How did Marcus Hutchins stop Wantcry?

Summary of the Article: WannaCry Ransomware Attack

Computer users became victims of the WannaCry attack because they had not updated their Microsoft Windows operating system. Had they updated their operating systems regularly, they would have benefited from the security patch that Microsoft released before the attack.

WannaCry versions 0, 1, and 2 were created using Microsoft Visual C++ 6.0. EternalBlue is an exploit of Microsoft’s implementation of their Server Message Block (SMB) protocol released by The Shadow Brokers.

WannaCry spread by using a vulnerability exploit called “EternalBlue.” The US National Security Agency (NSA) had developed this exploit, presumably for their own use, but it was stolen and released to the public by a group called the Shadow Brokers after the NSA was itself compromised.

The WannaCry ransomware is a worm that spreads by exploiting vulnerabilities in the Windows operating system (OS). WannaCry, also known as WannaCrypt, WannaCryptor, and Wanna Decryptor, spreads using EternalBlue, an exploit leaked from the National Security Agency (NSA).

The security firm Symantec believed that the code behind this malware might have a North Korean origin. They fingered the Lazarus Group as the culprits behind WannaCry, a hacking group that has been tied to North Korea.

The original global WannaCry infection could have been prevented if companies and individuals had updated their Windows software. The exploit that allowed WannaCry to propagate had been patched by Microsoft two months earlier.

One of the key features of WannaCry is its ability to spread quickly through a network by taking advantage of vulnerabilities in the Server Message Block (SMB) protocol. This allowed it to quickly infect large numbers of computers, making it particularly devastating.

The United States officially blames North Korea for the WannaCry attack, and it even indicted three North Koreans for the malware and the 2014 Sony Pictures Entertainment hack.

The ransomware spread was finally stopped after a web security researcher accidentally found its ‘kill switch.’

Marcus Hutchins, also known online as MalwareTech, is a British computer security researcher known for stopping the WannaCry ransomware attack.

WannaCry spreads via a flaw in the Microsoft Windows implementation of the Server Message Block (SMB) protocol.

Hutchins’ work, as MalwareTech, to stop WannaCry, was highly praised, but this led to the press figuring out his identity and revealing his real name.

Questions:

1. What was the major vulnerability in the WannaCry attack?

Computer users became victims of the WannaCry attack because they had not updated their Microsoft Windows operating system. Had they updated their operating systems regularly, they would have benefited from the security patch that Microsoft released before the attack.

2. What programming language was WannaCry written in?

WannaCry versions 0, 1, and 2 were created using Microsoft Visual C++ 6.0. EternalBlue is an exploit of Microsoft’s implementation of their Server Message Block (SMB) protocol released by The Shadow Brokers.

3. How did the WannaCry ransomware attack spread?

WannaCry spread by using a vulnerability exploit called “EternalBlue.” The US National Security Agency (NSA) had developed this exploit, presumably for their own use, but it was stolen and released to the public by a group called the Shadow Brokers after the NSA was itself compromised.

4. What is the WannaCry virus?

The WannaCry ransomware is a worm that spreads by exploiting vulnerabilities in the Windows operating system (OS). WannaCry, also known as WannaCrypt, WannaCryptor, and Wanna Decryptor, spreads using EternalBlue, an exploit leaked from the National Security Agency (NSA).

5. Who caused the WannaCry attack?

The security firm Symantec believed that the code behind this malware might have a North Korean origin. They fingered the Lazarus Group as the culprits behind WannaCry, a hacking group that has been tied to North Korea.

6. Was the WannaCry attack preventable?

The original global WannaCry infection could have been prevented if companies and individuals had updated their Windows software. The exploit that allowed WannaCry to propagate had been patched by Microsoft two months earlier.

7. Why was WannaCry so successful?

One of the key features of WannaCry is its ability to spread quickly through a network by taking advantage of vulnerabilities in the Server Message Block (SMB) protocol. This allowed it to quickly infect large numbers of computers, making it particularly devastating.

8. Who created WannaCry and why?

The United States officially blames North Korea for the WannaCry attack, and it even indicted three North Koreans for the malware and the 2014 Sony Pictures Entertainment hack.

9. What was the conclusion of the WannaCry ransomware attack?

The ransomware spread was finally stopped after a web security researcher accidentally found its ‘kill switch.’

10. Who killed WannaCry?

Marcus Hutchins, also known online as MalwareTech, is a British computer security researcher known for stopping the WannaCry ransomware attack.

11. How did the WannaCry virus start?

WannaCry spreads via a flaw in the Microsoft Windows implementation of the Server Message Block (SMB) protocol.

12. Who was the man who stopped WannaCry?

Hutchins’ work, as MalwareTech, to stop WannaCry, was highly praised, but this led to the press figuring out his identity and revealing his real name.