Dahsyatnya Serangan Siber Virus Malware Wannacry

CNN Indonesia

15 May 201707:12

Summary

TLDRThe W Cry ransomware attack, a massive cyber threat, has impacted over 200,000 computers across 150 countries, including Indonesia. It encrypts files, rendering them inaccessible without a decryption key, for which hackers demand a ransom. The malware exploited a vulnerability in Microsoft Windows, including versions 7 and 8, despite a security patch being available. Notable victims include large corporations like FedEx and Nissan, and even critical infrastructures like Russia's central bank. The attack underscores the importance of updating software and security measures. A 22-year-old British researcher discovered a method to halt the W Cry attack, emphasizing the need for vigilance and proactive security practices.

Takeaways

🔒 The W Cry ransomware has attacked 150 countries and infected 200,000 computers, including those in Indonesia.
💡 W Cry encrypts files on infected computers, making them inaccessible to their owners.
💸 Hackers initially demand a ransom of $300 or around 4 million Indonesian Rupiah to decrypt the files.
📈 The ransom demands have been escalating, with some reports suggesting amounts up to $300,000.
🏥 Hospitals are among the victims, with some paying large sums to regain access to their files.
🖥 W Cry exploits vulnerabilities in Microsoft Windows, including Windows 7 and Windows 8.
📅 The attack emerged in April 2017, coinciding with the release of a security update by Microsoft in March that many did not install.
🍎 W Cry does not target Apple products or operating systems.
🌍 The mastermind behind the W Cry attacks remains unknown, but it is estimated that over $50 million has been collected from the ransomware spread.
🇷🇺 Russia is the country most heavily affected by W Cry, with over 20% of its population not updating Microsoft software, making them vulnerable.
🏢 Major global companies like FedEx, Nissan, Telefónica, and Deutsche Bahn have been infected, demonstrating the hackers' ability to penetrate high-security systems.

Q & A

WannaCry ransomware攻击是如何在全球范围内传播的？
-WannaCry ransomware利用了被称为EternalBlue的漏洞，这是一个针对Windows操作系统的SMBv2漏洞。这个漏洞是由一个名为Shadow Brokers的黑客组织公开的，而微软在2017年3月通过MS17-010安全补丁修复了这个漏洞。WannaCry通过这个漏洞自动在未打补丁的计算机和网络之间传播，无需用户交互。一旦一台计算机被感染，它就可以通过网络发送SMB请求，感染同一网络中的其他计算机。
WannaCry攻击对哪些行业造成了影响？
-WannaCry攻击影响了多个行业，包括医疗保健、制造业、能源（石油和天然气）、技术、食品和饮料、教育、媒体和通信以及政府机构。特别是医疗保健行业受到了严重打击，例如英国国家卫生服务系统（NHS）的数百家诊所和医院遭受了大规模的服务中断，导致手术和X光检查被推迟或取消。
WannaCry攻击对英国国家卫生服务系统（NHS）造成了哪些具体影响？
-WannaCry攻击导致英国NHS的数百家诊所和医院遭受服务中断，手术和X光检查被迫推迟或取消。据估计，这次攻击导致约19,000个预约被取消，给NHS造成了高达9200万英镑的损失。
WannaCry攻击是如何被阻止的？
-WannaCry攻击被一位名为MalwareTech的22岁英国安全研究员阻止。他发现了一个所谓的“kill switch”，这是一个域名，当WannaCry尝试连接到这个域名时，它会停止传播。这位研究员通过注册这个域名，无意中激活了这个kill switch，从而减缓了攻击的传播。
WannaCry攻击是否仍然构成威胁？
-尽管WannaCry攻击在2017年被阻止，但这种类型的勒索软件仍然存在。由于许多组织和个人可能没有及时更新他们的操作系统或打补丁，因此仍然存在被WannaCry或其他利用相同漏洞的恶意软件感染的风险。因此，保持系统更新和采取适当的安全措施仍然至关重要。
个人和组织应如何保护自己免受WannaCry等勒索软件的攻击？
-个人和组织应采取以下措施来保护自己免受WannaCry等勒索软件的攻击：1. 定期更新软件和操作系统；2. 使用能够检测和阻止勒索软件威胁的网络安全软件；3. 频繁备份数据，并确保备份与主系统隔离；4. 修补系统漏洞，定期检查安全更新；5. 对于勒索软件威胁载体（如钓鱼邮件）保持警惕；6. 设置复杂的密码并定期更改；7. 使用双因素认证保护系统和重要账户。
WannaCry攻击在全球范围内造成了多大的经济损失？
-WannaCry攻击对全球造成了巨大的经济损失。据估计，这次网络犯罪在全球范围内造成了约40亿美元的损失。
WannaCry勒索软件是如何加密用户文件的？
-WannaCry勒索软件通过利用Windows操作系统中的漏洞，自动传播并感染计算机。一旦计算机被感染，WannaCry会加密用户的文件，并要求支付比特币作为赎金以解密这些文件。如果受害者在三天内不支付赎金，WannaCry会威胁永久删除这些文件。
WannaCry攻击是否针对特定国家或行业？
-WannaCry攻击并没有针对特定国家或行业。它利用了广泛的Windows操作系统漏洞，影响了全球范围内的多个行业和组织，包括医疗保健、制造业、能源、技术、食品和饮料、教育、媒体和通信以及政府机构。

