NHS cyber-attack: GPs and hospitals hit by ransomware

[chookey]

did ye draw straws in the mod room for who would apply it

They didn't have any straws left, Rawsy's shitting through them roud:

 

[Spectre]

Let's have a look:

Whois malwaretech.co.uk

Registration Date:
2017-05-13

Expiration Date:
2018-05-13

Updated Date:
2017-05-13



Whois malwaretech.com

Registration Date:
2013-11-14

Expiration Date:
2017-11-14

Updated Date:
2017-03-06



Why did the .co.uk address stop the malware?

I'm curious about the propagation speed of his domain, it seemed very quick.

 

[alimac]

block with firewall

for WannaCry, you should block TCP port 137 and UDP ports 137 and 138.

 

[ketmp]

I've seen news articles saying patient records might have been encrypted (not mine, I didn't let them upload it) but are these not in databases on servers, as oppose to local machines? I thought most of the PCs were pretty much acting as thin clients and smartcard access is needed for anything important. How would the malware have gotten to the databases?

I would have thought the main nhs data is held on backend servers (with backups) so worst case all this would do is stop the local PC from working unless it had got itself onto backend server as well?

If it wasn't on the backend server then it's just client PCs that would need to be re-imaged and that will take time. Actual thin clients, I'd have thought, would be unlikely hit by this themselves unless backend server has been infected.

 

[IANB]

Let's have a look:

Whois malwaretech.co.uk

Registration Date:
2017-05-13

Expiration Date:
2018-05-13

Updated Date:
2017-05-13



Whois malwaretech.com

Registration Date:
2013-11-14

Expiration Date:
2017-11-14

Updated Date:
2017-03-06



Why did the .co.uk address stop the malware?

I'm curious about the propagation speed of his domain, it seemed very quick.

So has poacher turned gamekeeper do you think?

 

[Spectre]

So has poacher turned gamekeeper do you think?

I don't know @IANB but there are a few iffy things.

I'm not a conspiracy theorist but I have some questions. I'm sure there are knowledgeable people on here that could help with some .

• He registered a domain name which seemed to propagate in a very short space of time through DNS in order to stop the malware. It was visible in many countries in a matter of hours?
• Was the executable not encrypted? How could he recover the URL?
• Was the memory image not encrypted?
• It is possible that the malware used an encrypted tunnel (I use one for some of my browsing when not at home) but that traffic should have been noticed.
• Why did the proxy servers not see unsolicited traffic?

I'm not an IT person, I just like to dabble .

 

[ketmp]

He registered a domain name which seemed to propagate in a very short space of time through DNS in order to stop the malware. It was visible in many countries in a matter of hours?

I always thought propagating DNS servers throughout the world with all the ISPs can take days, depending on how long an ISP syncs their DNS servers.

Was the executable not encrypted? How could he recover the URL?

Not likely as would need to be executed in a wide variety of OSs. You can recover URL from code via reverse engineering.

Was the memory image not encrypted?

Not sure what you mean?

It is possible that the malware used an encrypted tunnel (I use one for some of my browsing when not at home) but that traffic should have been noticed.

The idea behind the encrypted tunnel is it can't be read from anyone on outside. Likes of NHS networks may pick up an abnormal amount of traffic and flag this but I can imagine this was coded using very little traffic so as not to be immediately obvious until it's too late.

Why did the proxy servers not see unsolicited traffic?

I can imagine this is because they work from a list of known dodgy websites and apply filtering for non known dodgy websites (similar to antivirus) to determine if website is potentially dodgy. As mentioned above, if traffic is very little then this may not immediately be alerted to network administrators.

If I have read the news correctly, what I fail to see is why was this ransomware coded in a way that it would stop working once a website has been setup?

If this website was to be setup and used for so called payments then why wasn't this done quietly beforehand!

Definitely something amiss here I believe.

 

[little_pob]

Let's have a look:

Whois malwaretech.co.uk

Registration Date:
2017-05-13

Expiration Date:
2018-05-13

Updated Date:
2017-05-13



Whois malwaretech.com

Registration Date:
2013-11-14

Expiration Date:
2017-11-14

Updated Date:
2017-03-06



Why did the .co.uk address stop the malware?

I'm curious about the propagation speed of his domain, it seemed very quick.

That's not the killswitch URL that the ransomware was checking for; it was using an unchanging alphanumeric string:

You don't have permission to view the code content. Log in or register now.

The security expect that is going by MalwareTech wants to stay anonymous. Whilst MalwareTech owns the .com URL; the .co.uk address was not registered by him. It is being made available to him by the person that bought it, though. A cynical me wondered if it was a journalist trying to find out his real name. But a brief search on Google of the registrant's name, plus a few other keywords, didn't bring anything up.

This is an interesting read from the horses mouth: Just a moment...

 

[ketmp]

Horizon: Cyber Attack - The Day the NHS Stopped, BBC2 9pm tonight