How 22 year old stopped the cyber attack ransomware

By Prempal Singh 0 Comment May 15, 2017  anti ransomware, cerber, cryptolocker, cryptolocker ransomware, decrytp ransomware, FBI, fbi ransomware, kaspersky, kaspersky ransomware, locky, locky ransomware, Malware, malware ransomware, malwarebytes, malwarebytes ransomware, ransom, ransomware attack, ransomware cerber, ransomware download, ransomware removal, removw ransomware, virus, virus ransomware, what is ransomware, windows ransomware

The “accidental hero” who ceased the global spread of an unprecedented ransomware harm by registering a confusing domain name hidden the malware has warned the attack could be rebooted.

The ransomware utilized in Friday’s attack cause havoc on organizations including FedEx and Telefonica, as well as the UK’s National Health Service (NHS), where operations canceled, X-rays, test results and patient information became unavailable and mobile phones did not work.

Nevertheless, the spread of the strike was brought to a sudden halt when one UK cyber security researcher tweeting as @malwaretechblog, by using Darien Huss from security company Proofpoint, found and unintentionally activated a “kill switch” in the malicious software.

The researcher, who recognized himself only as MalwareTech, is a 22-year-old from southwest England who works for Kryptos logic, an LA-based threat intelligence company.

“I was out having lunch with a good friend and got back about 3 p. m. and saw an introduction of stories articles about the NHS and various UK organizations being hit,  he told the Protector. “I had a little bit of look of that and then I found an example of the malware to it and saw that it was connecting away to a specific domain name, which has been not registered. Consequently, I picked it up not knowing what it did at the time. ”

The kill change was hardcoded into the malware in circumstance the creator wanted to stop it spreading. This involved enlarge meaningless domain name that the malware makes a demand to – just as if this was looking up any website – and if the request comes back again and shows that the domain is live, the kill switch takes the impact and the malware prevents spreading. The domain cost $10. 69 and was immediately registering thousands of connections every second.

MalwareTech explained that he bought the domain because his company tracks botnets, and by registering these domain names they can get an insight into how a botnet is spreading. “The purpose was to just screen the spread and see whenever we could do anything about it afterward. But we actually halted the spread just by registering the domain,  he said. But the following hours were an “emotional rollercoaster”.

“Initially someone had reported the incorrect way round that we had caused the virus by registering the domain name, so I had a new mini freak out until I actually realized it was actually vice versa and we had stopped it.

MalwareTech said he preferred to stay unknown “because it just does not make sense to give out my own information, naturally we’re working against bad guys and they’re not happy about this.

He also said this individual planned to hold onto the URL, and this individual and colleagues were collecting the IPs and mailing them off to law enforcement agencies for them to alert the infected victims, not all of whom realize that they have recently been affected.

‘This is not over’

He warned people to patch their systems, adding “This is not over. The attackers will realize how we halted it, they’ll change the code and then they will start again. Enable windows update, update and then reboot. ”

He said he got his first job out of college without the real qualifications, having skipped university to begin up a tech blog and write software.

“It’s always been a hobby to me, I’m self-taught. I ended up obtaining a job out of my first botnet tracker, that the company I now work for a saw and approached me about, asking if I wanted a career. I have been working there a year and two months now.

But the dark knight of the dark web still lives at home with his parents, which he joked was “so stereotypical”. His mom, he said, was conscious of what had occurred and was excited, but his dad hadn’t recently been home yet. “I’m sure my mother will notify him, ” he said.

“It’s not going to be a lifestyle change, it’s simply a five-minutes of fame sort of thing. It is quite silly, I’ve not been able to check on into my Tweeter feed all day because it’s just been going too fast to study. Every single time I refresh it can another 99 notifications.

Proofpoint’s Ryan Kalember said the British researcher takes “the accidental hero award of the day”. “They didn’t realize how much it probably slowed down the spread of this ransomware”.

The time that @malwaretechblog registered the domain was too late to help Europe and Asia, where many organizations were damaged. However, it gave people in the US additional time to develop immunity to the attack by patching their systems before they were infected, said Kalember.

The kill switch won’t help anyone whose computer is already infected with the ransomware, and it is possible that there are other variations of the malware with different kill changes that will continue to spread.

The malware was made available online on 14 April through a dump with a group called Shadow Brokers, which claimed last year to obtain stolen a cache of “cyber weapons” from the National Security Agency (NSA).

Ransomware is a type of malware that codes an user’s data, then demands payment in exchange for unlocking the information. This kind of attack used a bit of harmful software called “WanaCrypt0r 2. 0” or WannaCry, that exploits a vulnerability in Windows. Microsoft released a patch (a software upgrade that fixes the problem) for the flaw in March, but computers which may not have installed the security update remain vulnerable.

The ransomware demands users pay $300 worth of cryptocurrency Bitcoin to retrieve their files, though it alerts that the “payment will be raised” after a specific amount of time. Translations of the ransom message in 28 languages are included. The malware spreads through email.

“This was obviously predictable in lots of ways, ” said Kalember. “As soon as the Shadow Brokers dump turned out everyone [in the safety industry] realized that many of folks would not be able to install a patch, particularly if they used an operating system like Windows XP [which many NHS computer systems still use], for which there is absolute no patch. ”

Security researchers with Kaspersky Laboratory have recorded more than 45, 000 attacks in 74 countries, including the UK, Russia, Ukraine, India, China, Italy, and Egypt. In Spain, major companies including telecommunications firm Telefonica were infected.

Simply by Friday evening, the ransomware had spread to the United States and South America, though Europe and Russia remained the toughest hit, according to security researchers Malware Hunter Group. The Russian interior ministry says about 1, 000  computers have been damaged.

Source: www.businessinsider.com