WannaCry Ransomware : Working & How to stay safe?

WannaCry is the trending shit. Its a ransomware which have affected more than 3,00,000 computers in 150 countries. It is one of the biggest cyber attacks in the history so we are going to discuss what is it, how it works and how to stay safe from it.

What is it and How it works?

WannaCry is a ransomware which started showing its rage on May 12, 2017. It uses NSA’s EternalBlue exploit and DoublePulsar backdoor. It can spread without user interaction as it exploits a vulnerability in SMB protocol. After the the attack, a patch for SMB was release on May 14, 2017 by Microsoft.

1. It gets installed on victim’s device. The users gets infect by malicious emails or from the other infected devices.
2. First of all the Ransomware Starts encrypting files and starts creating some files on the desktop and changes background. Each infection generates a new RSA-2048 keypair. The public key is exported as blob and saved to 00000000.pky
   The private key is encrypted with the ransomware public key and saved as 00000000.eky Each file is encrypted using AES-128-CBC, with a unique AES key per file. Each AES key is generated CryptGenRandom. The AES key is encrypted using the infection specific RSA keypair.                                                                                                                                                  Simply, it encrypts the files in such a way that you can’t decrypt them unless you have the decryption key.
3. It leaves DoublePulsar backdoor in the device it has infected. This backdoor is created by National Security Agency.
4. It infects all the the devices present in the same network.
5. Then it uses EternalBlue exploit to infect random computers on the internet. This exploit is also developed by NSA which exploits the Server Message Block (SMB) protocol in windows.
6. After encrypting the files, it asks for bitcoins worth $300 in order to decrypt the files. If you pay the ransom, you may get the decryption key which can be used to get your files back.

How to protect yourself?

1. Update your windows which will fix the SMB vulnerability.
2. Click on Start and search for Windows Features, now disable the SMB service from there.










2. Use a firewall
3. Don’t download anything from unknown sources.
4. Only open trusted emails and be extra careful while opening email attachments.
5. The best thing you can do is to use Linux instead of windows.
Thanks for reading! I hope you will stay safe with the precautions we have discussed. Now lets end this article with Iron Man vs WannaCry.