{"id":3220,"date":"2017-05-16T00:00:00","date_gmt":"2017-05-16T00:00:00","guid":{"rendered":"http:\/\/otava.test\/breaking-down-the-wannacry-ransomware-attack\/"},"modified":"2025-05-28T20:44:27","modified_gmt":"2025-05-28T20:44:27","slug":"breaking-down-the-wannacry-ransomware-attack","status":"publish","type":"post","link":"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/","title":{"rendered":"Breaking down the WannaCry ransomware attack"},"content":{"rendered":"\n

Companies across the globe are still reeling and recovering from the global ransomware attack<\/a> known as WannaCry on Friday, which took down tens of thousands of machines in 150 countries, including Britain’s National Health System. How and why did this happen?<\/p>\n\n\n\n

We’ve talked at length about ransomware<\/a> and how it’s distributed, how it particularly affects healthcare<\/a>, and the rise of ransomware as a service<\/a>. Friday’s attack was unusual in how quickly the infection spread, but it also reminded us of an age-old life lesson: It’s really important to keep your systems patched and up to date.<\/p>\n\n\n\n

<\/span>Prevention is the best cure<\/span><\/h2>\n\n\n\n

The security world has been saying it for years, but now it has another true-to-life case in point: Update your machine when it tells you to. The attack on Friday took advantage of a zero-day vulnerability in all Microsoft systems before Windows 10. Microsoft had released a patch for it back in March (even issuing a rare patch for the now-unsupported Windows XP systems), but most people treat system updates the way they treat pre-cancer screenings: “I’m fine now, so why should I worry about it?”<\/p>\n\n\n\n

Well, just like you don’t want cancer when you’re older, you don’t want ransomware, either. Company-issued patches often address security vulnerabilities and keep your system better protected against ransomware and other malicious activity. For personal computers it’s a matter of dedicating the few minutes it takes to install the patch(es) and reboot. For enterprise, it’s a different story. It’s not only the time it takes to install patches on potentially hundreds of machines, but there are software compatibility and patch priority issues as well, which can turn a simple update into a much more complicated mess. It’s for these reasons that many enterprises are slow to patch their systems, and this unfortunately leaves them as prime targets for malicious actors to take advantage of.<\/p>\n\n\n\n

<\/span>How does WannaCry work?<\/span><\/h2>\n\n\n\n

WannaCry (and now new variants) are exploiting a vulnerability in Windows known as SMBv1 and SMBv2. SMB, known as Server Message Block<\/a>, is a networking component of Windows that’s mainly used for providing shared access to\u00a0files, printers and miscellaneous communications between nodes on a network. Security researchers believe that is how the infection has been able to spread so quickly–much more quickly than anticipated.<\/p>\n\n\n\n

<\/span>Why ransom payments are low<\/span><\/h2>\n\n\n\n

You might have noticed that while the WannaCry attack from Friday hit thousands and thousands of computers, the total ransom collected so far<\/a> is less than $100,000. That’s pretty low by ransomware standards. There are a few reasons for this:<\/p>\n\n\n\n

    \n
  1. The ransomware gave victims 72 hours before their payment doubled, and that time window has only just passed. Security researchers expect\u00a0more money to go to the Bitcoin wallets of the hackers but for now, it’s pretty low considering the scale of the attack.<\/li>\n\n\n\n
  2. Despite Bitcoin’s growing popularity, most people don’t use it or know how to get it. Doing so takes some time, and determining how much to pay based on how many computers were infected will also take time.<\/li>\n\n\n\n
  3. The hackers, by all accounts, seem to be pretty unsophisticated. The original payment asked for $300, which is absurdly reasonable compared to the average payment of $1,000 or more. Then there’s the problem of WannaCry’s decryption process, or lack thereof. According to a blog post from cybersecurity firm Check Point<\/a>, “WannaCry doesn’t seem to have a way of associating a payment to the person making it.” For now, victims just have to pay, and wait. Most security researchers and governments have urged victims not to pay the ransom, and it appears that most victims haven’t–yet.<\/li>\n<\/ol>\n\n\n\n

    <\/span>What’s next<\/span><\/h2>\n\n\n\n

    A security researcher going by the name Malware Tech accidentally stumbled<\/a> upon a killswitch built into the malware, which stopped Friday’s infection from spreading. However, a new variant of the malware has already been released, known as Uiwix<\/a>. This new variant is believed to no longer have the killswitch built in, which means the only way of stopping the new infection is to patch the SMB vulnerability in Windows. Information can be found for Microsoft here<\/a> for WannaCry support, as well as direct downloads<\/a> for each version of Windows with the SMB vulnerability. Be sure you’re also running a robust antivirus that can check for new malware strains as they appear.<\/p>\n\n\n\n

    <\/p>\n","protected":false},"excerpt":{"rendered":"

