Join +750K new investors every month who copy stock picks from billionaire's portfoliosSign Up Free

Oddities in WannaCry ransomware puzzle cybersecurity researchers

Published 16/05/2017, 11:57
© Reuters. A WannaCry ransomware demand, provided by cyber security firm Symantec
MSFT
-
GEN
-
IBM
-
MNDT
-

By Jeremy Wagstaff

SINGAPORE (Reuters) - The WannaCry malware that spread to more than 100 countries in a few hours is throwing up several surprises for cybersecurity researchers, including how it gained its initial foothold, how it spread so fast and why the hackers are not making much money from it.

Some researchers have found evidence they say could link North Korea with the attack, but others are more cautious, saying that the first step is shedding light on even the most basic questions about the malware itself.

For one thing, said IBM (NYSE:IBM) Security's Caleb Barlow, researchers are still unsure exactly how the malware spread in the first place. Most cybersecurity companies have blamed phishing e-mails - e-mails containing malicious attachments or links to files - that download the ransomware. 

That's how most ransomware finds its way onto victims' computers. 

The problem in the WannaCry case is that despite digging through the company's database of more than 1 billion e-mails dating back to March 1, Barlow's team could find none linked to the attack. 

"Once one victim inside a network is infected it propagates," Boston-based Barlow said in a phone interview, describing a vulnerability in Microsoft (NASDAQ:MSFT) Windows that allows the worm to move from one computer to another.

The NSA used the Microsoft flaw to build a hacking tool codenamed EternalBlue that ended up in the hands of a mysterious group called the Shadow Brokers, which then published that and other such tools online. 

But the puzzle is how the first person in each network was infected with the worm. "It's statistically very unusual that we'd scan and find no indicators," Barlow said.  

Other researchers agree. "Right now there is no clear indication of the first compromise for WannaCry," said Budiman Tsjin of RSA Security, a part of Dell. 

Knowing how malware infects and spreads is key to being able to stop existing attacks and anticipate new ones. "How the hell did this get on there, and could this be repeatedly used again?" said Barlow.

PALTRY RANSOM

Some cybersecurity companies, however, say they've found a few samples of the phishing e-mails. FireEye (N:FEYE) said it was aware customers had used its reports to successfully identify some associated with the attack. 

But the company agrees that the malware relied less on phishing e-mails than other attacks. Once a certain number of infections was established, it was able to use the Microsoft vulnerability to propagate without their help. 

There are other surprises, that suggest this is not an ordinary ransomware attack.

Only paltry sums were collected by the hackers, according to available evidence, mostly in the bitcoin cryptocurrency.

There were only three bitcoin wallets and the campaign has far earned only $50,000 (£38,790) or so, despite the widespread infections. Barlow said that single payments in some other ransomware cases were more than that, depending on the victim. 

Jonathan Levin of Chainalysis, which monitors bitcoin payments, said there were other differences compared to most ransomware campaigns: for instance the lack of sophisticated methods used in previous cases to convince victims to pay up. In the past, this has included hot lines in various languages.

And so far, Levin said, the bitcoin that had been paid into the attackers' wallets remained there - compared to another campaign, known as Locky, which made $15 million while regularly emptying the bitcoin wallets. 

"They really aren't set up well to handle their bitcoin payments," Levin said.

The lack of sophistication may bolster those cybersecurity researchers who say they have found evidence that could link North Korea to the attack.

A senior researcher from South Korea's Hauri Labs, Simon Choi, said on Tuesday the reclusive state had been developing and testing ransomware programs only since August. In one case, the hackers demanded bitcoin in exchange for client information they had stolen from a South Korean shopping mall.

Choi, who has done extensive research into North Korea's hacking capabilities, said his findings matched those of Symantec (O:SYMC) and Kaspersky Lab, who say some code in an earlier version of the WannaCry software had also appeared in programs used by the Lazarus Group, identified by some researchers as a North Korea-run hacking operation.

The Lazarus hackers have however been more brazen in their pursuit of financial gain than others, and have been blamed for the theft of $81 million (£62.8 million) from the Bangladesh central bank, according to some cybersecurity firms. The United States accused it of being behind a cyber attack on Sony Pictures in 2014.

Whoever is found to be behind the attack, said Marin Ivezic, a cybersecurity partner at PwC in Hong Kong, the way the hackers used freely available tools so effectively may be what makes this campaign more worrying. 

By bundling a tool farmed from the leaked NSA files with their own ransomware, "they achieved better distribution than anything they could have achieved in a traditional way" he said.

© Reuters. A WannaCry ransomware demand, provided by cyber security firm Symantec

"EternalBlue (the hacking tool) has now demonstrated the ROI (return on investment) of the right sort of worm and this will become the focus of research for cybercriminals," Ivezic said. 

(Additional reporting Ju-Min Park in Seoul, Editing by Raju Gopalakrishnan)

Latest comments

Risk Disclosure: Trading in financial instruments and/or cryptocurrencies involves high risks including the risk of losing some, or all, of your investment amount, and may not be suitable for all investors. Prices of cryptocurrencies are extremely volatile and may be affected by external factors such as financial, regulatory or political events. Trading on margin increases the financial risks.
Before deciding to trade in financial instrument or cryptocurrencies you should be fully informed of the risks and costs associated with trading the financial markets, carefully consider your investment objectives, level of experience, and risk appetite, and seek professional advice where needed.
Fusion Media would like to remind you that the data contained in this website is not necessarily real-time nor accurate. The data and prices on the website are not necessarily provided by any market or exchange, but may be provided by market makers, and so prices may not be accurate and may differ from the actual price at any given market, meaning prices are indicative and not appropriate for trading purposes. Fusion Media and any provider of the data contained in this website will not accept liability for any loss or damage as a result of your trading, or your reliance on the information contained within this website.
It is prohibited to use, store, reproduce, display, modify, transmit or distribute the data contained in this website without the explicit prior written permission of Fusion Media and/or the data provider. All intellectual property rights are reserved by the providers and/or the exchange providing the data contained in this website.
Fusion Media may be compensated by the advertisers that appear on the website, based on your interaction with the advertisements or advertisers.
© 2007-2024 - Fusion Media Limited. All Rights Reserved.