WannaCry (2017) Explained: The Ransomware That Shut Down Hospitals and What It Taught Us

On Friday 12 May 2017, screens inside English hospitals began to change. A red window took over, announcing that the files on the computer had been locked and that the way to get them back was to pay $300 in Bitcoin. A countdown ticked beneath it. If the money didn't arrive, the price would go up.

Within hours the same message was appearing in offices, factories, railway stations and phone companies in dozens of countries. It was called WannaCry, and it became the biggest ransomware outbreak the world had seen. It also became one of the clearest lessons in how a boring, avoidable failure, a missing software update, can switch off something as vital as a hospital.

A stolen tool and an unapplied patch

WannaCry didn't invent anything clever. It borrowed. The attack leaned on an exploit called EternalBlue, which targeted a flaw in the way Windows handled a file-sharing protocol known as SMB. According to widespread reporting, the exploit was developed by the US National Security Agency and then leaked online by a group calling itself the Shadow Brokers.

Here's the uncomfortable part. Microsoft had already fixed the flaw. The question was whether people had installed the fix.

It wasn't an email attack, and that's the point

This is the part that surprises people, especially on a site that spends so much time talking about email. When the outbreak began, many experts assumed it was spreading through phishing emails with a booby-trapped attachment. It's what ransomware usually does, and it's what the last big outbreak in our ILOVEYOU story did.

But analysts kept looking and couldn't find any email. Security firms concluded that WannaCry spread by itself, hunting for computers with the SMB service exposed to the network, using EternalBlue to break in, and then moving on to the next machine. Nobody had to click anything. A computer that was switched on, connected, and missing the update could simply be infected.

Researchers hedged their wording, as careful people do. But the picture that emerged was of a worm moving through networks, not an inbox. That's why it travelled so quickly: it didn't wait for anyone to be curious.

What it did to a computer

Once WannaCry had a foothold, it encrypted the user's files, scrambling documents, photos, databases and more so they couldn't be opened without a key. It then displayed its ransom note, in many languages, demanding $300 in Bitcoin, with a warning that the amount would double to $600 after about three days.

Meanwhile, the worm half of the program carried on working in the background. It scanned the local network, and random addresses on the wider internet, for any other machine it could break into. That combination, a worm bolted to ransomware, is what made it so unusually destructive. One infected computer could end up infecting a whole building.

The hospital problem

The victims were many: Telefónica in Spain, FedEx, Renault, Deutsche Bahn, and a long list of others. But it was the damage to the UK's National Health Service that dominated the headlines, because the consequences were so human.

A later report by the National Audit Office found that more than a third of NHS trusts in England were disrupted. Doctors' surgeries lost access to their systems, and five hospital emergency departments had to divert ambulances elsewhere. An estimated 19,000 appointments and operations were cancelled, though only around 6,900 were formally recorded at the time, partly because the systems that track such things were themselves affected. Staff improvised, sharing information by phone and messaging apps. The Department of Health later put the cost at about £92 million, a figure some analysts consider conservative.

Why were hospitals so exposed? Partly because they run huge numbers of specialist devices and older systems that are difficult to update without risking patient care. And partly, as the NAO bluntly concluded, because of gaps in basic security. It said the outbreak could have been avoided with basic IT security, and noted that the health service had been warned to apply the fix.

The accidental hero and the kill switch

The spread was slowed by a young British security researcher, Marcus Hutchins, who blogged under the name MalwareTech. While examining a sample of the malware that Friday, he noticed that it tried to contact a long, nonsense web address before doing anything else. That address wasn't registered to anyone.

So he registered it. And just like that, the spread of the encryption slowed dramatically. It turned out the malware was designed to check whether the address responded, and if it did, to stop. It acted as a kill switch, probably meant to help the authors detect researchers' test environments, and Hutchins had flipped it by accident. The NAO credited his work with preventing even worse damage.

Don't take that as a happy ending, though. It slowed the outbreak, but it didn't unlock a single locked computer, and some infections kept happening afterwards. It was a lucky break rather than a defence.

Who was behind it?

In December 2017, the governments of the US, UK and several allies publicly blamed North Korea, pointing to a hacking group known as Lazarus. The US later brought charges against a North Korean national over the attack. North Korea has denied involvement. As with many attributions in this field, the public evidence is the word of governments and security researchers, so it's worth keeping the phrase "according to" in mind.

Did paying the ransom work?

Reports were mixed. Payments to the attackers' Bitcoin wallets reportedly added up to a little over $100,000 for an outbreak that affected hundreds of thousands of computers, which is strikingly small. The NHS is reported not to have paid anything. And the handling of ransom requests was manual, which suggested the criminals hadn't built a polished operation. Some victims who paid said they recovered files, while in other cases people paid and got nothing. Security agencies consistently advise against paying, partly for that reason.

WannaCry in numbers

Counts of this kind come from different organisations measuring different things, so treat them as ballpark figures rather than exact totals.

What it taught us

• Install updates, quickly. The fix existed for roughly two months before the outbreak. Every organisation that applied it was safe from this attack. It's the dullest advice in security and the most effective.
• Retire software that no longer gets updates. Systems the manufacturer has stopped supporting can't be patched, so they stay exposed forever.
• Don't expose what you don't need to. File-sharing services shouldn't be reachable from the open internet, and networks work better when they're split into sections, so one infection can't wander everywhere.
• Keep offline backups. A copy that the ransomware can't reach turns a catastrophe into an inconvenience. The 3-2-1 idea, three copies on two kinds of storage with one kept elsewhere, is a good rule.
• Have a plan before you need one. Organisations that have rehearsed working without their computers are far better placed to cope when the screens go red.
• Email caution is still necessary, just not sufficient. Most ransomware still arrives through phishing, so the habits in how a disposable email protects you from phishing still apply.

For ordinary people, the takeaway is refreshingly small: switch on automatic updates for your computer and phone, and keep a backup of the files you'd hate to lose.

A patch that was already there

It's easy to turn WannaCry into a story about shadowy hackers and stolen weapons, and those parts are real. But the thing that stays with you is smaller. For about two months, the fix sat there, free and waiting, while the clock ran down. Most of the pain of that Friday was optional. That's a hard thing to read, and a helpful thing to remember the next time your computer asks to restart for an update and you tell it to come back later.

Sources

• 'Basic IT security' could have prevented UK NHS WannaCry attack - Engadget (reporting the National Audit Office findings)
• NHS and Government to Blame for WannaCry, Says NAO - Infosecurity Magazine
• WannaCry cyberattack cost British government over $120 million - The Washington Times
• WannaCry Did Not Start with a Phishing Attack, Experts Say - Solutions Review
• Massive WannaCry/Wcry Ransomware Attack Hits Various Countries - Trend Micro
• Teardown: WannaCry Ransomware - BankInfoSecurity
• WannaCry Ransomware Campaign Exploiting SMB Vulnerability - CERT-EU advisory