The WannaCry ransomware affected thousands of companies and hundreds of thousands of users in the summer of 2017 around the world.
66626190-fb31-4776-bdcc-017eb12e3645
22d038fb-ed9b-4ba8-a507-a7fb72c6c225
8f6dcbf8-e7b1-4252-a61e-986d131f30d7
The threat was spread using the ETERNALBLUE and DOUBLEPULSAR exploits, exploiting a vulnerability in the SMB protocol and using NSA tools published by the hacker group The Shadow Brokers.
c054b02e-ce0b-428b-b345-a67b9e542f96
It was successfully neutralized by British cybersecurity specialist Marcus Hutchins in May 2017.
He discovered an emergency kill switch in the malware code.
The malware, prior to engaging, checks if the domain iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com exists.
If the domain is not registered, the malware begins to encrypt files.
However, if the domain exists, the ransomware stops the infection process.
66626190-fb31-4776-bdcc-017eb12e3645
22d038fb-ed9b-4ba8-a507-a7fb72c6c225
8f6dcbf8-e7b1-4252-a61e-986d131f30d7
c054b02e-ce0b-428b-b345-a67b9e542f96
a570d9b6-2538-4156-b832-6500eb92dc68
43b36b9d-7af6-47f6-b269-daef0e6f5ba5
b92a9dd8-708b-4276-8595-dd36d0328a27
301bcb00-a84e-47e2-99df-7ce7aabd4ba4
Hutchins registered the domain, thereby activating the “kill switch”, after which the number of successful WannaCry infections decreased sharply, and almost disappeared.
66626190-fb31-4776-bdcc-017eb12e3645
8f6dcbf8-e7b1-4252-a61e-986d131f30d7
c054b02e-ce0b-428b-b345-a67b9e542f96
At present, many patches for WannaCry have been released, the malware itself has been “neutralized,” and the ransomware is detected by any anti-virus solution.
22d038fb-ed9b-4ba8-a507-a7fb72c6c225
Hutchins claimed he discovered this kill switch “somewhat by accident.”
He believes that the malware did not self-destruct, but was “scared” by the so-called virtual machine - a secure platform used to detect viruses and read their program code.
A real computer cannot access the meaningless address as opposed to a virtual machine that can pretend to connect to it as if it were a genuine website.
43b36b9d-7af6-47f6-b269-daef0e6f5ba5
Hutchins’ pseudonym is MalwareTech.
The press managed to reveal that MalwareTech was 22-year-old Briton Marcus Hutchins.
22d038fb-ed9b-4ba8-a507-a7fb72c6c225
Kryptos Logic, where Hutchins worked, still support the operation of this “emergency switch”, together with specialists from Cloudflare, who protect the domain from further DDoS attacks.
8f6dcbf8-e7b1-4252-a61e-986d131f30d7

Warning: these questons and answers are not all representative of the way questions will be asked and answered in the pilot, because some questions are compound and some answers do not include citations.

Q: How many users did the WannaCry ransomware affect?
A: thousands of companies and hundreds of thousands of users around the world. [66626190-fb31-4776-bdcc-017eb12e3645, 22d038fb-ed9b-4ba8-a507-a7fb72c6c225, 8f6dcbf8-e7b1-4252-a61e-986d131f30d7]

Q: When did the attack take place?
A: in the summer of 2017 [66626190-fb31-4776-bdcc-017eb12e3645, 22d038fb-ed9b-4ba8-a507-a7fb72c6c225, 8f6dcbf8-e7b1-4252-a61e-986d131f30d7]

Q: How was WannaCry spread?
A: using the ETERNALBLUE and DOUBLEPULSAR exploits, exploiting a vulnerability in the SMB protocol and using NSA tools [c054b02e-ce0b-428b-b345-a67b9e542f96]

Q: Who shared the NSA tools?
A: hacker group The Shadow Brokers. [c054b02e-ce0b-428b-b345-a67b9e542f96]

Q: Who successfully neutralized the spread of WannaCry?
A: British cybersecurity specialist Marcus Hutchins [66626190-fb31-4776-bdcc-017eb12e3645, 22d038fb-ed9b-4ba8-a507-a7fb72c6c225, 8f6dcbf8-e7b1-4252-a61e-986d131f30d7, c054b02e-ce0b-428b-b345-a67b9e542f96, a570d9b6-2538-4156-b832-6500eb92dc68, 43b36b9d-7af6-47f6-b269-daef0e6f5ba5, b92a9dd8-708b-4276-8595-dd36d0328a27, 301bcb00-a84e-47e2-99df-7ce7aabd4ba4]

