As hospital after hospital went offline, security researchers around the world started poring over the ransomware that had gone round the globe.<\/p>\n
And one 22-year-old in the UK ended up saving thousands more computers across the world being infected. <\/p>\n
Working together through the night on an IRC channel - an online chatroom themed around a topic, in this case #wannadecryptor - researchers shared their findings. <\/p>\n
Despite the spread of the ransomware, researchers weren't impressed. <\/p>\n
\"It really doesn't seem like a sophisticated attack at all,\" one hacker told me. \"It's embarrassing the NHS got caught out by this.\" <\/p>\n
Other researchers found that the malware was using Tor - anonymity software originally developed by US defence - to communicate with its command and control centre on the deep web (the part of the internet not visible to search engines). <\/p>\n
That command and control wasn't active - a sign perhaps \"these folks didn't even properly set up their command infrastructure properly before launching\", according to another researcher. <\/p>\n
And there was another weakness in the malware, found by a 22-year-old security researcher in the UK, who goes by the handle of MalwareTech (MT). <\/p>\n
The malware checked a site. MT bought the domain for a few pounds - and ended up slowing the spread of the attack. Without realising it, he had stumbled on a kill switch for the ransomware. <\/p>\n
\"The kill switch wasn't discovered until about three hours after we'd bought the domain which had already killed all subsequent infections,\" MT told Sky News. <\/p>\n
\"From what I can see it killed every infection that contacted our C2 (command and control server).\" <\/p>\n
:: Hack exposes serious NHS vulnerabilities <\/p>\n
The hackers had built in the kill switch, but not registered the site. <\/p>\n
If that site was active, a kill switch would activate, stopping the worm's spread. By activating the domain, MT slowed the spread. <\/p>\n
Nor was MT impressed by the sophistication of the attack. <\/p>\n
\"Although the exploit used is very sophisticated (taken from NSA leak), the ransomware itself seems somewhat amateur\", he told Sky News. <\/p>\n
That raises more questions about NHS systems, which a Sky News investigation found to be underfunded and lacking last year - and also why the UK government didn't do more to make sure they were secure. <\/p>\n
While everyone, including the newish National Cybersecurity Centre, part of GCHQ, was \"monitoring the situation\", a handful of volunteers actually brought the ransomware to a halt. <\/p>\n
<\/p>\n
Go here to see the original: As hospital after hospital went offline, security researchers around the world started poring over the ransomware that had gone round the globe. And one 22-year-old in the UK ended up saving thousands more computers across the world being infected Continue reading
\nAnonymous hero disrupts hack with 'kill switch' - Sky News<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"