Thai lecturer writes programme to block ‘WannaCry’

[webfact]

Thai lecturer writes programme to block ‘WannaCry’

BY THE NATION 

 

 

BANGKOK: -- A Thai lecturer has successfully written a programme to block the global ransomware bug dubbed “WannaCry”.

 

Chanwit Kaewkasi, a lecturer at the Computer Engineering Department at Suranaree University of Technology in Nakhon Ratchasima province, on Monday demonstrated the Block Wannacry program, which was developed by university lecturers to protect computers from the malware.

 

The program – now available for free download – has seen more than 1 million visits to the host webpage and tens of thousands of downloads.

 

Full story: http://tech.thaivisa.com/thai-lecturer-writes-programme-to-block-wannacry/21667/

 

-- © Copyright Thai Tech 2017-05-16

[ukrules]

What exactly is it doing on a technical level ? Maybe it's disabling the SMBv1 service in the correct way depending on the OS version ?

[chrisinth]

4 hours ago, ukrules said:

What exactly is it doing on a technical level ? Maybe it's disabling the SMBv1 service in the correct way depending on the OS version ?

As far as I am aware, the disabling of the SMB services will not stop the computer being infected if the user opens an attachment or clicks on a link in email activating the trojan Wannacry (and variations) on that machine. Disabling SMB will stop it spreading throughout the network.

 

May be wrong in my assumptions though.......................

[Srikcir]

4 hours ago, chrisinth said:

As far as I am aware, the disabling of the SMB services will not stop the computer being infected if the user opens an attachment or clicks on a link in email activating the trojan Wannacry (and variations) on that machine. Disabling SMB will stop it spreading throughout the network.

 

May be wrong in my assumptions though.......................

Maybe this is relevant:

"When executed, the malware first checks for a specifically generated kill switch domain . If it is not found, then the ransomware will begin to encrypt data on the computer.  WannaCry has a second stage that attempts to exploit the SMB vulnerability MS17-010 to spread out to random computers on the Internet, and laterally to computers within an organization."

https://community.rsa.com/community/products/netwitness/blog/2017/05/15/blocking-wannacry-with-netwitness-endpoint

Wannacry was stopped when a cybersecurity researcher appears discovered a “kill switch” that can prevent the spread of the WannaCry ransomware by simply registering the domain name.

http://www.deccanchronicle.com/technology/in-other-news/140517/accidental-hero-finds-kill-switch.html

[chrisinth]

3 minutes ago, Srikcir said:

Maybe this is relevant:

"When executed, the malware first checks for a specifically generated kill switch domain . If it is not found, then the ransomware will begin to encrypt data on the computer.  WannaCry has a second stage that attempts to exploit the SMB vulnerability MS17-010 to spread out to random computers on the Internet, and laterally to computers within an organization."

https://community.rsa.com/community/products/netwitness/blog/2017/05/15/blocking-wannacry-with-netwitness-endpoint

Wannacry was stopped when a cybersecurity researcher appears discovered a “kill switch” that can prevent the spread of the WannaCry ransomware by simply registering the domain name.

http://www.deccanchronicle.com/technology/in-other-news/140517/accidental-hero-finds-kill-switch.html

That's about what I understand. There have been variants found that do not have the kill-switch (necessity to talk-home to the URL before activating).

 

But going back to what I speculate; it is a two step trojan, first stage encrypting data on the affected computer and stage two trying to spread through the network through SBM vulnerability and perhaps other methods as well.

 

As bad as these viruses are, it should always be remembered that they are activated through human interaction, ie. they need physical input by the user and this is achieved, in most cases, either opening an attachment that hasn't been verified or clicking on a link to a phishing site and activating from there.

 

Stay safe out there..........................

[ukrules]

7 hours ago, chrisinth said:

As far as I am aware, the disabling of the SMB services will not stop the computer being infected if the user opens an attachment or clicks on a link in email activating the trojan Wannacry (and variations) on that machine. Disabling SMB will stop it spreading throughout the network.

 

May be wrong in my assumptions though.......................

You are correct, this variant spreads through SMBv1, there's 1000's of other things which spread through manual clicks, this is why I never click anything that comes in via email. Occasionally I will view a PDF in a virtual machine but that's a rare day.