For those who had windows computers when the WannaCry virus hit, how exactly did the virus bypass antivirus programs. I have tried to read some papers about this, but I don't understand how exactly that windows hole helped the virus evade antivirus software. Is this just a matter of people not having antivirus software, or did this virus somehow evade that?
The problem with "traditional anti-virus" is that they do not detect exploits or in memory malware which was the case of Wanancry. The SMB "hole" as you described it, was used -via EternelBlue (the exploit)- to execute remotely and in memory the piece of malware. This means:
It is almost impossible to protect against new malware that will use the EternalBlue exploit to propagate except when using next-generation endpoint protection with memory scanning capabilities and exploit detection. Traditional anti-virus without premium features or configured by default will not block the EternalBlue exploit.
Herer is a typical Wanancry execution flow:
Antivirus software usually detect malware threats in two ways:
- signature-based detection
- heuristic detection
Antivirus software products did not have a virus definition or signature for WannaCry since it had not been seen before (previously undetected threat) being a newly created malware. So it escaped all signature based detection.
Heuristic detection relies upon observing active execution of a binary. For example, if an antivirus observes a virus scanning for and modifying or appending executables on a system, it would flag the binary as possible malware or suspicious. The way WannaCry works is by accessing specific crypto libraries on Windows (for the process of generating keys and subsequent encryption) and then scanning for common document file types such as DOCX, XLSX, JPG etc to encrypt. The antivirus heuristics engine fails to detect this as a typical malware infection. They will possibly add heuristic capabilities to stop ransomware as it is executing by observing its behavior some time in the near future. For example: https://www.wired.com/story/shieldfs-ransomware-protection-tool/
Also, as you mentioned, it is possible that a lot of users who got hit were not using a properly updated and effective Antivirus solution. If they were big on updating software, they would have updated their Windows OS and had a patch for MS17-010 Eternal Blue vulnerability.