by
Matt Suiche
Matthieu Suiche (born September 22, 1988), also known as Matt and under the username msuiche, is a French hacker and entrepreneur widely known as the founder of MoonSols, and co-founder of CloudVolumes before it was acquired by VMWare in 2014. In ...
on the same day. This was followed by a second variant with the third and last kill-switch on 15 May, which was registered by
Check Point
Check Point is an American-Israeli multinational provider of software and combined hardware and software products for IT security, including network security, endpoint security, cloud security, mobile security, data security and security managem ...
threat intelligence analysts. A few days later, a new version of WannaCry was detected that lacked the kill switch altogether.
On 19 May, it was reported that hackers were trying to use a
Mirai botnet variant to effect a
distributed denial-of-service attack
In computing, a denial-of-service attack (DoS attack) is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connec ...
on WannaCry's kill-switch domain with the intention of knocking it offline. On 22 May, Hutchins protected the domain by switching to a cached version of the site, capable of dealing with much higher traffic loads than the live site.
Separately, researchers from
University College London
, mottoeng = Let all come who by merit deserve the most reward
, established =
, type = Public research university
, endowment = £143 million (2020)
, budget = ...
and
Boston University
Boston University (BU) is a private research university in Boston, Massachusetts. The university is nonsectarian, but has a historical affiliation with the United Methodist Church. It was founded in 1839 by Methodists with its original campu ...
reported that their ''PayBreak'' system could defeat WannaCry and several other families of ransomware by recovering the keys used to encrypt the user's data.
It was discovered that Windows encryption APIs used by WannaCry may not completely clear the
prime number
A prime number (or a prime) is a natural number greater than 1 that is not a product of two smaller natural numbers. A natural number greater than 1 that is not prime is called a composite number. For example, 5 is prime because the only ways ...
s used to generate the payload's private keys from the memory, making it potentially possible to retrieve the required key if they had not yet been overwritten or cleared from resident memory. The key is kept in the memory if the WannaCry process has not been killed and the computer has not been rebooted after being infected. This behaviour was used by a French researcher to develop a tool known as WannaKey, which automates this process on Windows XP systems.
This approach was iterated upon by a second tool known as Wanakiwi, which was tested to work on Windows 7 and Server 2008 R2 as well.
Within four days of the initial outbreak, new infections had slowed to a trickle due to these responses.
Attribution
Linguistic analysis of the ransom notes indicated the authors were likely fluent in Chinese and proficient in English, as the versions of the notes in those languages were probably human-written while the rest seemed to be
machine-translated.
According to an analysis by the FBI's Cyber Behavioral Analysis Center, the computer that created the ransomware language files had
Hangul
The Korean alphabet, known as Hangul, . Hangul may also be written as following South Korea's standard Romanization. ( ) in South Korea and Chosŏn'gŭl in North Korea, is the modern official writing system for the Korean language. The let ...
language fonts installed, as evidenced by the presence of the "\fcharset129"
Rich Text Format
)
As an example, the following RTF code
would be rendered as follows:
This is some bold text.
Character encoding
A standard RTF file can only consist of 7-bit ASCII characters, but can use escape sequences to encode other characters. Th ...
tag.
Metadata in the language files also indicated that the computers that created the ransomware were set to
UTC+09:00, which is used in
Korea
Korea ( ko, 한국, or , ) is a peninsular region in East Asia. Since 1945, it has been divided at or near the 38th parallel, with North Korea (Democratic People's Republic of Korea) comprising its northern half and South Korea (Republic o ...
.
A security researcher initially posted a tweet referencing code similarities between WannaCry and previous malware. The cybersecurity companies
Kaspersky Lab
Kaspersky Lab (; Russian: Лаборатория Касперского, tr. ''Laboratoriya Kasperskogo'') is a Russian multinational cybersecurity and anti-virus provider headquartered in Moscow, Russia, and operated by a holding company in th ...
and
Symantec have both said the code has some similarities with that previously used by the
Lazarus Group
Lazarus Group (also known by other monikers such as Guardians of Peace or Whois Team
) is a cybercrime group made up of an unknown number of individuals run by the government of North Korea. While not much is known about the Lazarus Group, resea ...
(believed to have carried out
the cyberattack on Sony Pictures in 2014 and
a Bangladesh bank heist in 2016—and linked to
North Korea
North Korea, officially the Democratic People's Republic of Korea (DPRK), is a country in East Asia. It constitutes the northern half of the Korea, Korean Peninsula and shares borders with China and Russia to the north, at the Yalu River, Y ...
