Week 3. The WannaCry Came Back From The Dead

Over a month ago, the WannaCry ransomware attacked several hundred thousands of Windows machines around the world.   Just couple days ago, the malware stroked again.  This time it visited Honda Motor production plant in Sayama, Tokyo, and several dozen traffic lights in Australia.  WannaCry is a computer worm that uses weaknesses in the communication protocols to spread over the network.  The worm is called ransomware because, once infected the target, it encrypts data on the infected machine and ask the owner for a ransom to turn the data.

This computer worm exploited the vulnerability in the  Server Message Block (SMB) version 1.  The vulnerability allows a source remotely send fake requests to the SMB server without going through authentication.  Microsoft released the patches to correct the issues about two days after the first attack in May.  The patches applied to Windows Vista SP2 and newer.  According to Khandelwal, Honda Motor did make an effort to secure their system after the worm attack in May.  So why Honda get hit? There are three possibilities: 1. Honda is running Windows version that is older than the released patch. 2. Microsoft's patch did not stop WannaCry. 3. WannaCry is grown stronger and immune to the fix. I would guess that Honda is using older Windows version, possibly Windows XP.  Unfortunately, Windows XP was declared end-of-life.  Will Microsoft create a patch for Windows XP if the Auto Maker, Honda, has it in their production plant?  One interesting point here is that Microsoft created a patch for a similar vulnerability in the client side of the SMB.  The patch (2511455) was released in April 2011. 

If you are using Windows Vista SP2 and above, try to apply the patch if you don't want to throw couple hundreds of dollars out for nothing.  If you use the older systems, you should try to disable unnecessary file and printer sharing services.



Sources:

 Swati Khandelwal (June 22, 2017). No, WannaCry Is not Dead! Hits Honda & Traffic Light Camera System.  Retrieved from http://thehackernews.com/2017/06/honda-wannacry-attack.html.
Microsoft (March 14, 2017). Security Update for Microsoft Windows SMB Server (4013389).  Retrieved from https://technet.microsoft.com/library/security/MS17-010.

Microsoft (April 12, 2011).  Vulnerabilities in SMB Client Could Allow Remote Code Execution (2511455).  Retrieved from https://technet.microsoft.com/en-us/library/security/ms11-019.aspx.

Comments

Post a Comment

Popular posts from this blog

Week 4 - STRIDE: Spoofing

Image
On week one, I briefly mentioned STRIDE as a method for threat identification. From this week, I want to go into a little more detail on each of its Mnemonic.  First, let's talk a little more about STRIDE.  In security , there are three fundamental aspects of the asset when speaking of security.  They are Confidentiality, Integrity, and Availability, which are referred to as the CIA triad.  To protect the asset means to protect its confidentiality, integrity, and availability.  STRIDE provides six ways to identify threats that would target the three areas. Spoofing: pretend to be someone or something that has legitimate permission to access the asset.  It is one of the ways to break the confidentiality . Tampering: ways to change the integrity of the asset. Repudiation: ways to obtain proves of violation Information Disclosure: access restricted information without permission (confidentiality) Denial of Service: ca...
Read more

Week 12 - The Final Words

Finally, I get to take a week of break.   This is the busiest Term so far.   Lots of demands from work plus things keep breaking at home made it tough.   I am glad it over.   With that said, I learned much from this class. In the first four weeks, I got to understand the threat modeling process and different threat modeling tools.   In a nutshell , threat modeling is about understanding your current state of the network; find all vulnerabilities, threats, and risks; formulate action plan and priority.   The process is carried out in a systematic way .   Initially, I thought the threat modeling is a process for finding the threats.   The name sounds small, but it also covers asset identification and action planning, as I realized after the comment on my assignment.  I spent the following weeks working on a security project where I apply the threat modeling process.   The first phase in threat modeling is the asset assessmen...
Read more

Week 7 - STRIDE: Repudiation

Image
In 2000, couple individuals at Signal Lake were sued for $25 million by a man named Suni Munshani.   He alleged that Signal Lake’s officers promised him a large amount of asset.     Munshani provided an email that purportedly sent from the dependents as the proof for his allegation.   The court ordered security professional to investigate and concluded that the plaintiff altered one of the emails the dependent sent to him.   Although this does not relate to repudiation, it brings an important aspect of non-repudiation.   (memecrunch.com) Repudiation, in short, is the denial of any wrongdoing , which is the very first thing anyone would do when they get caught doing something illegal.   Professional hackers learn to cover their track very well.   Likewise, security professionals learn to track.   For the email tampering case I mentioned, the defendant would not win the lawsuit if old emails weren’t available for invest...
Read more