All Questions
42 questions
0
votes
0
answers
673
views
Why did the WannaCry ransomware kill switch check whether it was within a virtual environment in this manner?
I have been researching the Wannacry ransomware, and have seen an example of the kill switch within Ghidra. What baffles me is, why did they implement the kill switch as a web domain instead of any ...
1
vote
1
answer
378
views
Where is the AES key of ransomware stored (in the file header/trailer)?
Advanced types of Ransomware generate, usually, an AES 128 bit key (used to encrypt files, some types of ransomware use a unique AES key for each file). This key is generated on the fly. In addition, ...
- 55
2
votes
1
answer
310
views
Wannacry testing in lab - Not getting SMB scan attempts
So I booted up two windows 7 64bit sp1 versions in virtualbox and shared their network and the operating systems are vulnerable to the SMB exploit that the wannacry ransomware is using. The Issue is ...
1
vote
0
answers
171
views
How to affect VMs in a network using WannaCry?(Cuckoo Sandbox)
I have a network consisting of 2 VMs(Windows 7).
VM1:- 192.168.56.101
VM2:- 192.168.56.102
Both are connected to vboxnet0 (192.168.56.1).
I infected VM1 using WannaCry ransomware but the ...
- 111
1
vote
1
answer
525
views
What is the role of LLMNR, NBSS and NBNS protocols in WannaCry? [closed]
I know that LLMNR is the "new version" of NetBIOS and both of them are basically for resolving names to IP addresses
I also know some exploits based on them, like a MiTM attack that the attacker ...
- 410
0
votes
1
answer
174
views
Is it safe to install MS17-010 unpatched OS as guest on patched host?
For example, these are unpatched old OS.
Windows 98
Windows 98 SE
Windows ME
Windows NT 4.0
Windows 2000
Given that SMBv1 is not disabled on host but already patched.
Is the unpatched guest OS ...
- 101
4
votes
1
answer
652
views
Why was the NX bit unable to stop WannaCry?
I'm working on a presentation to give to high school computer science students where I work at as a volunteer. Part of the presentation is on local and network exploits. I am planning to talk about ...
- 43
-1
votes
1
answer
264
views
Wrong user or IP in High Sierra terminal
When reinstalling MacOS High Sierra, setting root user password I have noticed strange line dsl-201-101-1-179-sta: before my admin username user$.
I Googled and found references to WannaCry ...
MacUser
6
votes
3
answers
1k
views
Spectre and Meltdown being used in large scale attack on unpatched systems [closed]
Do we have to be worried about Spectre and Meltdown being used for a large scale attack like Wannacry? Even though the patches coming out are being deployed to a most recent systems, there will ...
- 201
5
votes
2
answers
717
views
Are we safe from infection of Bad Rabbit?
I'm doing an assessment on the potential outspread of Bad Rabbit in our organization. Our staff do not have admin privileges on their host machines. We have also blocked the IOCs. Am I safe to say ...
- 739
4
votes
1
answer
9k
views
WannaCry Source Code
Maybe this is a stupid question: Is the WannaCry source code public?
https ://github.com/svenvdz/wannacry
https: //github.com/Hackstar7/WanaCry
https: //github.com/fadyosman/WannaCrySample
I didn'...
- 41
4
votes
0
answers
336
views
What does Memory Scanning refer to in the Context of Malware Detection Wanna Cry
When reading https://www.zionsecurity.com/sites/default/files/what_to_expect_from_your_antivirus.pdf
It mentions:
It is almost impossible to protect against new malware that will use
the ...
- 53
1
vote
2
answers
2k
views
How did Wanna Cry get past Antivirus Programs
For those who had windows computers when the WannaCry virus hit, how exactly did the virus bypass antivirus programs. I have tried to read some papers about this, but I don't understand how exactly ...
- 53
0
votes
2
answers
305
views
WannaCry attack
The kill switch discovered by marcus hutchins the web security researcher, how did that kill switch actually work? ,domain name registration must have been done on the system of researcher , how did ...
- 899
2
votes
2
answers
1k
views
Can the new WannaCry affect Linux ext4 file system data from Windows?
So every now and then I switch over to my Windows 10 OS from my Linux partition. Whilst I am there, I am fully aware that I can be infected with WannaCry which will encrypt all the files on the system....
user152282
1
vote
1
answer
202
views
Can a WannaCry infection via zero day vector be blocked by an antivirus?
We know that an AV would be able to stop a WannaCry executable that can be found in an attack email/file just before double-clicking.
However would an anti-virus be able to block against a WannaCry ...
- 1,142
1
vote
1
answer
256
views
How is Malware Traced to a Specific Country? [duplicate]
Following the WannaCry malware being traced to North Korea, how is the malware traced to a specific country?
How I think this could be done:
Malware is reverse engineered to find IP addresses or ...
- 2,764
4
votes
1
answer
1k
views
How can Malware authors be determined? [duplicate]
My question is:
How can we make any conclusions about malware authors at all, when anyone could just get sample malware online, copy paste the parts they like, and add their own parts to it?
...
- 1,595
2
votes
2
answers
433
views
How to protect from wannacry on home wifi network
I am running an outdated Windows 7 and am not able to update it due to some reasons. I wanted to know how vulnerable is my Windows to WannaCry from the home wifi network connection. What would you ...
- 23
-1
votes
1
answer
882
views
WannaCry DNS abilities
I was checking sandbox and information on the killswitch link but the WannaCry does not do a DNS query. How does it call out?
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com
8
votes
2
answers
888
views
Does Wannacry spread outside its private subnet to adjacent private subnets?
Does a Wannacry-infected computer on an internal network with a private IP address attempt to spread to other privately-addressed subnets?