Q: How did he neutralize the threat?
A: He discovered an emergency kill switch in the malware code. [66626190-fb31-4776-bdcc-017eb12e3645, 8f6dcbf8-e7b1-4252-a61e-986d131f30d7, c054b02e-ce0b-428b-b345-a67b9e542f96]

Q: How does this kill switch work?
A: The malware checks for a particular domain. If the domain is not registered, the malware begins to encrypt files. However, if the domain exists, the ransomware stops the infection process. [66626190-fb31-4776-bdcc-017eb12e3645, 22d038fb-ed9b-4ba8-a507-a7fb72c6c225, 8f6dcbf8-e7b1-4252-a61e-986d131f30d7, c054b02e-ce0b-428b-b345-a67b9e542f96, a570d9b6-2538-4156-b832-6500eb92dc68, 43b36b9d-7af6-47f6-b269-daef0e6f5ba5, b92a9dd8-708b-4276-8595-dd36d0328a27, 301bcb00-a84e-47e2-99df-7ce7aabd4ba4]

Q: What is the domain he discovered?
A: iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea. com [66626190-fb31-4776-bdcc-017eb12e3645, 22d038fb-ed9b-4ba8-a507-a7fb72c6c225, 8f6dcbf8-e7b1-4252-a61e-986d131f30d7, c054b02e-ce0b-428b-b345-a67b9e542f96, a570d9b6-2538-4156-b832-6500eb92dc68, 43b36b9d-7af6-47f6-b269-daef0e6f5ba5, b92a9dd8-708b-4276-8595-dd36d0328a27, 301bcb00-a84e-47e2-99df-7ce7aabd4ba4]

Q: What did Hutchins do with the information he found?
A: registered the domain, thereby activating the “kill switch” [66626190-fb31-4776-bdcc-017eb12e3645, 8f6dcbf8-e7b1-4252-a61e-986d131f30d7, c054b02e-ce0b-428b-b345-a67b9e542f96]

Q: What happened after he activated the kill switch?
A: the number of successful WannaCry infections decreased sharply, and almost disappeared. [66626190-fb31-4776-bdcc-017eb12e3645, 8f6dcbf8-e7b1-4252-a61e-986d131f30d7, c054b02e-ce0b-428b-b345-a67b9e542f96]

Q: What protections against WannaCry exist at present?
A: There are many patches for WannaCry, the malware itself has been “neutralized,” and the ransomware is detected by any anti-virus solution. [22d038fb-ed9b-4ba8-a507-a7fb72c6c225]

Q: How did Hutchins discover the kill switch?
A: Somewhat by accident [43b36b9d-7af6-47f6-b269-daef0e6f5ba5]

Q: How does the kill switch work per Hutchins?
A: the malware did not self-destruct, but was “scared” by the so-called virtual machine - a secure platform used to detect viruses and read their program code. [43b36b9d-7af6-47f6-b269-daef0e6f5ba5]

Q: How does a virtual machine function differently than a real computer in this scenario?
A: A real computer cannot access the meaningless address as opposed to a virtual machine that can pretend to connect to it as if it were a genuine website. [43b36b9d-7af6-47f6-b269-daef0e6f5ba5]

Q: What is Hutchins’ pseudonym?
A: MalwareTech [66626190-fb31-4776-bdcc-017eb12e3645, 22d038fb-ed9b-4ba8-a507-a7fb72c6c225, 8f6dcbf8-e7b1-4252-a61e-986d131f30d7, c054b02e-ce0b-428b-b345-a67b9e542f96, a570d9b6-2538-4156-b832-6500eb92dc68, 43b36b9d-7af6-47f6-b269-daef0e6f5ba5, b92a9dd8-708b-4276-8595-dd36d0328a27, 301bcb00-a84e-47e2-99df-7ce7aabd4ba4, 22d038fb-ed9b-4ba8-a507-a7fb72c6c225]

Q: Where does/did he work?
A: Kryptos Logic [8f6dcbf8-e7b1-4252-a61e-986d131f30d7]

Q: How does Kryptos Logic defend against this malware?
A: support the operation of this “emergency switch”, together with specialists from Cloudflare, who protect the domain from further DDoS attacks. [8f6dcbf8-e7b1-4252-a61e-986d131f30d7]