).
This could also be either simple re-use of code by another group or an attempt to shift blame—as in a
cyber false flag operation;
but a leaked internal NSA memo is alleged to have also linked the creation of the worm to North Korea.
Brad Smith Brad or Bradley Smith may refer to:
Sportspeople
* Bradley Smith (cricketer) (born 1969), English former cricketer
* Brad Smith (footballer, born 1948), Australian rules footballer and premiership coach of East Fremantle
* Brad Smith (ice hockey) ...
, the president of Microsoft, said he believed North Korea was the originator of the WannaCry attack, and the UK's National Cyber Security Centre reached the same conclusion.
On 18 December 2017, the
United States Government
The federal government of the United States (U.S. federal government or U.S. government) is the national government of the United States, a federal republic located primarily in North America, composed of 50 states, a city within a fede ...
formally announced that it publicly considers North Korea to be the main culprit behind the WannaCry attack. Then-
President
President most commonly refers to:
*President (corporate title)
*President (education), a leader of a college or university
*President (government title)
President may also refer to:
Automobiles
* Nissan President, a 1966–2010 Japanese ful ...
Trump
Trump most commonly refers to:
* Donald Trump (born 1946), 45th president of the United States (2017–2021)
* Trump (card games), any playing card given an ad-hoc high rank
Trump may also refer to:
Businesses and organizations
* Donald J. T ...
's
Homeland Security Advisor
The Assistant to the President for Homeland Security and Counterterrorism, commonly referred to as the Homeland Security Advisor and formerly the Deputy National Security Advisor for Homeland Security and Counterterrorism, is a senior aide in the ...
,
Tom Bossert
Thomas P. Bossert (born March 25, 1975) is an American lawyer and former Homeland Security Advisor to U.S. President Donald Trump. He is an ABC News Homeland Security analyst.
Immediately before, he was a fellow at the Atlantic Council and prior ...
, wrote an
op-ed
An op-ed, short for "opposite the editorial page", is a written prose piece, typically published by a North-American newspaper or magazine, which expresses the opinion of an author usually not affiliated with the publication's editorial board. O ...
in ''
The Wall Street Journal
''The Wall Street Journal'' is an American business-focused, international daily newspaper based in New York City, with international editions also available in Chinese and Japanese. The ''Journal'', along with its Asian editions, is published ...
'' about this charge, saying "We do not make this allegation lightly. It is based on evidence." In a press conference the following day, Bossert said that the evidence indicates that
Kim Jong-un
Kim Jong-un (; , ; born 8 January 1982) is a North Korean politician who has been Supreme Leader of North Korea since 2011 and the leader of the Workers' Party of Korea (WPK) since 2012. He is a son of Kim Jong-il, who was North Korea's sec ...
had given the order to launch the malware attack. Bossert said that Canada, New Zealand and Japan agree with the United States' assessment of the evidence that links the attack to North Korea, while the United Kingdom's
Foreign and Commonwealth Office
The Foreign, Commonwealth & Development Office (FCDO) is a Departments of the Government of the United Kingdom, department of the Government of the United Kingdom. Equivalent to other countries' Ministry of Foreign Affairs, ministries of fore ...
says it also stands behind the United States' assertion.
North Korea, however, denied being responsible for the cyberattack.
On 6 September 2018, the US Department of Justice (DoJ) announced formal charges against
Park Jin-hyok for involvement in the
Sony Pictures hack
On November 24, 2014, a hacker group identifying itself as "Guardians of Peace" leaked a release of confidential data from the film studio Sony Pictures Entertainment (SPE). The data included personal information about Sony Pictures employees ...
of 2014. The DoJ contended that Park was a North Korean hacker working as part of a team of experts for the North Korean
Reconnaissance General Bureau. The Department of Justice asserted this team also had been involved in the WannaCry attack, among other activities.
Impact
![Countries initially affected in WannaCry ransomware attack](https://upload.wikimedia.org/wikipedia/commons/2/20/Countries_initially_affected_in_WannaCry_ransomware_attack.svg)
The ransomware campaign was unprecedented in scale according to
Europol,
which estimates that around 200,000 computers were infected across 150 countries. According to
Kaspersky Lab
Kaspersky Lab (; Russian: Лаборатория Касперского, tr. ''Laboratoriya Kasperskogo'') is a Russian multinational cybersecurity and anti-virus provider headquartered in Moscow, Russia, and operated by a holding company in th ...
