More about the WannaCry Ransomware Attack

The crooks responsible for WannaCry exploited a weakness in Windows operating systems with a computer worm that encrypts data, making affected computer files inaccessible. Windows had, in fact, released protective patches in March that could have easily been installed with a regular software update. (If you think you missed installing the patch on your home computer, go to this page … By the way, if you’re reading this and you are a SynchroNet customer, you are good to go.) What makes WannaCry especially virulent is that it can spread throughout corporate networks without user-interaction. In other words, if you’re part of an infected network — i.e., someone on your network fell for the scam — you don’t have to open an email or click on a link to have the virus lock your files; your colleague may have opened the door already.

As the virus has spread, efforts got underway to fight back. The day after WannaCry hit, a 22-year-old researcher in the United Kingdom noticed a domain name used by the hackers hadn’t been registered, so he did this himself for $10.69. He took control of the domain to track how the virus was spreading, but in a lucky break, his surveillance inadvertently triggered one of the hackers’ own security measures which caused the virus to “kill” itself. (You can read a detailed account here.) Unfortunately, the hackers fixed the “bug” in their bug, so within a few days the virus was back in action. On Friday, May 19, Reuters reportedthat French researchers had found a way to unlock the decrypted files without paying the ransom. A problem with their method though, is that it won’t work if the computer has been rebooted (the first thing most people instinctively try). Incidentally, by that date, 300,000 computers in 150 countries had been victimized.

One positive outcome is that the scope of this ransomware attack has generated a great deal of public awareness — and perhaps this will spur intensified R&D investment in prevention and counter measures from software manufacturers, as well as government defense and law enforcement agencies. Though a $300 ransom is relatively small, we note that hospitals were prominent among the initial targets, putting the healthcare and lives of huge numbers of people at risk. It’s also easy to imagine a virus like WannaCry affecting databases used by emergency first responders. Collectively, we can’t afford to view ransomware like WannaCry ransomware as just an especially annoying “cost-of-doing” business.

In the meantime, we individually remain our best defense against ransomware. To help protect your files: