The WannaCry ransomware has been in the global spotlight for the past few days after it affected more than 300,000 computers, spread across over 150 countries. It has caused a widespread panic, as no one is sure if they are vulnerable to its attack or not. The Internet is filled with information about WannaCry’s attack, but most of it is incoherent and illegible. It is tough to protect yourself from something you don’t understand. Keeping that in mind we have created a small guide which will help you understand and protect yourself against WannaCry. So, without wasting any more time, let me tell you about the 8 things you should know about WannaCry Ransomware:
WannaCry ransomware (also known as WannaCrypt, Wana Decrypt, WCry and WanaCrypt0r), as you can deduce from its name, is a type of ransomware. A ransomware is basically a digital equivalent of a kidnapper. It takes something of value to you and you are asked to pay a ransom amount to get it back. That something of value being your data and files on your computer. In the case of WannaCry, the ransomware encrypts the files on a PC and asks a ransom if the user wants the files decrypted.
WannaCry, although a type of ransomware, is not your average run of the mill ransomware. There’s a reason behind why it was able to affect such a large number of computers in such a small time frame. Normally, a ransomware requires a user to manually click on a malicious link to install itself. Hence, ransomware originally targeted only a single individual at a time.
However, WannaCry uses an exploit in the “Server Message Block” or SMB to infect the whole network. SMB is a protocol used by a network to share data, files, printers etc. across the users connected to it. Even if a single computer in the network get infected by manually clicking on a malicious link, the WannaCry ransomware will then crawl through the host’s network and infect every other computer connected to that network.
NSA (National Security Agency) is known to keep a vault full of exploits which help them to spy on people. Tech giants have been at loggerheads with the NSA to release the exploits, so they can be fixed to prevent cyber attacks, but, to no avail. Once such vault of exploits were obtained and leaked by a cyber criminal group known as the “Shadow Brokers”. The leaked vault contained a tool named “EternalBlue”, which could use the SMB exploit in Microsoft Windows to transfer files without needing user authorization.
Two different technology companies have asserted the similarity between WannaCry ransomware and an earlier ransomware in 2015 developed by hackers who go by the name of “Lazarus Group”. The group is believed to be operating out of North Korea and they are reportedly, they are even supported by the North Korean government. The group is largely known for its attack on the Sony Pictures and Entertainment in the year 2014.
Systems Vulnerable to WannaCry’s Attack
One of the reasons WannaCry attack has been so successful is because of the fragmented nature of Windows ecosystem. Many networks are still using versions of Windows, especially the likes of Windows XP and Windows Server 2003, which are outdated and no longer supported by Microsoft. Since these older versions are not supported, they do not receive software patches for the exploits discovered and are more susceptible to such attacks.
When WannaCry has successfully attacked your system, you will see a window telling you that your system has been encrypted. A link to a BitCoin wallet is at the bottom asking you to pay $300 (US) in the bitcoin currency to get access to your data. If you do not pay within 3 days, the ransom amount is doubled to $600 with a warning that after a week, the data will be deleted forever.
Even after knowing the negatives of paying the ransom, many people pay it, as they are too afraid of losing their data and hope that the extorters remain true to their word. A twitter bot has been created by Keith Collins, who is data/graphics developer at Quartz. The @actualransom Twitter bot keeps track of the ransom money.
As per the description, the bot is watching 3 wallets hard-coded into the WannaCry ransomware and tweets every time money is deposited into any of the wallets. At every two hours, it also gives the total amount deposited till now. At the time of writing, over $78,000 has been paid in ransom to hackers.
Nothing can guarantee a full-scale protection against a ransomware until and unless you as a user became vigilant. There are some basic rules here. Stop downloading software from unverified sites and keep a keen eye on all your emails. Do not open links or download files contained in an email from an unverified user. Always check the sender’s email to confirm its source.
SEE ALSO: 6 Best Anti-Ransomware Software To Protect Your Files
WannaCry has caused a huge havoc around the world and hence Windows users are naturally afraid. However, in most of the cases it’s not the platform but the user who is responsible for making such attacks successful. If users follow clean practices like installing and using latest version of the OS, installing security patches regularly and refraining from visiting malicious/shoddy websites, the risk of getting attacked by a ransomware like WannaCry is severely minimised.