I have not found a definitive answer online.
Cisco says:
...
- 201
1
vote
2
answers
516
views
Is it possible to recover wannacry encrypted files through file system recovery?
As I saw wannacry encrypts files and then removes them, I thought it is possible to recover some of the original files by file system recovery using a bootable OS.
Is it possible to use a bootable ...
- 165
2
votes
2
answers
3k
views
Does Wanna Cry encrypt files on network drives?
I've dealt with ransomware threats in the past, such as LOCKY that not only encrypt data it considers user documents found on the local machine, but also on any network drive to which the user has ...
63
votes
3
answers
16k
views
What happens if you run WannaCry after installing the necessary patches?
I understand that WannaCry spreads itself by exploiting the SMBv1 vulnerability, which is fixed by patch MS17-010.
Does this mean that even with the patch installed, WannaCry can still infect the ...
- 647
2
votes
1
answer
2k
views
Effective blocking of SMB connections on AsusWRT
I recently was attacked by some cryptolocker (not sure if it's WannaCry) and now I am revising my network policies. For reaching this aim I want to disable all SMB-activity for infected PC. ...
- 304
1
vote
2
answers
283
views
Would it be possible and advisable to create a worm to patch for WannaCrypt?
WannaCrypt uses an SMB vulnerability to spread. Can we not use this vulnerability to create a similar worm, but one which patches for WannaCrypt instead of affecting it.
Our worm infects a computer ...
- 123
3
votes
2
answers
5k
views
EternalBlue exploit doesn't work against windows 8
i have tried this poc:
https://gist.github.com/worawit/074a27e90a3686506fc586249934a30e
against a windows 8 target that i own, the code exits with an error that says:
impacket.nmb.NetBIOSTimeout: ...
- 43
0
votes
2
answers
897
views
Is a insecure VM in a secure host vulnerable to wannacry?
Assume a reasonably secure windows host (latest windows updates/patches, up-to date enterprise antivirus).
How vulnerable is in this context a VM with a not up to date windows OS and an old and not ...
- 135
5
votes
1
answer
2k
views
What happens if a Dropbox folder is encrypted by WannaCrypt / WannaCry?
Does one's Dropbox "data in the cloud" also get encrypted?
2
votes
1
answer
383
views
How does WannaCrypt detect when someone pays the ransom?
It seems they are processing it manually, but how can they verify the payment? WannaCry doesn't provide a unique ransom bitcoin adress for each victim.
- 123
15
votes
4
answers
7k
views
Has anybody successfully decrypted their files after paying the WannaCrypt ransom?
WannaCrypt is a shot heard 'round the world, for sure.
I have seen news articles saying that people have paid more than $20,000 in ransoms. Here's one from Krebs: Global ‘Wana’ Ransomware Outbreak ...
- 977
2
votes
1
answer
922
views
Is WannaCry Proxy Aware?
I read the Article of WannaCry on malwaretech.com and as far I understand it works like this:
Try to connect via HTTP to www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
if it got an response then ...
- 578
2
votes
1
answer
2k
views
WannaCry - block callback IP/domain?
While new variants of Wannacry has sprung up, the old variant is still lurking around corners and I am not sure whether the following callback IPs and domains should be blocked as per typical ...
- 739
1
vote
1
answer
1k
views
How can we beef the security of our Windows Server 2012 R2 against ransomware? [duplicate]
We have a MS Windows Server 2012 installed. After the attacks of last week, I was wondering how we could improve the security of the server against ransomware/cryptoware.
We did install the latest ...
- 848
5
votes
2
answers
615
views
Does EMET prevent WannaCry exploit execution?
Based on answers to the question How is the “WannaCry” Malware spreading (...), I understand it leverages vulnerabilities present in the SMB implementation. Assuming an unpatched and otherwise ...
- 594
5
votes
1
answer
2k
views
How to reverse engineer WannaCry? [closed]
I was reading an article today about a Google researcher linking the WannaCry malware to the earlier malware Cantopee.
I had two primary questions based on the contents of the article.
What do the ...
- 153
16
votes
1
answer
21k
views
How does the EternalBlue Exploit Work?
I've casually googled for explanations on how exactly the EternalBlue exploit works but, I suppose given the media storm about WannaCry, I've only been able to find resources that at best say it's an ...
- 281
1
vote
5
answers
18k
views
Will Running MEMZ or Wanna Cry in VirtualBox Harm Host Computer?
I have read some threads talking about the safety of running malware in a VM. I found out that it may not be safe and there is still a risk. I would like to know specifically if running Wanna Cry, a ...
- 13
1
vote
1
answer
467
views
Does the WannaCry Ransomware affect VMs which are connected in Network? [closed]
I have a lot of Windows VMs, viz XP, Server 2003, Vista and 7. All of them are in Network and connected to Internet. Will they be affected by WannaCry if not patched ?
1
vote
3
answers
1k
views
What do emails have to do with the spread of WannaCrypt?
After the recent spread of WannaCrypt, there has been a lot of warnings about the dangers of emails and clicking on links in them.
But the malware is spreading as a worm using SMB to infect other ...
- 977
26
votes
3
answers
37k
views
Does WannaCry infect Linux? [duplicate]
After reading this question, now, I am wondering if WannaCry malware can infect Linux OS especially Ubuntu.
One of the answers talked about SMB2 and windows. Does it mean a Linux based computer is ...
- 279
251
votes
10
answers
83k
views
How is the "WannaCry" Malware spreading and how should users defend themselves from it?
There's a new strain of attacks which is affecting a lot of systems around the world (including the NHS in the UK and Telefonica in Spain) which is being called "WannaCry" amongst other names.
It ...
- 62.6k