The WannaCry Ransomware Attack Could’ve Been a Lot Worse

You may have heard: a globe-spanning ransomware attack known as WannaCry (and “WannaCrypt” and “WannaDecryptor”) started on Friday, ultimately encompassing some 200,000 computers in 150 countries.

But it could have been a lot worse—and we have cybersecurity researchers to thank for making sure it wasn’t.

Even as word was still spreading Friday that computers at dozens of hospitals in the U.K. were being maliciously locked down, and a notice demanding ransom posted on their screens, an anonymous researcher known as MalwareTech was in the process of shutting down further spread of the program.

As s/he reported in a fascinating blog post, MalwareTech had found an unregistered URL address in WannaCry’s code. Suspecting that the address had something to do with how the virus communicated—a common feature in botnets and other types of malware—MalwareTech registered the domain and watched as traffic from thousands of infected computers came flooding in, nearly overloading the server hosting the domain. Usually this kind of “sinkhole” move is an effort to disrupt a botnet, for example, from issuing commands to infected systems.

In this case, the domain turned out to be a “kill switch”—on any system that made contact with the URL, the virus shut itself down. WannaCry was on its way out.

As MalwareTech noted, however, malicious programmers could easily alter WannaCry’s code to ping a new address instead. And they did. On Sunday a new variant was infecting thousands of systems in Russia. That, too, was curtailed thanks to the quick work of a cybersecurity researcher.

In the meantime, Microsoft took the unusual step of hustling to distribute a patch for a flaw in the unsupported version of Windows that WannaCry was exploiting. The U.S. National Security Agency had been hoarding the vulnerability, but it was leaked after the theft of the agency’s secrets by a hacking group known as the Shadow Brokers.

Unfortunately, as we’ve stated before, ransomware has become a popular form of cybercrime for one simple reason: it pays. It’s also difficult—though not impossible—to stop. Apart from this weekend’s attacks, criminals have locked down part of San Francisco’s public transit system and a hospital in Los Angeles—in the latter case, forcing the hospital to pony up $17,000 to regain access to its files.

The architects of WannaCry were similarly looking for a quick payday. But they made it pretty easy to follow the money: WannaCry’s code contained the addresses of three Bitcoin wallets. As of midafternoon Monday, a Twitter bot tracking payments to the wallets said the accounts had a total of a little over $55,000 in them.

Thanks to such scrutiny, some experts have speculated that whoever is behind WannaCry won’t dare try to make a withdrawal from the wallets, fearing that it will blow their cover. The sum itself might also give them pause. Sure, it’s a lot of money—but it could’ve been a whole lot more.

(Read more: Malware Tech, Los Angeles Times, BBC, Quartz, “Holding Data Hostage: The Perfect Internet Crime?,” “Two Ways to Stop Ransomware in Its Tracks”)