Hacker News Reader

Comment by neom | Hacker News Reader

"it is simply scanning accessible servers for the presence of the DOUBLEPULSAR backdoor. In cases where it identifies a host that has been implanted with this backdoor, it simply leverages the existing backdoor functionality available and uses it to infect the system with WannaCry." - Not a security person but that seems pretty clever, and incredibly worrying. I presume we'll see more of this type of attack in the future - but curious if this has been a popular vector of compromising in the past? Also curious about what a / how a killswitch domain works?

View on HN

You stopped before the next sentence which completely changes the context:

> In cases where the system has not been previously compromised and implanted with DOUBLEPULSAR, the malware will use ETERNALBLUE for the initial exploitation of the SMB vulnerability. This is the cause of the worm-like activity that has been widely observed across the internet.

This is not really any different from Blaster from 2003.

Was Blaster using a hole that had been patched months ago?

About a month, yes

In that case, it was supposedly because of the patch:

> According to court papers, the original Blaster was created after security researchers from the Chinese group Xfocus reverse engineered the original Microsoft patch that allowed for execution of the attack

The patch was

ms03-026: Buffer Overrun In RPC Interface Could Allow Code Execution Published: July 16, 2003

(could, hah)

> The worm was first noticed and started spreading on August 11, 2003

It was a huge problem at college campuses well into September. Students would arrive with their brand new laptops running XP and get hit with the worm 30 seconds after connecting to the network.

Really the main difference is blaster was just an annoyance and mostly just broke random things like the DHCP service, but was easily fixed.

Months? No. Weeks? Yes.

It is quite clever. Computer worms were much more common in the past. https://en.wikipedia.org/wiki/Computer_worm

The lack of highly available and remotely exploitable vulnerabilities have made them less common.

Or, "less commonly discussed". Why would worms be less prevalent today when the density of targets has increased one-hundred fold? Many systems may be inoculated but there are lots and lots of non-patched machines in the World.

In large part they are less common because of NAT's popularity.

Back in 2003, most people were on dialup or had a single machine plugged directly into the Internet. Microsoft had no firewall out of the box. So by default you exposed all your Microsoft networking services to the whole Internet.

NAT changed that, it made it so no one could directly connect to all the vulnerable machines floating around. Your phone is unable to infect other phones on your providers network or the wider internet in this same way.

No one is out mass exploiting those IOT light bulbs with default telnet passwords because they're not exposed directly to the Internet. There are a few however exploiting vulnerable NAT routers... probably the only sort of worm to see widespread success in recent years.

Exactly this. MSBlast was so prevalent that ISP's would prevent infected computers from accessing the internet, by redirecting them to a page which described how they could remove the infection and patch themselves up.

I don't remember that happening with any other type of infection.

And I don't think we'll ever see that again. Even if there are big vulnerabilities in Linksys, DLink, Netgear or common ISP shipped modem/router combos - there are just too many different devices to see it on the same scale.

Thank you for the explanation!

> Also curious about what a / how a killswitch domain works?

From the article:

The above subroutine attempts an HTTP GET to this domain, and if it fails, continues to carry out the infection. However if it succeeds, the subroutine exits. The domain is registered to a well known sinkhole, effectively causing this sample to terminate its malicious activity.

Except on networks that block HTTP GET to unknown hosts...

But why??

Why does it do it? To avoid triggering in many sandbox environments, as they often are not connected to the internet and track and respond with generic yes/"correct data" formats

Reply on news.ycombinator.com