Ransomware Outbreak Targeting Windows SMB Flaw

A large ransomware outbreak affecting some Windows systems is in effect today, with a report from the SANS Institute's Internet Storm Center estimating 45,000 attacks in 74 countries.

The ransomware is identified as "WannaCry" and is targeting a Windows Server Message Block (SMB) flaw that was addressed with Microsoft's March MS17-010 "critical" security bulletin release. The Internet Storm Center also identified this flaw as "ETERNALBLUE." Apparently, that's a reference to one of the code names used for a group of hacking tools purportedly collected by the U.S. National Security and then subsequently leaked by a group calling itself "The Shadow Brokers."

The ransomware has hit hospitals in the United Kingdom and Telefonica in Spain, according to the Internet Storm Center. It's affecting National Health Services computers in England and Scotland, according a report by The Guardian.

The ransomware, which encrypts a computer's files, is said to present a demand for $300 in Bitcoins to unlock them, along with a threat to double the price.

A Motherboard story suggested that the UK's National Health Service may have been hit because it continues to run the unsupported Windows XP operating system across thousands of machines. However, MS17-010 is a patch for newer operating systems as well, such as Windows 7 and Windows 8.1, plus Windows Server 2008, Windows Server 2012 and even Windows Server 2016.

The WannaCry ransomware exploits a remote code execution flaw in SMB version 2, according to a Kaspersky Lab post. While Microsoft issued MS17-010 to patch the flaw, "it appears that many organizations have not yet installed the patch," Kaspersky Lab indicated. Most of the attacks are happening in Russia, according to the organization. The security firm recommended installing MS17-010, "which closes the affected SMB Server vulnerability used in this attack," among other measures.

When asked about the flaw, Microsoft responded today by e-mail, saying that its March update addressed the issue and consumers running Windows Defender and Windows Update would be protected, per a spokesperson:

Today our engineers added detection and protection against new malicious software known as Ransom:Win32.WannaCrypt. In March, we provided a security update which provides additional protections against this potential attack. Those who are running our free antivirus software and have Windows Update enabled, are protected. We are working with customers to provide additional assistance.

Such an outbreak of malware, affecting public institutions, is the kind of scenario found in the novel, "Zero Day." Its author, Mark Russinovich, chief technology officer at Microsoft, acknowledged the similarity today, saying, "Yes, it's a scenario from Zero Day," in a Twitter post.

About the Author

Kurt Mackie is senior news producer for the 1105 Enterprise Computing Group.


  • Windows Admin Center vs. Hyper-V Manager: What's Better for Managing VMs?

    Microsoft's preferred interface for Windows Server is Windows Admin Center, but can it really replace Hyper-V Manager for managing virtual machines? Brien compares the two management tools.

  • Microsoft Offers More Help on Windows Server 2008 Upgrades

    Microsoft this week published additional help resources for organizations stuck on Windows Server 2008, which fell out of support on Jan. 14.

  • Microsoft Ups Its Carbon Reduction Goals

    Microsoft on Thursday announced a corporatewide carbon reduction effort that aims to make the company "carbon negative" by 2030.

  • How To Dynamically Lock Down an Unattended Windows 10 PC

    One of the biggest security risks in any organization happens when a user walks away from their PC without logging out. Microsoft has the solution (and it's not a password-protected screensaver).

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.