WannaCry began infecting computers around May 2017, being downloaded onto windows machines and consequently encrypting the files it needs to run. While this form of infection is not new, the absolute scale of WannaCry leads it to be breaking news in most countries across the globe, especially the United Kingdom where it resulted in the NHS (National Health Service) to append various services, including operations. The infection was not mostly sophisticated and evidently was not some new super malware that will undermine the world’s computing infrastructure. Nonetheless, it did outline a more bold approach by hackers to request money upfront for their crimes. In the NHS scenario, a sum of over $300 worth of Bitcoin was demanded to decrypt the infected computers. Most of you are probably pondering the question ‘what is WannaCry?’ Well, you will learn more in this article.

What is WannaCry?

WannaCry is a Trojan virus known as ransomware. Just as the name suggests, the malware in effect holds the infected machine hostage and requests that the victims pay a huge amount of money in order to reclaim access to the files on their PCs. RansomWare such as WannaCry operates by encrypting most or all of the files on a user’s PC. Then, the program demands that payment be paid to have the files decrypted. In most cases, the program requests that the victim part with a ransom of $300 in bitcoins at the point of infection. If the victim fails to pay within three days, the ransom doubles to $600. WannaCry will then delete the encrypted files altogether, and data will be lost if no payment is made after seven days.

It is essential to note that WannaCry ransomware contains several components. The ransomware gets into the infected machine in the form of a dropper, an independent program that extracts other app components rooted within it. These components include:

• An app that encrypts and decrypts data
• Files that contain encryption keys
• A copy of Tor

The origin of WannaCry is still unknown, but the program code was simple, and the IT experts efficiently analyzed it. After being launched, the ransomware attempts to get into the hard-coded URLs. However, it continues to look for and encrypt files in some essential formats, ranging from MKVs to MP3s to Microsoft Office files if it fails to locate the hard-coded URLs. Afterward, it shows the ransomware notice requesting the $300-worth of Bitcoin to decrypt the affected files.

How Ransom Payment Work

The WannaCry hackers demand that the payoff is paid using Bitcoins. WannaCry generates a matchless Bitcoin wallet address for every infected machine, but due to a race condition error, this code executes inappropriately. Afterward, WannaCry changes to 3-hardcoded Bitcoin address for the payment. It is often impossible to have your files decrypted since the attackers are unable to determine the victims that have parted way with the ransom using the hardcoded addresses. The WannaCry hackers consequently released a new version of the ransomware that resolved this bug, but this version was not successful in comparison to the original. After this release, a new notice was sent to the infected PCs informing the victims that the files would be decrypted if the payoff was paid.

How WannaCry Infects Computers

The attack method for WannaCry is quite interesting than the ransomware itself. The susceptibility the ransomware exploits is founded in the Windows enactment of SMB (Server Message Block). The server message block assists several nodes on a network to communicate, and specially crafted packets could dupe the enactment of Microsoft into implementing the arbitrary code. It is noted that the United States National Security Agency found this susceptibility and developed a code known as EternalBlue rather than reporting it. The exploit was however stolen and released in a complicated manner by a hacking team named Shadow Brokers. Microsoft on its part had discovered the susceptibility earlier and released a patch to counterattack it, but most systems remained susceptible, and WannaCry continued infecting PCs rapidly by utilizing EternalBlue. Microsoft blamed the United States government for not sharing the knowledge of the susceptibility.

WannaCry does not start encrypting files even if the computer has been successfully infected. This is so because the ransomware attempts to access the hard-coded URL first before beginning the work. The WannaCry then shuts itself down if it fails to access the domain.

Can users recover the encrypted files or should they just pay the ransom?

The decryption of encrypted files is not possible at the moment, but several researchers continue to examine the possibility. You may be able to retrieve your files if you have backup copies of your affected files. Most IT experts do not recommend users to pay for the payoff. In some situations, it is possible to recover files without using the backups. Files which are often saved on My Documents, Desktop or a removable disk are encrypted and their original copies deleted. These files are unrecoverable. Files which are stored in other locations in your PC are encrypted and their original copies just deleted. It means that these types of files can be retrieved by using a recovery tool.

Who is impacted by WannaCry?

All unpatched windows machine are potentially vulnerable to WannaCry. Companies are specifically at risk due to its capability to spread across networks, and several companies worldwide have been affected. Europe is the continent that has been majorly affected. Nonetheless, the ransomware can also affect individual PCs.

The best practices for protecting against ransomware such as WannaCry

• Always ensure that the security software is up to date to defend yourself against potential attacks since ransomware appears on a frequent basis.
• Make sure that your operating system is up to date. Software upgrades often integrate patches for newly discovered security susceptibilities that could be misused by attackers.
• You should be wary of suspecting mails specifically if the mail contains attachments and URLs.
• Backing up essential data is a significant way of avoiding the ransomware infection. Attackers have the tendency of encrypting valuable files and documents and then leave them inaccessible. You can, however, restore the encrypted files if you have any backup.
• Using cloud services can help alleviate the ransomware infection because most retain the earlier versions of files allowing the user rollback to the unencrypted form.

