The WannaCry malware saw its peak infections on May 12^th 2017, during which 300 000 computers across 150 countries were affected. This piece of malicious software locks computer data behind ransomwalls and demands Bitcoin payments for the release of this information.

However payment of this ransom does not even guarantee the safe release of the information. This is because the author of the WannaCry code did not include a method of storing and collecting the unique computer IDs of the victims’ computers. In other words, the attackers using the malware do not have any way to identify those who have paid the ransom, and therefore no way of knowing which information to release.

WannaCry exploits a vulnerability in the code for a component of Windows PCs called the “Windows Server Message Block”. It accomplishes this via a tool called “EternalBlue”, which is believed to have been developed by the NSA (US National Security Agency) for spying. This code was released to the public on April 14^th 2017 by a group of cyberattackers called the “Shadow Brokers”, and has therefore become widely accessible since. By utilizing this vulnerability, attackers are able to insert the WannaCry malware directly into a system. This malware is particularly difficult to stop once it has gained ground, due to its ability to self-spread throughout an organization’s network without any further input from users.

Because it exploits a Windows vulnerability, WannaCry affects Microsoft Windows XP, Vista SP2, Server 2008 SP2, R2 SP1, 7, 8.1, RT 8.1, Server 2012 and R2, 10, and Server 2016.

The Repair has been Available

The Windows vulnerability that was exploited by EternalBlue was in fact repaired in a patch released by Microsoft in March of 2017, even before the “Shadow Brokers” released the spying tool to the public. The enormous impact of WannaCry was the result of many organizations being uninformed-of and neglecting important updates released by software developers. These updates often contain critical security fixes that protect your computers against the latest cyberthreats. In fact, ServiceNow completed a survey which discovered that 467 financial companies were impacted by cyberattack attempts that had in fact been patched prior to each incident.

It is this continued neglect of updates that has kept WannaCry relevant and dangerous even now, over a year after its peak. The Taiwan Semicondictor manufacturing Company (TSMC) has been one of the latest in the long list of WannaCry victims. The computer chip manufacturer reported that the ransomware attack resulted in production halts in numerous plants in Taiwan during early August 2018.

The Chief Executive Officer of the company reported that the breach was caused by a fake malicious supplier that was connected to the organization’s network. From there, the malware was able to spread to several of the plants owned by the company. The total financial cost of the damages are predicted to reduce the company’s Q3 revenue by 3%.

How to protect yourself from WannaCry

The TSMC attack demonstrates the importance of keeping your organization’s computers up-to-date with the latest software. The widespread neglect of the windows update that patched the WannaCry malware resulted in the amplification it its impacts across the world.

Below are some other best practices to keep your organization safe from malware like WannaCry:

Ensure that the url: “www[dot]iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com” is not blocked on your computers. This domain was developed as a “kill switch” by the author of the WannaCry malware. If the URL is connected to your computer, the malware simply disables itself.

Disable old protocols on your computer such as the “SMB protocol” which contain the vulnerabilities that are exploited by cyberattackers. Also, do not open links or downloads found within email sources that you do not trust, or that seem malicious. This is one of the primary ways that malware can enter your system.

GigE Solutions can help your company protect itself from malware attacks by keeping your computers always up-to-date with the latest security patches. Contact us at +1 (888) 366-4443 to get started with us today!

A server is a computer that is connected to other systems in a company through either the internet or a local network, and that dedicates its resources to ‘serving’ these computers. Because of this, servers are in constant communication with all company systems, storing, processing, and communicating data. Due to the fact that they are the central nodes of an organization’s network, they are often the targets of malware attacks. This is because servers are connected to most, if not all company systems, and therefore give easy avenues for the attackers to spread their malicious software to all computers on the network. In light of this, protecting your server should be viewed as critically important when it comes to company cybersecurity.

Recent Malware Attacks that Ravaged Company Servers

On July 16^th, Algonquin College reported that its servers were affected by a malware attack on May 16^th. The infected server, they stated, contained sensitive information belonging to students, employees, and alumni. It is believed that data such as date-of-birth and home addresses of 4,568 individuals was leaked, and that the non-sensitive data of another 106,931 individuals could also have been compromised.

Another recent case of malware infecting server systems was the “Wannacry” malicious software. In 2017, this ransomware was able to lock the files of hundreds of thousands of systems behind ransom-walls. The widespread reach of the malware was attributed to the fact that it has “worm capability”, allowing it to spread to computers connected to a server without any input from the user. In other words, once this malware attached itself onto the central server of an organization, all connected systems became at-risk of infection.

Finally, the “Adylkuzz” malware also demonstrates the importance of protecting your server. This malware is categorized as “cryptomining malware”, which transforms the infected system into a cryptomining slave that wastes its resources making digital currency for the attacker.

How to protect your servers against Malware Attacks

In many of the above instances, malware was able to infiltrate an organizations’ servers due to the fact that the companies neglected to keep their systems up-to-date with current patches. Servers, like any other system, use operating systems such as Windows. Therefore, they need to be constantly updated to receive the latest security measures developed by vendors such as Microsoft.

Following the Wannacry outbreak, Microsoft released a statement noting that “EternalBlue”, the security vulnerability that was exploited by the attackers, had in fact been patched two months prior to the incident. However, many companies failed to install the fix, leaving their systems open to infection. Similarly, the vulnerability used by “Adylkuzz” called CVE-2017-7269 was also repaired prior to the event by Microsoft in an update released on June 13^th, 2017. The severity of both of these incidents could have been drastically mitigated if organizations had been more diligent in keeping their servers’ operating systems up-to-date.

Therefore, it is clear that protecting your company’s server is critical to the safety of all systems on your network. Because they are connected to many of an organization’s systems, malware-infected servers become extreme threats to the security of all computers connected to it.

At GigE, our experts have years of experience in ensuring that your organization’s servers and computers are up-to-date with current software. Do not fall victim to malware and contact us today at +1 (888) 366-4443.