, the four most affected countries were
Russia
Russia (, , ), or the Russian Federation, is a List of transcontinental countries, transcontinental country spanning Eastern Europe and North Asia, Northern Asia. It is the List of countries and dependencies by area, largest country in the ...
,
Ukraine
Ukraine ( uk, Україна, Ukraïna, ) is a country in Eastern Europe. It is the second-largest European country after Russia, which it borders to the east and northeast. Ukraine covers approximately . Prior to the ongoing Russian inv ...
,
India
India, officially the Republic of India (Hindi: ), is a country in South Asia. It is the seventh-largest country by area, the second-most populous country, and the most populous democracy in the world. Bounded by the Indian Ocean on the so ...
and
Taiwan
Taiwan, officially the Republic of China (ROC), is a country in East Asia, at the junction of the East and South China Seas in the northwestern Pacific Ocean, with the People's Republic of China (PRC) to the northwest, Japan to the nort ...
.
One of the largest agencies struck by the attack was the
National Health Service
The National Health Service (NHS) is the umbrella term for the publicly funded healthcare systems of the United Kingdom (UK). Since 1948, they have been funded out of general taxation. There are three systems which are referred to using the " ...
hospitals in England and Scotland, and up to 70,000 devices – including computers,
MRI scanners, blood-storage refrigerators and theatre equipment – may have been affected.
On 12 May, some NHS services had to turn away non-critical emergencies, and some ambulances were diverted.
In 2016, thousands of computers in 42 separate
NHS trust
An NHS trust is an organisational unit within the National Health Services of England and Wales, generally serving either a geographical area or a specialised function (such as an ambulance service). In any particular location there may be several ...
s in England were reported to be still running Windows XP.
In 2018 a report by Members of Parliament concluded that all 200 NHS hospitals or other organizations checked in the wake of the WannaCry attack still failed cybersecurity checks. NHS hospitals in Wales and Northern Ireland were unaffected by the attack.
Nissan Motor Manufacturing UK
Nissan Motor Manufacturing (UK) Ltd (NMUK) is a British subsidiary car manufacturing plant in Sunderland. It is owned and operated by the European division of Japanese car manufacturer Nissan.
Geography
Nissan Motor Manufacturing UK is loc ...
in
Tyne and Wear
Tyne and Wear () is a metropolitan county in North East England, situated around the mouths of the rivers Tyne and Wear. It was created in 1974, by the Local Government Act 1972, along with five metropolitan boroughs of Gateshead, Newcastl ...
, England, halted production after the ransomware infected some of their systems.
Renault
Groupe Renault ( , , , also known as the Renault Group in English; legally Renault S.A.) is a French multinational automobile manufacturer established in 1899. The company produces a range of cars and vans, and in the past has manufactured ...
also stopped production at several sites in an attempt to stop the spread of the ransomware. Spain's
Telefónica
Telefónica, S.A. () is a Spanish multinational telecommunications company headquartered in Madrid, Spain. It is one of the largest telephone operators and mobile network providers in the world. It provides fixed and mobile telephony, broadba ...
,
FedEx
FedEx Corporation, formerly Federal Express Corporation and later FDX Corporation, is an American multinational conglomerate holding company focused on transportation, e-commerce and business services based in Memphis, Tennessee. The name "Fe ...
and
Deutsche Bahn
The (; abbreviated as DB or DB AG) is the national railway company of Germany. Headquartered in the Bahntower in Berlin, it is a joint-stock company ( AG). The Federal Republic of Germany is its single shareholder.
describes itself as the se ...
were hit, along with many other countries and companies worldwide.
The attack's impact is said to be relatively low compared to other potential attacks of the same type and could have been much worse had Hutchins not discovered that a kill switch had been built in by its creators
or if it had been specifically targeted on highly
critical infrastructure
Critical infrastructure (or critical national infrastructure (CNI) in the UK) is a term used by governments to describe assets that are essential for the functioning of a society and economy – the infrastructure. Most commonly associated wi ...
, like
nuclear power plants
A nuclear power plant (NPP) is a thermal power station in which the heat source is a nuclear reactor. As is typical of thermal power stations, heat is used to generate steam that drives a steam turbine connected to a generator that produces elec ...
, dams or railway systems.
According to cyber-risk-modeling firm Cyence, economic losses from the cyber attack could reach up to US $4 billion, with other groups estimating the losses to be in the hundreds of millions.