Definition

Today, malware is one of the biggest threats on the internet. It is an abbreviation for malicious software. Malware is any software that has been developed by cyber attackers with the intention of damaging a computer or a network. In most cases, the owner is not aware of the compromise. Apart from destroying the computer, this software is mainly developed to steal, encrypt, and delete sensitive data or to monitor any computer activity without permission.

Types of malware

There are different types of malware. Each type has unique traits and characteristics. The following are the main types;

• Computer viruses – This is the most common type of malware. A computer virus is a malicious program that executes itself and spreads uncontrollably through the machine thus infecting other programs and files. These viruses end up deleting or corrupting other files.
• Computer Worm – This form of malware can replicate itself without the host program. Worms spread faster than computer viruses. They move from system to system across networks through programs or removable devices. For example, a computer worm can move from one machine to another through an email attachment. Worms are some of the long-lived forms of malware these days.
• Scareware – It is also referred to as a rogueware. Just as the name suggests, this malware works by scaring the computer user with fake warnings. They are required to pay a certain fee if they want the detected malware to be removed. If the user buys the “advertised” application and installs it on the device, they will continue experiencing more of the scareware.
•  Ransomware – This form of malware also scares the users with warnings of malware detected on the machine. However, ransomware also prevents the user from accessing the computer’s operating system or essential files. You will have to pay a huge fee if you want the OS and the vital data to be unblocked.
• Trojan horse – This is a very common form of malware. It pretends to be a legitimate and useful tool and tricks the user into installing it. The installation will allow the software to access the computer’s operating system. This malicious software often deals with copying essential files and sending them to other devices.

In most cases, its functions are hidden from the user. The worst thing about Trojan horses is that they can be remotely controlled through a backdoor function. It makes it possible for cyber attackers to hijack the computer.

• Adware – The word is a combination of advertisements and software. This malicious software works by inserting advertisements into programs. Online marketing has become the most common form of advertisements, and this makes adware one of the most common form of malware. Sometimes, it can make changes to the computer system without permission or even show fake websites.

How to recognize malware

Companies and individuals can be victims of malware attacks. In large organizations, cyber attackers can use malware to weaken the systems or expose essential data to gain profit. This could cause huge damage to the entire firm. Therefore, it is necessary to recognize the malware early enough and take corrective actions. There are very many signs that could guarantee that a computer has been infected with malware. Apart from a slow computer, other signs that the device has been infected with malware include;

• Program crash – sometimes, the computer programs end up crashing because some malicious software has deactivated the program. Also, the machine could experience problems starting up or shutting down.
• Installation of unwanted programs– If you notice that some programs are installing and opening themselves in your device, you should be aware that your machine has been infected by malware.
• Promotional pop-ups– Also, if you are experiencing pop-ups, spam or frequent crashes in your device, there is a possibility that it has been infected with malware.
• Low internet speed– when a malware affects the computer, it causes high data traffic which in turn lowers the internet speed.
• Automatic redirection to unwanted sites-if you notice a lot of unwanted internet content such as the appearance of new pages or toolbars in the browser, you should know that your device has been infected.

How to remove malware

In most cases, malicious software is developed to make a profit from spreading fake emails, stealing or encrypting sensitive data or making money from false advertisements. If you have identified the above signs and you think that your machine has been infected by malware, it is good to know how to get rid of the malware as soon as possible. Each type of malware has a unique way of infecting a computer which means that each type has its own removal method. However, the following are some of the necessary steps for getting rid of malware.

• Start by backing up all the critical files on the computer.
• Ensure that the machine is disconnected from the internet.
• Remove all the external storage devices from the computer. These include flash disks and USB drives.
• Scan the computer using the antivirus program.
• Restart it as you press the F8 button. This key should be pressed before the windows startup logo appears.

How to protect yourself against malware

Protection is always better than cure. Since anyone can be a victim of malware, it is necessary to take the basic cyber-security practices that can help users be safe from malware. The following are some of them.

• Installing an anti-virus program – There are different programs available in the market today, choose the best one and install it on the computer. Use it to scan the machine as frequently as you can.
• Updating the computer’s operating system – Computer users should ensure that will install all system updates as soon as they are released. Delays in patching up have caused many people to be victims of cyber-attacks.
• Installing cyber-security software – These days, most software providers will update their programs as frequently as possible. It could either be daily or weekly. The updating ensures that there is enough protection from malware in case of an attack.
• Being cautious about the email attachments that you open – It is correct to say that malware can also be transferred from system to system through email attachments. Therefore, if you want your machine to stay safe from any form of malware, you should ensure that email attachments are secure before downloading them.