#20 - Hacker History: WannaCry

The Cybersecurity Defenders Podcast

Content provided by LimaCharlie. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by LimaCharlie or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://player.fm/legal.

1+ y ago 18:31

MP3•Episode home

Archived series ("Inactive feed" status)

When? This feed was archived on November 03, 2023 15:07 (11M ago). Last successful fetch was on September 28, 2023 14:25 (12M ago)

Why? Inactive feed status. Our servers were unable to retrieve a valid podcast feed for a sustained period.

What now? You might be able to find a more up-to-date version using the search function. This series will no longer be checked for updates. If you believe this to be in error, please check if the publisher's feed link below is valid and contact support to request the feed be restored or if you have any other concerns about this.

In this episode of the Cybersecurity Defenders podcast, we recount some hacker history, and with the help of Marcus Hutchins, tell the story of the WannaCry ransomware attack.
The WannaCry ransomware attack was a worldwide cyberattack in May 2017 by the WannaCry ransomware cryptoworm, which targeted computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in the Bitcoin cryptocurrency. It propagated by using EternalBlue, an exploit developed by the United States National Security Agency (NSA) for Windows systems. EternalBlue was stolen and leaked by a group called The Shadow Brokers a month prior to the attack.
Researcher Marcus Hutchins discovered the kill switch domain hardcoded in the malware. Registering a domain name for a DNS sinkhole stopped the attack spreading as a worm, because the ransomware only encrypted the computer's files if it was unable to connect to that domain, which all computers infected with WannaCry before the website's registration had been unable to do. While this did not help already infected systems, it severely slowed the spread of the initial infection and gave time for defensive measures to be deployed worldwide, particularly in North America and Asia, which had not been attacked to the same extent as elsewhere.

The Cybersecurity Defenders Podcast: a show about cybersecurity and the people that defend the internet.

68 episodes

#Tech #LimaCharlie #Cybersecurity #InfoSec #Information Security #Blue Teaming #MDR #MSSP #DFIR #Cybersec #Security #Hacking