Affected organizations
The following is an alphabetical list of organisations confirmed to have been affected:
Reactions
A number of experts highlighted the
NSA
The National Security Agency (NSA) is a national-level intelligence agency of the United States Department of Defense, under the authority of the Director of National Intelligence (DNI). The NSA is responsible for global monitoring, collecti ...
's non-disclosure of the underlying vulnerability, and their loss of control over the EternalBlue attack tool that exploited it.
Edward Snowden
Edward Joseph Snowden (born June 21, 1983) is an American and naturalized Russian former computer intelligence consultant who leaked highly classified information from the National Security Agency (NSA) in 2013, when he was an employee and su ...
said that if the NSA had "
privately disclosed the flaw used to attack hospitals when they found it, not when they lost it, the attack may not have happened". British cybersecurity expert
Graham Cluley
Graham Cluley (born 8 April 1969) is a British security blogger and the author of grahamcluley.com, a daily blog on the latest computer security news, opinion, and advice.
Cluley started his career in the computer security industry as a program ...
also sees "some culpability on the part of the U.S. intelligence services". According to him and others "they could have done something ages ago to get this problem fixed, and they didn't do it". He also said that despite obvious uses for such tools
to spy on people of interest, they have a duty to protect their countries' citizens. Others have also commented that this attack shows that the practice of intelligence agencies to stockpile exploits for offensive purposes rather than disclosing them for defensive purposes may be problematic.
Microsoft president and chief legal officer
Brad Smith Brad or Bradley Smith may refer to:
Sportspeople
* Bradley Smith (cricketer) (born 1969), English former cricketer
* Brad Smith (footballer, born 1948), Australian rules footballer and premiership coach of East Fremantle
* Brad Smith (ice hockey) ...
wrote, "Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage. An equivalent scenario with conventional weapons would be the U.S. military having some of its
Tomahawk missiles stolen." Russian President
Vladimir Putin
Vladimir Vladimirovich Putin; (born 7 October 1952) is a Russian politician and former intelligence officer who holds the office of president of Russia. Putin has served continuously as president or prime minister since 1999: as prime min ...
placed the responsibility of the attack on U.S. intelligence services, for having created EternalBlue.
On 17 May 2017, United States bipartisan lawmakers introduced the PATCH Act that aims to have exploits reviewed by an independent board to "balance the need to disclose vulnerabilities with other national security interests while increasing transparency and accountability to maintain public trust in the process".
On 15 June 2017, the United States Congress was to hold a hearing on the attack.
Two subpanels of the House Science Committee were to hear the testimonies from various individuals working in the government and non-governmental sector about how the US can improve its protection mechanisms for its systems against similar attacks in the future.
Marcus Hutchins
Marcus Hutchins (born 1994), also known online as MalwareTech, is a British computer security researcher known for stopping the WannaCry ransomware attack. He is employed by cybersecurity firm Kryptos Logic. Hutchins is from Ilfracombe in Dev ...
, a cybersecurity researcher, working in loose collaboration with UK's
National Cyber Security Centre,
researched the malware and discovered a "kill switch".
Later globally dispersed security researchers
collaborated online to
develop
Develop or DEVELOP may refer to:
* ''Develop'' (magazine), a trade publication for the video game industry
* ''Develop'' (Apple magazine), a technical magazine formerly published by Apple Computer
* Develop (chess), moving a piece from its origina ...
open source
Open source is source code that is made freely available for possible modification and redistribution. Products include permission to use the source code, design documents, or content of the product. The open-source model is a decentralized sof ...
tools
that allow for decryption without payment under some circumstances.
Snowden states that when "
NSA
The National Security Agency (NSA) is a national-level intelligence agency of the United States Department of Defense, under the authority of the Director of National Intelligence (DNI). The NSA is responsible for global monitoring, collecti ...
-enabled ransomware eats the Internet, help comes from researchers, not spy agencies" and asks why this is the case.
Adam Segal, director of the digital and cyberspace policy program at the
Council on Foreign Relations
The Council on Foreign Relations (CFR) is an American think tank
A think tank, or policy institute, is a research institute that performs research and advocacy concerning topics such as social policy, political strategy, economics, mi ...
, stated that "the patching and updating systems are broken, basically, in the private sector and in government agencies".
In addition, Segal said that governments' apparent inability to secure vulnerabilities "opens a lot of questions about backdoors and access to encryption that the government argues it needs from the private sector for security".
