WannaCry: the ransomware worm that hit the NHS

On May 12, 2017, a worm called WannaCry spread to more than 200,000 computers in at least 100 countries. A worm copies itself from computer to computer on its own; this one was also ransomware, which locks files and demands money to unlock them. It used a flaw in Windows file sharing that Microsoft had fixed two months earlier, and in England it disrupted the National Health Service (NHS) for days.

How it worked

Windows computers share files and printers over a network protocol called SMB. Its first version, SMBv1, had several bugs in how it handled certain requests. The one WannaCry used is a size miscalculation: a crafted network packet overflows a buffer, a reserved piece of memory, inside the Windows kernel, the core of the system. Anyone who can reach port 445, the network door for file sharing, can run code with the highest rights. In practice, no password is needed.

The attack tool for this flaw, EternalBlue, came from tools stolen from the US National Security Agency (NSA), Microsoft said. A group calling itself the Shadow Brokers published it on April 14, 2017, together with other tools. Microsoft confirmed that its security update MS17-010 of March 14 already fixed all of them.

WannaCry packed EternalBlue and DoublePulsar, a backdoor that gives attackers a hidden way back in, into a worm. Each infected computer scanned its own network and random internet addresses for an open port 445 and copied itself on. On every new victim, it encrypted the files, each with its own key, and locked those keys with a lock that only the attackers could open. The ransom note demanded 300 US dollars in Bitcoin, 600 dollars after three days, and threatened to delete the files after seven days.

Before it did anything, the worm tried to reach a long web address that no one had registered, and stopped if that worked. That check would turn out to be its off switch.

Reach and damage

The UK National Audit Office (NAO), which checks public spending, counted more than 200,000 affected computers in at least 100 countries. Its report on the NHS shows what the worm did to one large organization.

In England, 34 NHS trusts, the bodies that run hospitals and other health services, were infected and locked out of devices, and 46 more were disrupted without being infected: at least 80 of 236 trusts. A further 603 primary care and other NHS organizations were infected, including 595 GP practices, the offices of family doctors. The worm also infected 1,220 pieces of diagnostic equipment, 1 % of all such NHS equipment. Five hospital trusts had to send emergency ambulances to other hospitals.

NHS England identified 6,912 cancelled appointments in the first week and estimated the total at around 19,494.

The UK Department of Health and Social Care estimates the cost to the NHS at about GBP 92 million: GBP 19 million of lost patient care and GBP 73 million of IT costs. Most of it, GBP 72 million, arose after the attack.

No NHS organization paid the ransom. Worldwide, few victims did: an analysis of the worm’s three Bitcoin addresses counted 238 ransom payments up to October 2, 2017, worth about USD 86,000 at the exchange rates of the day.

The fix and the response

Microsoft had fixed the flaw on March 14, 2017, with security update MS17-010, rated critical for all supported versions of Windows. Every infected NHS organization had run unpatched or unsupported Windows, the NAO found.

On the evening of May 12, a UK security researcher activated the kill switch by registering the web address the worm checked for. From then on, new infections stopped locking devices. NHS England had declared a national major incident at 4 p.m. that day; it stood the incident down on May 19. By the evening of May 14, 3,486 GP practices, 44 %, had installed the necessary patches.

On May 13, Microsoft released emergency patches for Windows XP, Windows 8, and Windows Server 2003, versions it no longer supported.

The NVD, the US National Vulnerability Database, rates the flaw 8.8 out of 10. Its score assumes that the attacker needs a basic user account; Microsoft says an attacker without one can use the flaw.

What happened next

About six weeks later, the same Windows flaw helped spread NotPetya, which hit companies in Ukraine and 64 more countries.