    Companies across the globe are still reeling and recovering from the global ransomware attack known as WannaCry on Friday, which took down tens of thousands of machines in 150 countries, including Britain’s National Health System. How and why did this happen? We’ve talked at length about ransomware and how it’s distributed, how it particularly affects healthcare, and the rise of ransomware as a service. Friday’s attack was unusual in how quickly the infection spread, but it also reminded us of an age-old life lesson: It’s really important to keep your systems patched and up to date. Prevention is the best cure The security world has been saying it for years, but now it has another true-to-life case in point: Update your machine when it tells you to. The attack on Friday took advantage of a zero-day vulnerability in all Microsoft systems before Windows 10. Microsoft had released a patch for it back in March (even issuing a rare patch for the now-unsupported Windows XP systems), but most people treat system updates the way they treat pre-cancer screenings: “I’m fine now, so why should I worry about it?” Well, just like you don’t want cancer when you’re older, you don’t want ransomware, either….<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[48],"tags":[],"other_category":[],"class_list":["post-3220","post","type-post","status-publish","format-standard","hentry","category-cybersecurity"],"acf":[],"yoast_head":"\nBreaking down the WannaCry ransomware attack | OTAVA<\/title>\n<meta name=\"description\" content=\"Wannacry ransomware took down tens of thousands of machines on Friday, so we break down what happened and how you can protect yourself moving forward.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Breaking down the WannaCry ransomware attack\" \/>\n<meta property=\"og:description\" content=\"Wannacry ransomware took down tens of thousands of machines on Friday, so we break down what happened and how you can protect yourself moving forward.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/\" \/>\n<meta property=\"og:site_name\" content=\"OTAVA\" \/>\n<meta property=\"article:published_time\" content=\"2017-05-16T00:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-28T20:44:27+00:00\" \/>\n<meta name=\"author\" content=\"Irma Brillantes\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Irma Brillantes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/\"},\"author\":{\"name\":\"Irma Brillantes\",\"@id\":\"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263\"},\"headline\":\"Breaking down the WannaCry ransomware attack\",\"datePublished\":\"2017-05-16T00:00:00+00:00\",\"dateModified\":\"2025-05-28T20:44:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/\"},\"wordCount\":744,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.otava.com\/#organization\"},\"articleSection\":[\"Cybersecurity\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/\",\"url\":\"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/\",\"name\":\"Breaking down the WannaCry ransomware attack | OTAVA\",\"isPartOf\":{\"@id\":\"https:\/\/www.otava.com\/#website\"},\"datePublished\":\"2017-05-16T00:00:00+00:00\",\"dateModified\":\"2025-05-28T20:44:27+00:00\",\"description\":\"Wannacry ransomware took down tens of thousands of machines on Friday, so we break down what happened and how you can protect yourself moving forward.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.otava.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Breaking down the WannaCry ransomware attack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.otava.com\/#website\",\"url\":\"https:\/\/www.otava.com\/\",\"name\":\"OTAVA\u00ae\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.otava.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.otava.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.otava.com\/#organization\",\"name\":\"OTAVA\u00ae\",\"url\":\"https:\/\/www.otava.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.otava.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg\",\"contentUrl\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg\",\"caption\":\"OTAVA\u00ae\"},\"image\":{\"@id\":\"https:\/\/www.otava.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263\",\"name\":\"Irma Brillantes\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g\",\"caption\":\"Irma Brillantes\"},\"url\":\"https:\/\/www.otava.com\/blog\/author\/ibrillantesotava-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Breaking down the WannaCry ransomware attack | OTAVA","description":"Wannacry ransomware took down tens of thousands of machines on Friday, so we break down what happened and how you can protect yourself moving forward.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/","og_locale":"en_US","og_type":"article","og_title":"Breaking down the WannaCry ransomware attack","og_description":"Wannacry ransomware took down tens of thousands of machines on Friday, so we break down what happened and how you can protect yourself moving forward.","og_url":"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/","og_site_name":"OTAVA","article_published_time":"2017-05-16T00:00:00+00:00","article_modified_time":"2025-05-28T20:44:27+00:00","author":"Irma Brillantes","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Irma Brillantes","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/#article","isPartOf":{"@id":"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/"},"author":{"name":"Irma Brillantes","@id":"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263"},"headline":"Breaking down the WannaCry ransomware attack","datePublished":"2017-05-16T00:00:00+00:00","dateModified":"2025-05-28T20:44:27+00:00","mainEntityOfPage":{"@id":"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/"},"wordCount":744,"commentCount":0,"publisher":{"@id":"https:\/\/www.otava.com\/#organization"},"articleSection":["Cybersecurity"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/","url":"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/","name":"Breaking down the WannaCry ransomware attack | OTAVA","isPartOf":{"@id":"https:\/\/www.otava.com\/#website"},"datePublished":"2017-05-16T00:00:00+00:00","dateModified":"2025-05-28T20:44:27+00:00","description":"Wannacry ransomware took down tens of thousands of machines on Friday, so we break down what happened and how you can protect yourself moving forward.","breadcrumb":{"@id":"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.otava.com\/blog\/breaking-down-the-wannacry-ransomware-attack\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.otava.com\/"},{"@type":"ListItem","position":2,"name":"Breaking down the WannaCry ransomware attack"}]},{"@type":"WebSite","@id":"https:\/\/www.otava.com\/#website","url":"https:\/\/www.otava.com\/","name":"OTAVA\u00ae","description":"","publisher":{"@id":"https:\/\/www.otava.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.otava.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.otava.com\/#organization","name":"OTAVA\u00ae","url":"https:\/\/www.otava.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.otava.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg","contentUrl":"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg","caption":"OTAVA\u00ae"},"image":{"@id":"https:\/\/www.otava.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263","name":"Irma Brillantes","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g","caption":"Irma Brillantes"},"url":"https:\/\/www.otava.com\/blog\/author\/ibrillantesotava-com\/"}]}},"_links":{"self":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/posts\/3220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/comments?post=3220"}],"version-history":[{"count":0,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/posts\/3220\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/media?parent=3220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/categories?post=3220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/tags?post=3220"},{"taxonomy":"other_category","embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/other_category?post=3220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}