I am WannaCry, the Cryptoworm!

Updated 1 May 2019 12:28AM

Pet Sementary (2019)?  Although Horror has many delivery methods such as visceral horror, demon possession, toy monsters or monster toys, apocalypse zombies, mutants, deviant behavior, supernatural, worms and holiday and comedy horror. What happens when worms are autonomous?  A cryptoworm is a malware that was created to disrupt, collect and infiltrate.  Malware has many methods of delivery as well. This is the third blog in a series that jars at Rayome’s worst top ten ransomware attacks of 2017.  According to Rayome, the top three scariest ransomwares are WannaCry, NotPetya and Locky.  Of the three, WannaCry opened old wounds. Cryptoworms are not new threats, yet cryptoworms bite. Worms do not bite in the human world!  On the other side, the digital realm, worms are self-replicating, autonomous, repurposed and excruciating to sanitize. Viruses are similar to worms with an important difference; viruses need hosts. It’s easier to remember for security testing. Worms do not need a host.  Do you remember primitive viruses that wreaked havoc in the digital realm in the late 20th century: the Creeper (1971), Elk Cloner (1982), the Morris Worm (1988), ILOVEYOU (2000) and Code Red (2001)? ILOVEYOU virus – when executed – copies itself to several windows directories and registry entries. Additionally,  ILOVEYOU added a fictitious link to Microsoft’s Internet Explorer that downloaded an executable program and a trojan when clicked.  The latter malware has been newly characterized as a Remote Access Trojan (RAT).  Can you detect or catch a RAT? Some associated security terminology of primitive malware infections has been updated to browser or URL hijacking. To a script kiddie, cryptoworms are not as interesting as a watering hole attack? Malware is still affecting millions. Detective and corrective controls are two formidable countermeasures if used repeatedly in the security cycle.  On March 29, 2019,  Earl Enterprises reported its data security incident that affected 2.15 million cardholders.  Cardholders were affected if they dined in one of the many Earl Enterprises branded restaurants.  The dwell time lasted between May 23, 2018 and March 18, 2019.  The average dwell time was 101 days in 2018; the previous year average dwell time was 99 days. Earl Enterprises’ security incident ascribes to the same catastrophic cybersecurity story lines: longer dwell times and millions of customer’s data deposited on the dark web.  Who impeded WannaCry? Marcus Hutchins arrested the spread of WannaCry according to Jeong’s article. WannaCry was a cryptoworm created to infiltrate and to extract payment, yet its weakness was very translucent rather than transparent.   WannaCry called home an unregistered URL, which is still under scrutiny for its purpose.  Once the URL was registered, WannaCry reign ended.  Another solution to impede WannaCry was Microsoft Security Bulletin MS17-010 or patch. A patch is a preventive control. 

Resources 
Coccarelli, Joana. miss October 11. 03 October 2012. Flickr. https//www.flickr.com/photos/catrinaustin/13952107359/. Accessed 22 April 2019.
Earl Enterprises. “Notice Of Data Breach.” 29 March 2019. Earl Enterprises, https//www.earlenterprise.com/incident/#potentially-affected-locations. Accessed 30 April 2019.
Fox, S. “The Top 10 Computer Viruses” 08 April 2009. Popular Science, https//www.popsci.com/scitech/article/2009-04/top-10-computer-viruses#page-3. Accessed 23 April 2019.
Fruhlinger, J. “What is WannaCry ransomware, how does it infect, and who was responsible.” 30 August 2018, CSO, https//www.csoonline.com/article/3227906/what-is-wannacry-ransomware-how-does-it-infect-and-who-was-responsible.html. Accessed 30 April 2019.
GitHub, Inc. https//github.com/vz-risk/VCDB/issues/13338. Accessed 27 April 2019.

Hall. Artondra. “Three Heads are better than one!” 14 February 2013. Flickr. https//www.flickr.com/photos/projectart69/galleries/?rb=1. Accessed 07 July 2018.
“Horror films by genre.” 28 March 2013. Wikipedia, The Free Encyclopedia, Wikipedia, The Free Encyclopedia, https//en.wikipedia.org/wiki/Category:Horror_films_by_genre. Accessed 21 April 2019.
Indiana University. “ARCHIVED: What is the ILOVEYOU worm, what does it do, and how do I detect and remove it?” Indiana University, Knowledge Base, https//kb.iu.edu/d/aioe. Accessed 25 April 2019.
Jeong, S. “The WannaCry Hero Deserves a Pardon, Not a Conviction. Society owes this security researcher a very big favor.” 25 April 2019.  New York Times, https//www.nytimes.com/2019/04/25/opinion/marcus-hutchins-wannacry.html. Accessed 27 April 2019.
“Nimda.” 06 February 2018. Wikipedia, The Free Encyclopedia, Wikipedia, The Free  Encyclopedia. https//en.wikipedia.org/wiki/Nimda. Accessed 23 April 2019.
Rayome, A.D. “The top 10 worst ransomware attacks of 2017, so far.” 31 October 2017, Tech Republic, https//www.techrepublic.com/article/the-top-10-worst-ransomware-attacks-of-2017-so-far/. Accessed 22 January 2019.
Spring, T. “Meet the Cryptoworm, The Future of Ransomware.” 12 April 2016, Threatpost.com, https//threatpost.com/meet-the-cryptoworm-the-future-of-ransomware/117330/. Accessed 23 April 2019.

Leave a comment