Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.



// // //
10:05 AM
Simon Marshall
Simon Marshall
Simon Marshall

Kaspersky Names WannaCry 'Vulnerability of the Year'

Of all the breaches, malware and ransomware that security researchers saw this year, WannaCry had the greatest effect, according to Kaspersky Labs.

When looking back at the 2017 threat landscape, what event had the most impact? In a troublesome 12-month retrospective, Kaspersky Lab reckons WannaCry -- indirectly aided by the US National Security Agency -- was the baddest boy on the security block.

Described by Kaspersky as the "vulnerability of the year," about 400,000 computers in 150 countries were affected in May. This massive attack could have been much bigger if it wasn't for the intervention of a 22-year old security researcher in England, who discovered a killswitch -- which the hackers themselves had built -- that temporarily disabled the ransomware worm. (See WannaCry Was an Avoidable Mess for NHS.)

In the end, fundamental technical errors were made by the hackers which further limited its spread, and reportedly only 0.07% of victims paid the ransom, leaving the beneficiaries with chump change versus the "ask" of $300 per computer -- a potential $120 million total -- that could have been netted.

WannaCry notably affected the British National Health Service, shipping giant Maersk, Telefonica, FedEx and several financial institutions. The total cost of such widespread disruption has been tabbed from hundreds of millions of dollars to $4 billion.

Observers have speculated why the hackers appeared to have launched such an amateurish attack; the killswitch was discoverable, and remarkably, there was no automated ransomware response, so decryption of data on computers where the ransom was paid had to be done manually.

(Source: Wikipedia)
(Source: Wikipedia)

This calls into question the ability of the hackers to effectively track and exploit ransoms that had not been paid.

It now emerges that, according to Kaspersky, the ransomware was an experiment that got out of hand. "It ran out of control before the authors had chance to implement the proper payment mechanism," said Costin Raiu, researcher at Kaspersky Lab security hunt and analysis team.

WannaCry was spread using EternalBlue -- described by Kaspersky as a "galactic level" vulnerability, which exploits Microsoft's Server Message Block (SMB). SMB is an application-layer networking protocol used for offering shared data access to network nodes.

It's widely believed that EternalBlue was developed by the NSA, and then leaked by The Shadow Brokers hacker group for all to use. At the time, Microsoftcriticized the US government for "stockpiling" -- collecting and retaining -- vulnerabilities, crippling the software leader's ability to release timely patches.

WannaCry 2.0 was eventually linked to activity from the Lazarus Advanced Persistent Threat (APT) group, noted as the 2014 attacker of Sony, after research that showed links between previous samples of code, according to Kasperky.

After further investigation WannaCry 1.0, a less-evolved ancestor, was discovered. It contained the ransomware but was not at that point working in concert with EternalBlue, and was only using a basic spear phishing attack to propagate.

Often enough, unsophisticated attacks are the ones yielding results.

"[Hackers] don't want to burn a sophisticated capability, or use it when it's not really necessary," said Vicente Diaz, also a researcher at Kaspersky Lab. Examples from Diaz include the continuing use of macros to deliver payloads, as well as abuse of Microsoft's DDE application data and memory-sharing feature in Word, Excel and Outlook.

DDE was commonly used during 2017 to launch spear phishing attacks, suggesting that enterprises are still not able to police desktop and mobile users effectively.

"Since September, DDE has been used by every big actor we know," said Diaz.

Lazarus is recognized as a specialist in cyber espionage and cyber sabotage, and its work includes developing backdoors, DoS, infiltration, data exfiltration and wiping attacks. Kaspersky warned of a subset of Lararus called BlueNoroff, which focuses entirely on financial exploitation, and is considered by Kaspersky as one of the biggest threats to banks right now.

"Even though financial (gains) have not always been the main focus of APT groups, we are seeing that (this idea) is somehow wrong, because we have seen many financial, APT-like attacks," said Diaz.

APTs are different to one-off, hit-and-run attacks, enabling hackers to hang out on financial networks unobserved, exploiting them over longer periods of time.

"BlueNoroff is one of the most active organizations we have seen this year," said Diaz.

The hacker group specializes in money theft, as well as cryptocurrency fraud. In January, it launched a notable "watering hole" attack aimed at banking institutions in Poland and Mexico. Later in the year, it returned again to target financial organizations in Taiwan and also the central bank of Bangladesh.

"They're not limiting themselves to targeting traditional financial institutions, they've also been targeting Bitcoin exchanges … and this trend is very worrisome because [attackers] don't need to use anything very sophisticated to be successful," said Diaz.

"[These attacks] are very difficult to detect, and attackers will use any method they can find to get inside of a financial institution. They've been very successful and they're giving a hard time to many security teams," said Diaz.

Typical BlueNoroff attack tools include fileless malware, open source artifacts, pentesting and admin tool abuse.

Sometimes an attacker is targeting a financial organization, but they're not looking to steal money. Kaspersky highlighted the activity of the Shadow Brokers group in compromising one of the Middle East's main SWIFT bureaus. The group went undetected for several years, effectively spying on financial operations and financial activity of customers, gaining widespread knowledge from interactions with many institutions, rather than targeting and hitting only one.

"They weren't interested in the money, they were interested in the financial movements within the network," said Diaz.

Related posts:

— Simon Marshall, Technology Journalist, special to Security Now

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
Developing and Testing an Effective Breach Response Plan
Whether or not a data breach is a disaster for the organization depends on the security team's response and that is based on how the team developed a breach response plan beforehand and if it was thoroughly tested. Inside this report, experts share how to: -understand the technical environment, -determine what types of incidents would trigger the plan, -know which stakeholders need to be notified and how to do so, -develop steps to contain the breach, collect evidence, and initiate recovery.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2022-12-05
Missing authorization vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to alter the product settings without authentication by sending a specially crafted request. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASK...
PUBLISHED: 2022-12-05
Stored cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers allows a remote authenticated attacker with an administrative privilege to inject arbitrary script. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKa...
PUBLISHED: 2022-12-05
OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to obtain appkey of the product and execute an arbitrary OS command on the product.
PUBLISHED: 2022-12-05
Plaintext storage of a password vulnerability exists in +F FS040U software versions v2.3.4 and earlier, which may allow an attacker to obtain the login password of +F FS040U and log in to the management console.
PUBLISHED: 2022-12-05
Cross-site request forgery (CSRF) vulnerability in +F FS040U software versions v2.3.4 and earlier, +F FS020W software versions v4.0.0 and earlier, +F FS030W software versions v3.3.5 and earlier, and +F FS040W software versions v1.4.1 and earlier allows an adjacent attacker to hijack the authenticati...