Cis5205 Management Of Information Security Assessment Answers

Questions:

Answer:

The WannaCry RansomWare Attack in summary

The WannaCry Ransonware attack was first occur in May 2017 in the whole world. The attack mainly targeted the computers which was running on the windows operating system. The attack is basically they first attacks the victim’s computer and encrypt their data. After the data encryption they use to ask for a ransome amount of money from the victim to get back their data. The operating system vendor which is Microsoft though released some patches to the operating system to prevent the exploit (Mattei, 2017). The systems that are infected and running on old data security measurement are mainly targeted by the attackers.

Q1 What sort of cyber security attack was WannaCry Ransomware Attack and when did it first emerge and occur

Q2 What was the impact of the WannaCry Ransomware Attack in dollar terms for organisations globally – give two specific examples of organisations that were impacted by the WannaCry Ransomware Attack

The impact of WannaCry Ransomware attack for the global organizations are huge. Arounr 200,000 computers were attacked around 150 countries. And the amount that is loss by this attack can be of $4 billion U.S Dollar.

As a process

The process of wannacry ransomware is very simple in general. The attacker’s first search for the victims those are using old and out dated operating system. The old operating systems are often the infected system which is easy to exploit and the wannacry attacker’s main target are those device which are infected and where the security is less. After exploiting the device the attackers first encrypt the data that are in the device (Kao and Hsiao, 2018). After encrypting the data they ask ransom amount of money from the victim. The amount is basically of $300 and $600. After the victim pay the money using bitcoin which is also a crypto currency. When the ransome amount is given then the user get back his access to his/ her data. The operating systems that passed the validity of its own are mainly in the target because an operation system that is past its end of life has no security and many security loop wholes which is prone to be vulnerable (Mohurle & Patil, 2017). The wannacry attackers installed backdoors on the device that are infected and then do the next steps for the ransomware attacks. 

Technically

The hackers and the creators of the WannaCry Ransomware Attack attacks the the windows devices that are vulnerable, it already discussed earlier. The NSA developed a malware to exploit the world by using the DoublePulsar backdoor malware and by EternalBlue SMB exploit for the installation of wannacry on the windows systems. EternalBlue is a piggybank system which is the main thing behind this attack. EternalBlue and SMB protocols are exploit the windows systems (Chen and Bridges, 2017). EternalBlue.exe runs a script which targets the Windows computers to executing by using following commands:

• SMB echo request is sent to the targeted machine
• Environment is set up to exploit the system which is vulnerable
• Fingerprinting of SMB protocol is completed
• An attempt is made to exploit
• If the attack is successful, then DoublePulsar malware s being checked
• DoublePulsar pinged for a reply from SMB

The doublePulsar is a tool which bypass the measurement of authentication of a system and then creates a backdoor which allows the remote access. The DoublePulsar fully transfers the system of victims control to the hacker without even 

List of References

Chen, Q. and Bridges, R.A., 2017. Automated Behavioral Analysis of Malware A Case Study of WannaCry Ransomware. arXiv preprint arXiv:1709.08753.

Kao, D.Y. and Hsiao, S.C., 2018, February. The dynamic analysis of WannaCry ransomware. In Advanced Communication Technology (ICACT), 2018 20th International Conference on (pp. 159-166). IEEE.

Mattei, T.A., 2017. Privacy, Confidentiality, and Security of Health Care Information: Lessons from the Recent WannaCry Cyberattack. World neurosurgery, 104, pp.972-974.

Mohurle, S., & Patil, M. (2017). A brief study of wannacry threat: Ransomware attack 2017. International Journal of Advanced Research in Computer Science, 8(5).