1

After the recent spread of WannaCrypt, there has been a lot of warnings about the dangers of emails and clicking on links in them.

But the malware is spreading as a worm using SMB to infect other vulnerable computers.

Here is Microsoft's answer to the problem:

Customer Guidance for WannaCrypt attacks (Microsoft Technet, May 2017)

you'll notice they have no mention about emails in there.

My question is in the title: What do emails have to do with the spread of WannaCrypt?

Improve this question
5

3 Answers 3

Reset to default
7

According to Craig Williams of Cisco the reason for the email infection-rumour was another new attack that happened almost at the same time as WannaCry:

A likely point of confusion was the Jaff ransomeware, another new type of ransomware (so 2 new types in 2 days) that did spread via email, used the same executable name. It’s possible this lead some folks to the wrong conclusion. Many sites are including pictures of emails that are clearly Jaff. It’s also possible we’ve not seen everything yet but only time will tell. As we state in the blog it’s an ongoing investigation.

Improve this answer
5
  • An internal proprietary feed from a major security vendor informed me of the email vector. So true or not, at least one vendor was spreading the email vector story. I've seen nothing to confirm their research, but this suggests a possible honest mistake. Thanks :-)
    – mgjk
    May 19, 2017 at 17:08
  • I see little to no relation to this answer, so please add it as your own one, not a comment. You might also consider discussing the problem with Craig Williams directly in the thread on the blog I linked to.
    – techraf
    May 19, 2017 at 20:12
  • I think you misread my comment.
    – mgjk
    May 19, 2017 at 20:45
  • That's not uncommon to misread other person words, so do you mind explaining how? The question was about the source of the email vector theory. The fact that such theory exists is at the very root of the question itself, so I cannot see why it would require reconfirmation in the comment here. Hence I assumed it must serve a different purpose and given the context, I further assumed it: either suggests the "internal proprietary feed" might have been the source (thus I suggested another answer), or it stands in opposition to the above words (thus I suggested discussing with the author).
    – techraf
    May 19, 2017 at 21:08
  • The proprietary feed gives a clue as to why the mistake might have had legs among the tech journalists and bloggers. The feed's examples of email vectors likely being Jaff, as per your comment.
    – mgjk
    May 20, 2017 at 11:08
7

Many organizations don't have SMB directly exposed to the internet, but SMB is widely used internally by organizations.

It is believed that the initial attack vector for WannaCry was /is a malicious email. Once a single computer on a network of vulnerable computers is infected, it is then able to propagate itself to other vulnerable hosts on the network via the MS17-010 vulnerability.

Improve this answer
8
  • 1
    "it is believed" - pure speculation. Equally it is believed that there was no initial infection thorough email. Depends on who blogged.
    – techraf
    May 16, 2017 at 1:05
  • 2
    @techraf the wording was chosen carefully. There is a lot we don't know about WannaCry so far, but people think that it might be getting into networks via email, and that is why people are being told to be very careful with emails.
    – DKNUCKLES
    May 16, 2017 at 1:10
  • 1
    The belief that there was an initial email infection is a pure speculation. That's what I wrote in my comment. I also pointed out that the belief is not a prevalent one, but depends on a believer.
    – techraf
    May 16, 2017 at 2:01
  • 2
    more recent updates say email was not involved: telegraph.co.uk/technology/2017/05/15/…
    – schroeder ♦
    May 16, 2017 at 6:44
  • @techraf Even if we don't know if original infection was by email, it could be. That may be reason enough to recommend people being careful with emails.
    – Anders
    May 17, 2017 at 23:47
0

The logic is the following: SMB ports should not be open towards internet. There should be a firewall in-between. In that case, the malware will not be able to affect you directly.

But if a user downloads it and activates it, then, the malware is inside the network and will be able to spread around at will while having nothing to do with the firewall.

Improve this answer
4
  • 2
    Can a user download and activate, though? Is there any evidence of this happening? All I'm seeing are network worm activity.
    – schroeder ♦
    May 17, 2017 at 9:55
  • Yes, there are 2 executables also associated with this malware.
    – Overmind
    May 17, 2017 at 10:01
  • 1
    That is an opinion put forth as if a fact, but not backed up by references. My Adviser wouldn't allow me to put a statement like that in any of my papers. But I will upvote you if you can show what you mean.
    – SDsolar
    May 19, 2017 at 1:14
  • I did dig a lot into this. I protect a network of ~350 devices at this moment from such things. If I e-mail you mssecsvc.exe which is one of the mw/rw .exes and I even compress it a little, not even your anti-virus can detect it and anyone opening it will be instantly affected.
    – Overmind
    May 19, 2017 at 6:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.