Friday’s unprecedented ransomware attack may have stopped spreading to new machines—at least briefly—thanks to a “kill switch” that a security researcher has activated.
The ransomware, called Wana Decryptor or WannaCry, has been found infecting machines across the globe. It works by exploiting a Windows vulnerability that the U.S. National Security Agency may have used for spying.
The malware encrypts data on a PC and shows users a note demanding $300 in bitcoin to have their data decrypted. Images of the ransom note have been circulating on Twitter. Security experts have detected tens of thousands of attacks, apparently spreading over LANs and the internet like a computer worm.
However, the ransomware also contains a kill switch that may have backfired on its developers, according to security researchers.
Wana Decryptor infects systems through a malicious program that first tries to connect to an unregistered web domain. The kill switch appears to work like this: If the malicious program can’t connect to the domain, it’ll proceed with the infection. If the connection succeeds, the program will stop the attack.
A security researcher who goes by the name MalwareTech found that he could activate the kill switch by registering the web domain and posting a page on it.
MalwareTech’s original intention was to track the ransomware’s spread through the domain it was contacting. “It came to light that a side effect of us registering the domain stopped the spread of the infection,” he said in an email.
Michael Kan The Wanna Decryptor ransomware’s ransom note.
Security firm Malwarebytes and Cisco’s Talos security group reported the same findings and said new ransomware infections appear to have slowed since the kill switch was activated.
However, Malwarebytes researcher Jerome Segura said it’s too early to tell whether the kill switch will stop the Wana Decryptor attack for good. He warned that other versions of the same ransomware strain may be out there that have fixed the kill-switch problem or are configured to contact another web domain.
Unfortunately, computers already infected with Wana Decryptor will remain infected, he said.
Some researchers originally believed that Friday’s ransomware attack first spread through a massive email phishing campaign. That no longer appears to be the case.
The Wana Decryptor itself is no different from other typical ransomware strains. Once it infects the PC, it’ll encrypt all the files on the machine, and then demand the victim pay a ransom to free them.
But unlike other ransomware, Wana Decryptor has been built to spread quickly. It does so by incorporating a hacking tool that security researchers suspect came from the NSA and was leaked online last month.
The hacking tool, dubbed EternalBlue, can make it easy to hijack unpatched older Windows machines. Once Wana Decryptor has infected the first machine, it’ll attempt to spread to other machines on the same local network. Then it will scan the internet for vulnerable machines.
“It creates a snowball-like effect,” Segura said. “A few machines will be infected, then it’ll try to contact more.”
Security firm Avast said it had detected more than 75,000 attacks in 99 countries, with Russia, Ukraine and Taiwan among the hardest-hit countries. The U.K.’s National Health Service was one of the biggest organizations hit by the ransomware.
The ransomware was designed to work in numerous languages, including English, Chinese and Spanish, with ransom notes in each.
Segura advised victims not to pay the ransom because it encourages the hackers. Instead, he says they should wait for next few days as security researchers study the ransomware’s coding and try to come up with free ways to solve the infection.
On Friday, Microsoft said users will be protected from the ransomware if they’re running the company’s free antivirus software or have installed the latest patches.
This story’s original 11th paragraph has been changed to discount first reports that the ransomware was spread through a phishing email campaign. The original 12th paragraph is deleted.