WannaCry ransomware (2017)

What happened

On Friday, May 12, 2017, a ransomware program called WannaCry (also written WannaCrypt) began spreading rapidly across the world. Within about a day it had infected more than 200,000 computers in around 150 countries, according to widely reported estimates. Infected machines displayed a red-and-white ransom screen demanding payment in bitcoin, starting at the equivalent of $300 and doubling if not paid within days.

Victims ranged from home users to large organizations, including telecom companies, car factories, logistics firms and railway operators. One of the most visible was the National Health Service in England, where some hospitals and general practices had to cancel appointments and divert ambulances. A UK National Audit Office report later found that about 19,000 appointments were canceled.

How it worked

WannaCry combined two components:

• Ransomware. Like other ransomware, it encrypted documents, photos, databases and other files, then demanded payment for the decryption key.
• A worm. Unlike most ransomware, which arrives by email, WannaCry spread on its own across networks. It used an exploit, known as EternalBlue, for a flaw in version 1 of Windows' file-sharing protocol (SMBv1). The exploit had been leaked publicly in April 2017.

Microsoft had already released a fix for that flaw in its March 14, 2017 security update (bulletin MS17-010). Computers that had installed the update were protected from the worm. The victims were largely machines that had not been patched, or that ran Windows versions such as Windows XP that no longer received regular updates. Because SMB was often open inside corporate networks, a single infected machine could reach many others in minutes.

The kill switch

The spread slowed dramatically on the first day because of a quirk in the code. Before encrypting files, WannaCry tried to contact an unusual, unregistered web domain. If the domain answered, the program stopped. A British security researcher analyzing the sample noticed the domain and registered it, which caused new infections to halt. Later variants removed or changed this check, but by then many organizations had patched.

Microsoft also took the unusual step of releasing emergency fixes for Windows XP and other out-of-support versions on May 13.

Impact

Total damage estimates vary widely and are hard to verify, but the disruption to health care, manufacturing and transport was significant. Comparatively few victims paid, and paying was unreliable, because the ransom process did not track individual payments well. The main costs came from downtime, recovery and canceled services.

What defenders learned

• Patch quickly, especially for wormable flaws. The fix had been available for two months. Organizations need processes to apply critical updates in days, not quarters.
• Retire unsupported systems or isolate them. Medical devices and factory machines running old Windows versions were among the hardest to protect.
• Disable old protocols. SMBv1 dates from the 1980s and 1990s; Microsoft now disables it by default in current Windows versions.
• Segment networks. Flat networks let one infection reach everything.
• Backups decide recovery. Organizations with offline backups restored faster without paying.

What it means for you

At home, keep automatic Windows updates on and restart when asked. See software updates. If a device can no longer get updates, plan to replace it or keep it off the internet. Back up important files to a drive you disconnect afterwards or to a cloud service with version history, and read our guide to ransomware to recognize the more common, email-based kind. For businesses, our backups and ransomware readiness guide covers the steps that turn an outbreak into an inconvenience.