Computer nerds explain

Computer nerds explain.
theguardian.com/technology/2017/may/13/accidental-hero-finds-kill-switch-to-stop-spread-of-ransomware-cyber-attack

Other urls found in this thread:

gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168
zerohedge.com/news/2017-05-15/second-wave-ransomware-cyberattack-begins-spread-wever-never-seen-anything
twitter.com/NSFWRedditImage

>Unnamed source flipped the switch
Okay then.

He set a killswitch in the ransomware to stop it from spreading if it contacted a website and the website responded. The website didn't actually exist until someone registered the domain, thus activating the killswitch.

this
the idea of the malware creator was that if someone was trying to figure out how the program worked, they would capture all of its internet usage.
if the malware tried to contact a server it knew didn't exist and got a response, it would know it was being examined and stop running, to avoid giving any details to the researcher.
unfortunately for the malware, this "hero" bought the domain it checked and set something up there. now the malware will always think it is being examined and never run.

So why is he not a hero?

hero is a bit much - the creator could literally remove this system in under a minute and keep spreading the virus - this would only affect already infected devices

Also the "hero" admitted he didn't know what registering the domain would do. He just wanted it for whatever reason.

very cool and not suspicious at all

The creator is the NSA, son

people can just create a version without the killswitch and set it loose again, continuing to infect vulnerable machines

doubtful. the NSA/CIA tools got leaked by contractors months ago. dont you remember the whole wikileaks document?

it was the SMB exploit from the NSA that the ransomware uses to spread

collected info here

gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168

Yes I understand that, I was simply stating that the ransomware was most likely not created by the NSA. but simply uses a leaked exploit.

And almost immediately outdated. Very sneaky.

imagine the most insanely easy to trigger killswitch you can fucking imagine

now step it up a few levels of obvious and you have this killswitch

nice virus my dude

It could easily still be a state actor either from here or abroad that set the malware loose. Having wikileaks release it to the masses gives it a kind of cover for intel agencies to continue using it and allowing others to be blamed.

so could an attack on the domain dns providing servers re-enable this virus?

i mean, by ddosing that domain and taking it down (or the dns provider, but that's harder) would make the program think that domain is unreachable and re-enable itself as that domain doesn't exist yet?

yes, that would work but I assume precautions have been taken by this security researcher

do you know what do to right?

please if someone is reading this and has a botnet you know what to do. Only for the lols

Which Domain was it and why did the creator leave such a kill switch open to see for everybody? How would it have worked anyway?
Why would the Virus have known it gets traced if the Website it was pinging didnt exist.
May it be it was only a kill switch and the creator intended to do it anyway at a time?

read: basically it was not a "kill switch" to be activated later, but a weak way to prevent the program from being analyzed:
if something happened that it knew would not (a site that shouldn't exist has something there) shut the program down to prevent analysis

site: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

I've been searching and the domain is some kind of md5 hash + ".org" but i haven't found the actual domain yet. I suppose the creator tried to hide it but with reverse engineering you can find everything.

Not only is he a hero, he's one of us.

Genius takes what nobody knows and makes it common knowledge. Kid's a genius. Thanks, England.

kek u found it how? i googled and i didn't found nothing

>be evil hacker
>install Hollywood kill switch
Yeah nah

just saw it here: seems pretty legit

why did the kill switch deactivate the ransomware?
or is it a second symptom of hexa editing the program ?

There is a new version without the killswitch ATM
zerohedge.com/news/2017-05-15/second-wave-ransomware-cyberattack-begins-spread-wever-never-seen-anything

read;
the killswitch was created to protect the virus from being analysed in a sandbox by cyber defence organisations

i think this a side effect of editing the program, although there are version out there that were adjusted properly so are working and without the "kill switch"

>ransomware
Oh noes, I'll lose gb's of pictures of good looking women.

That supposedly already happened days ago.

UK hospitals were actually locked out of all their info. Pretty funny.

So then he's not a hero, and he'll soon be an hero.

F

So this particular piece of ransomware had an address it was pinging in order to stop. Some guy found the the address and registered it

Oh by the way that is exactly what the creator did. All variants of the spreading virus has this part removed.

>wikileaks release it to the masses
WRONG

You have to start over again though, systems infected with this killswitch cannot infect other systems.

Hackers let him live

>believing (((wikileaks))) isn't run by the CIA