StatewardStateward
← Toutes les vulnérabilités
CRITICALInfracurated

INFRA-WANNACRY-2017

Windows · SMB · Microsoft Windows (SMBv1 / EternalBlue)

Résumé

On the morning of 12 May 2017, WannaCry became the fastest-spreading ransomware in history, encrypting files on more than 230,000 Windows machines across 150-plus countries in a single day and demanding a few hundred dollars in Bitcoin per machine. It needed no phishing and no clicks. It was a worm: it spread itself from one unpatched computer to the next using EternalBlue, an exploit for a flaw in Windows' ancient SMBv1 file-sharing protocol that the US National Security Agency had quietly stockpiled and that a group called the Shadow Brokers had leaked weeks earlier. Microsoft had shipped a patch (MS17-010) two months before, but the unpatched and the end-of-life machines, most famously across the UK's National Health Service, which diverted ambulances and cancelled thousands of operations, were swept up regardless. The global rampage was then halted almost by accident when a 22-year-old researcher registered a single gibberish domain for about ten dollars, not yet knowing it was the worm's kill switch. WannaCry is the textbook lesson in patching fast and killing legacy protocols, with a stranger-than-fiction ending.

How it worked

WannaCry was two old ideas bolted together: ransomware and a network worm.

The ransomware part was ordinary. Once on a machine it encrypted documents, photos, and databases, dropped a red ransom note demanding around $300 in Bitcoin (rising to $600, then threatening deletion), and locked the screen. Ransomware like this was already common by 2017.

What made WannaCry catastrophic was the worm wrapped around it. It carried two leaked NSA cyberweapons: EternalBlue, an exploit for a remote-code-execution flaw in the SMBv1 file-sharing protocol (CVE-2017-0144), and DoublePulsar, a backdoor it installed to run its payload. With these, an infected machine scanned its own network and the wider internet for other Windows hosts with port 445 open, exploited them with no user interaction at all, and copied itself across. One unpatched laptop plugged into a hospital network could seed the whole estate in minutes. The exploit had been a zero-day hoarded by the NSA for several years; when the Shadow Brokers dumped it publicly in April 2017, it became a weapon anyone could fire, and a month later someone did.

The damage

WannaCry did not steal data or target anyone in particular; it just burned through everything reachable, which made its victim list almost random and global. Spain's Telefónica, FedEx, the German rail operator Deutsche Bahn, Renault and Nissan car plants (which halted production), Russia's interior ministry, and universities in China all went down.

The defining casualty was the UK's National Health Service. WannaCry knocked out computers, MRI scanners, and blood-storage fridges across at least 80 hospital trusts and hundreds of GP surgeries. Ambulances were diverted, an estimated 19,000 appointments and operations were cancelled, and the UK's National Audit Office later put the direct cost to the NHS at about £92 million, roughly £20 million in lost output during the week of the attack and £72 million on IT recovery afterward. The NAO's verdict was damning: the attack was unsophisticated and entirely preventable, and NHS bodies had been warned about exactly this SMB vulnerability weeks earlier. So severe was the outbreak that Microsoft took the rare step of shipping an emergency patch for Windows XP, Windows 8, and Server 2003, operating systems it had already stopped supporting. Worldwide damage estimates run from $4 billion to $8 billion.

The accidental kill switch

WannaCry's global spread was stopped, by luck, within hours, by a then-22-year-old British researcher named Marcus Hutchins (known online as MalwareTech). Reverse-engineering the worm on the day of the outbreak, he noticed it tried to contact one specific, unregistered, gibberish domain before doing anything else, and exited if the domain answered. Following his usual practice of sinkholing malware to track it, he registered the domain for about $10.69, only to realise afterwards that doing so had switched the worm off: every new infection now reached a live domain, read it as "stop," and shut itself down. The whole episode took about seven hours from the worm's first spread to the kill switch taking hold, though it did nothing for machines already encrypted. In a twist that became its own cautionary tale, Hutchins was arrested in the US months later on unrelated charges tied to banking malware he had written years earlier as a teenager.

Who was behind it

In December 2017 the United States, joined by the United Kingdom, Canada, Australia, New Zealand, and Japan, publicly attributed WannaCry to North Korea, specifically the Lazarus Group, the same state-backed crew tied to the 2014 Sony Pictures hack and the 2016 theft from Bangladesh's central bank. Security firms had already found code shared between WannaCry and earlier Lazarus malware. The result is one of the strangest provenance chains in security history: a North Korean ransomware worm, built on a cyberweapon stolen from the American NSA and leaked by a still-unidentified group, that ended up paralysing British hospitals. The ransom, tellingly, brought in only around $130,000 (about 51 Bitcoin across 327 payments), a trivial sum next to the damage, which suggests WannaCry may have been released before it was even finished.

Why WannaCry still matters

WannaCry is the case everyone points to when they say "patch faster," because the patch was already there. MS17-010 had shipped two months earlier; nearly every victim was hit through a hole that a single update would have closed. It is also the moment "wormable" re-entered the vocabulary: a vulnerability that lets malware spread with no human in the loop turns a slow problem into an instant, global one. And it kept on giving, the very same EternalBlue exploit went on to power NotPetya six weeks later and BadRabbit after that. The lessons are unglamorous and still routinely ignored: patch network-facing flaws on a clock, retire legacy protocols like SMBv1, segment the network, and keep offline backups so recovery never depends on paying a stranger.

Comment le corriger

  • Apply MS17-010 to every supported Windows host; for end-of-life systems (XP, Server 2003) apply Microsoft's separate emergency update or retire them behind strict compensating controls, since MS17-010 itself never covered those.
  • Disable SMBv1 entirely; it is obsolete and was the propagation channel.
  • Isolate infected hosts, rebuild them, and restore from clean offline backups; do not pay, the keys are unreliable and you are funding the next attack.
  • Block inbound SMB (TCP 445) at the network edge and between internal segments.

Comment l’éviter

  • Patch internet-facing and laterally-reachable vulnerabilities on a short, enforced SLA; a two-month-old fix saved no one who skipped it.
  • Remove or tightly segment end-of-life and unmaintainable systems that can no longer be patched.
  • Disable legacy protocols like SMBv1 and restrict SMB to the few places that genuinely need it.
  • Keep tested, offline, immutable backups so ransomware recovery never depends on paying.
  • Segment the network so a single wormable flaw cannot reach the entire estate.

Références

Vulnérabilités liées

Tout Infra →