WannaCrypt uses an SMB vulnerability to spread. Can we not use this vulnerability to create a similar worm, but one which patches for WannaCrypt instead of affecting it.
- Our worm infects a computer on network using the same vulnerability.
- And then spreads itself to other computers on the network.
- Then patches the infected computer.
Ignoring potential legal issues, is this advised?
To make sure our worm doesn't go out of control, we can rate limit it or ask it to stop by validating a domain (similar to WannaCry).
The aim is not to reverse the damage done, but to protect unpatched PCs from being infected by WannaCry.
Is this method even advisable? Not just against WannaCrypt but against any other similar but worms.