Outlines

00:00

🛡️ Global Impact of WannaCry Virus Attack

WannaCry ransomware, according to Europol, has spread to 150 countries, infecting 200,000 computers worldwide, including in Indonesia. Major companies were affected by this massive cyberattack, which encrypted all infected files and demanded a ransom of $300 (around 4 million IDR) to unlock them. Some victims, such as hospitals, reported higher ransom demands, up to $300,000. WannaCry exploited a vulnerability in Microsoft Windows, particularly in systems not updated with a March 2017 security patch. Though Apple devices were not targeted, the perpetrators behind the attack remain unidentified, with experts suggesting they might be amateurs. The ransomware amassed more than $50,000 from its victims globally, with Russia being hit the hardest due to outdated and pirated software usage.

05:01

🔓 Major Global Companies Hit by WannaCry

Several major global corporations were hit by the WannaCry virus, including FedEx, Nissan, Telefonica (Spain’s largest telecom company), and Deutsche Bahn (Europe's largest travel company). In Russia, even the Central Bank was affected, along with the country's second-largest telecom operator, Megafon. A 22-year-old British security researcher eventually found a way to stop the attack, suggesting the attackers were amateurs. To prevent future attacks, users were advised to disable the Server Message Block service, apply Microsoft security patches, back up data externally, update their Windows systems regularly, and use trusted security software.

Mindmap

Keywords

💡WannaCry Ransomware

WannaCry Ransomware is a notorious strain of malware that encrypts files on an infected computer's hard drive, rendering them inaccessible to the user. It then demands a ransom payment in Bitcoin to decrypt the files. This ransomware made headlines in May 2017 for its rapid global spread, affecting organizations across various sectors including healthcare, leading to significant disruptions. It is known for exploiting a Windows vulnerability, suggesting potential links to the Lazarus Group, which may have connections to the North Korean government. The WannaCry outbreak underscores the importance of timely security updates and robust cybersecurity measures to prevent such attacks.

💡EternalBlue Exploit

The EternalBlue exploit is a hacking tool that takes advantage of a vulnerability in the Microsoft Windows implementation of the Server Message Block (SMB) protocol. This exploit allows an attacker to execute arbitrary code on a target computer, which WannaCry Ransomware utilized to spread rapidly across networks. The exploit was believed to have been developed by the U.S. National Security Agency and later leaked by the Shadow Brokers group. The use of EternalBlue in the WannaCry attack highlights the dangers of such exploits falling into the wrong hands and the critical need for organizations to patch known vulnerabilities.

💡Ransomware Propagation

Ransomware propagation refers to the ability of ransomware like WannaCry to spread across networks and infect multiple systems without user interaction. WannaCry's worm-like behavior enabled it to exploit the EternalBlue vulnerability and infect connected systems, making it particularly destructive. This highlights the importance of network segmentation and robust security measures to contain the spread of such threats.

💡Cryptocurrency Ransom

Cryptocurrency, specifically Bitcoin, was the preferred method of payment demanded by WannaCry attackers. The use of cryptocurrency in ransomware attacks is common due to its pseudo-anonymous nature, which makes it difficult to trace transactions and identify the perpetrators. The ransom demand in the WannaCry case was initially around $300, with threats of increasing the amount if not paid promptly. This method of payment allows attackers to operate with a degree of anonymity and is a significant challenge for law enforcement and cybersecurity experts.