Arne Schönbohm, president of Germany's
Federal Office for Information Security
The Federal Office for Information Security (german: Bundesamt für Sicherheit in der Informationstechnik, abbreviated as BSI) is the German upper-level federal agency in charge of managing computer and communication security for the German go ...
(BSI), stated that "the current attacks show how vulnerable our
digital society is. It's a wake-up call for companies to finally take IT security
eriously.
United Kingdom
The effects of the attack also had political implications; in the
United Kingdom
The United Kingdom of Great Britain and Northern Ireland, commonly known as the United Kingdom (UK) or Britain, is a country in Europe, off the north-western coast of the continental mainland. It comprises England, Scotland, Wales and North ...
, the impact on the
National Health Service
The National Health Service (NHS) is the umbrella term for the publicly funded healthcare systems of the United Kingdom (UK). Since 1948, they have been funded out of general taxation. There are three systems which are referred to using the " ...
quickly became political, with claims that the effects were exacerbated by Government underfunding of the NHS; in particular, the NHS ceased its paid Custom Support arrangement to continue receiving support for unsupported Microsoft software used within the organization, including Windows XP.
Home Secretary
The secretary of state for the Home Department, otherwise known as the home secretary, is a senior minister of the Crown in the Government of the United Kingdom. The home secretary leads the Home Office, and is responsible for all national ...
Amber Rudd
Amber Augusta Rudd (born 1 August 1963) is a British former politician who served as Home Secretary from 2016 to 2018 and Secretary of State for Work and Pensions from 2018 to 2019. She was a Member of Parliament (MP) for Hastings and Rye, fi ...
refused to say whether patient data had been
backed up
Constipation is a bowel dysfunction that makes bowel movements infrequent or hard to pass. The Human feces, stool is often hard and dry. Other symptoms may include abdominal pain, bloating, and feeling as if one has not completely passed the bo ...
, and
Shadow Health Secretary
The Shadow Secretary of State for Health and Social Care is an office within British politics held by a member of His Majesty's Loyal Opposition. The duty of the office holder is to scrutinise the actions of the government's Secretary of State f ...
Jon Ashworth
Jonathan Michael Graham Ashworth (born 14 October 1978) is a British politician serving as Shadow Secretary of State for Work and Pensions since 2021. A member of the Labour and Co-operative parties, he has been the Member of Parliament (MP) f ...
accused
Health Secretary Jeremy Hunt
Jeremy Richard Streynsham Hunt (born 1 November 1966) is a British politician who has served as Chancellor of the Exchequer since 14 October 2022. He previously served in the Cabinet as Secretary of State for Culture, Olympics, Media and Sport ...
of refusing to act on a critical note from Microsoft, the
National Cyber Security Centre (NCSC) and the
National Crime Agency
The National Crime Agency (NCA) is a national law enforcement agency in the United Kingdom. It is the UK's lead agency against organised crime; human, weapon and drug trafficking; cybercrime; and economic crime that goes across regional and in ...
that had been received two months previously.
Others argued that hardware and software vendors often fail to account for future security flaws, selling systems that − due to their technical design and market incentives − eventually won't be able to properly receive and apply patches.
The NHS denied that it was still using XP, claiming only 4.7% of devices within the organization ran Windows XP.
The cost of the attack to the NHS was estimated as £92 million in disruption to services and IT upgrades.
After the attack,
NHS Digital
NHS Digital is the trading name of the Health and Social Care Information Centre, which is the national provider of information, data and IT systems for commissioners, analysts and clinicians in health and social care in England, particularly th ...
refused to finance the estimated £1 billion to meet the
Cyber Essentials Plus standard, an information security certification organized by the UK NCSC, saying this would not constitute "value for money", and that it had invested over £60 million and planned "to spend a further £150
illionover the next two years" to address key cyber security weaknesses.
See also
References
External links
Ransom:Win32/WannaCryptat Microsoft Malware Protection Center
* , a
Twitterbot
A Twitter bot is a type of software bot that controls a Twitter account via the Twitter API. The social bot software may autonomously perform actions such as tweeting, re-tweeting, liking, following, unfollowing, or direct messaging other account ...
tracking the ransom payments
{{Portal bar, Law, border=Microsoft, Internet
2017 in computing
Cyberattacks
Cybercrime
Hacking in the 2010s
May 2017 crimes
Ransomware
Computer security exploits
Windows malware
2010s internet outages
Cyberwarfare in North Korea
Cybercrime in India