💡Kill Switch

A kill switch in the context of malware like WannaCry is a mechanism that can halt the spread or functionality of the malware. In WannaCry's case, it was a hard-coded URL that, if accessible, would cause the ransomware to shut down. The discovery and activation of such a switch by security researcher Marcus Hutchins played a crucial role in stopping the WannaCry outbreak. The existence of a kill switch in WannaCry indicates a level of control that the attackers could have used to manage the spread of the ransomware.

💡Patching

Patching refers to the application of software updates that fix security vulnerabilities in systems. In the case of WannaCry, many of the affected systems were running outdated versions of Windows that had not been patched to address the SMB vulnerability exploited by EternalBlue. Patching is a fundamental cybersecurity practice that, when neglected, can leave systems exposed to threats like WannaCry.

💡Server Message Block (SMB)

Server Message Block (SMB) is a network protocol that enables communication and sharing of files, printers, and other resources on a network. The WannaCry ransomware exploited a flaw in Microsoft's implementation of SMB, allowing it to spread rapidly across networks. Understanding SMB and its role in network operations is essential for IT professionals to secure networks against threats that target such protocols.

💡Network Segmentation

Network segmentation is a security strategy that divides a network into separate sections or segments, typically to improve security and prevent the spread of malware. In the context of WannaCry, effective network segmentation could have limited the ransomware's ability to propagate within an organization's network, reducing the overall impact of the attack. This strategy is crucial for containing threats and minimizing damage in the event of a security breach.

💡Security Patches

Security patches are updates released by software vendors to address vulnerabilities in their products. In the case of WannaCry, Microsoft had released a security patch (MS17-010) prior to the outbreak to fix the SMB vulnerability exploited by the ransomware. The importance of promptly applying security patches cannot be overstated, as they are designed to protect systems from known threats and can prevent widespread attacks like WannaCry.

💡Lazarus Group

The Lazarus Group is a cybercrime organization that has been tentatively linked to the WannaCry ransomware attack. This group is believed to be connected to the North Korean government and has been associated with various high-profile cyberattacks. The potential involvement of the Lazarus Group in WannaCry underscores the sophistication and potential state sponsorship of certain cyber threats, highlighting the need for vigilance and robust defense mechanisms against such actors.

Highlights

Europol reports that the W Cry malware has attacked 150 countries and infected 200,000 computers, including in Indonesia.

Large companies are not exempt from the W Cry ransomware attack.

The W Cry virus locks all files on infected computers, rendering them inaccessible to their owners.

Hackers initially demand $300 or about 4 million IDR to unlock the infected files.

Ransom demands are increasing, with some reports suggesting they can go up to $300,000.

Hospitals are also targeted, with some paying as much as $300,000 to regain access to their files.

The W Cry virus exploits vulnerabilities in Microsoft Windows, including Windows 7 and Windows 8.

The attack emerged in April 2017, coinciding with the leak of surveillance tools from the US National Security Agency.

Microsoft had released a security update in March, but many did not update their systems, leaving them vulnerable.

The W Cry attack is not targeting Apple products or operating systems.

The mastermind behind the W Cry attacks is still unknown, but it is estimated that they have collected over $50 million or nearly 700 million IDR.

The virus has spread to 150 countries, infecting more than 200,000 computers, including in Indonesia.

Russia is the country most affected by the W Cry virus, with over 20% of its population not updating Microsoft software.

Even large companies with high-security systems have been breached by the W Cry virus.

FedEx, a logistics company operating in 220 countries, has been affected by the W Cry virus.

Nissan, the sixth-largest car manufacturer from Japan, was also attacked by hackers.

Telefonica, the largest private telecommunications company in the world, and Deutsche Bahn, the largest online travel company in Europe, were also hit by the virus.

Three major Russian companies were affected, including the Central Bank of Russia and the second-largest telecommunications operator, Megafon.

A 22-year-old British security researcher has found a way to stop the W Cry ransomware attack.

To prevent W Cry, one should turn off the Server Message Block service, update Microsoft patches, back up data on external hard drives, and use trusted security software.