{"data":{"case":{"actions":{"de":["Installiere **MS17-010** oder ein späteres Windows-Update; unter Windows XP, Windows 8 oder Server 2003 installiere den Notfall-Patch vom Mai 2017, denn diese Versionen bekommen keine regulären Updates mehr.","Schalte **SMB Version 1** ab, das alte Protokoll für die Dateifreigabe, das der Wurm nutzte.","Blockiere Port 445 am Übergang deines Netzwerks zum Internet, damit niemand von außen die Windows-Dateifreigabe erreicht."],"en":["Install **MS17-010** or any later Windows update; on Windows XP, Windows 8 or Server 2003, install the emergency patch of May 2017, since these versions no longer get regular updates.","Switch off **SMB version 1**, the old file-sharing protocol the worm used.","Block port 445 at the edge of your network, so that no one can reach Windows file sharing from the internet."]},"criteria":{"damage":{"de":"In England wurden etwa 19.494 Termine abgesagt, und fünf Krankenhaus-Trusts mussten Rettungswagen umleiten; die Kosten für den NHS werden auf etwa 92 Millionen Pfund geschätzt (National Audit Office; britisches Gesundheitsministerium).","en":"In England, about 19,494 appointments were cancelled and five hospital trusts had to divert ambulances; the cost to the NHS is estimated at about GBP 92 million (National Audit Office; Department of Health and Social Care).","met":true},"exploitation":{"de":"WannaCry war ein Wurm: Jeder infizierte Computer suchte in seinem Netzwerk und im Internet nach neuen Opfern und infizierte sie selbstständig (Cisco Talos).","en":"WannaCry was a worm: every infected computer searched its network and the internet for new victims and infected them on its own (Cisco Talos).","met":true},"reach":{"de":"Mehr als 200.000 Computer in mindestens 100 Ländern waren betroffen (britischer Rechnungshof, National Audit Office).","en":"More than 200,000 computers in at least 100 countries were affected (UK National Audit Office).","met":true},"response":{"de":"Microsoft veröffentlichte Notfall-Patches für Windows XP, Windows 8 und Windows Server 2003, die es nicht mehr unterstützte, und NHS England rief eine nationale Großschadenslage aus (Microsoft; National Audit Office).","en":"Microsoft released emergency patches for Windows XP, Windows 8 and Windows Server 2003, which it no longer supported, and NHS England declared a national major incident (Microsoft; National Audit Office).","met":true}},"cves":["CVE-2017-0144"],"cvss":8.8,"cvss_version":"3.1","dates":[{"date":"2017-03-14","key":"patched"},{"date":"2017-04-14","de":"Die Shadow Brokers veröffentlichen EternalBlue, ein der NSA gestohlenes Angriffswerkzeug","en":"The Shadow Brokers publish EternalBlue, an attack tool stolen from the NSA"},{"date":"2017-05-12","key":"outbreak"},{"date":"2017-05-12","de":"Am Abend aktiviert ein britischer Sicherheitsforscher den Kill-Switch","en":"In the evening, a UK security researcher activates the kill switch"},{"date":"2017-05-13","de":"Notfall-Patches für Windows XP, Windows 8 und Windows Server 2003","en":"Emergency patches for Windows XP, Windows 8 and Windows Server 2003"},{"date":"2017-05-19","de":"NHS England erklärt die nationale Großschadenslage für beendet","en":"NHS England stands down the national major incident"}],"de":{"credit":"Von Microsoft nicht genannt; das Angriffswerkzeug EternalBlue wurde dem US-Geheimdienst NSA gestohlen","fixed":"MS17-010 (14. März 2017); Notfall-Patches für Windows XP, Windows 8 und Windows Server 2003 (13. Mai 2017)","product":"Windows-Computer mit dem alten Dateifreigabe-Protokoll SMBv1","summary":"Ein Ransomware-Wurm traf mit einem geleakten NSA-Werkzeug und einer Windows-Lücke mehr als 200.000 Computer und störte Krankenhäuser in England."},"disclosed":"2017-05-12","en":{"credit":"Not named by Microsoft; the attack tool EternalBlue was stolen from the US NSA","fixed":"MS17-010 (March 14, 2017); emergency patches for Windows XP, Windows 8 and Windows Server 2003 (May 13, 2017)","product":"Windows computers with the old file-sharing protocol SMBv1","summary":"A ransomware worm used a leaked NSA tool and a Windows flaw to hit more than 200,000 computers, and it disrupted hospitals in England."},"figures":[{"de":"Computer in mindestens 100 Ländern getroffen","en":"computers hit in at least 100 countries","value":"200,000+"},{"de":"abgesagte NHS-Termine in England, nach Schätzung von NHS England","en":"NHS appointments cancelled in England, by NHS England's estimate","value":"19,494"},{"de":"Millionen Pfund: die geschätzten Kosten für den NHS","en":"million British pounds: the estimated cost to the NHS","value":"92"},{"de":"Lösegeldzahlungen weltweit bis zum 2. Oktober 2017, zusammen rund 86.000 US-Dollar wert","en":"ransom payments worldwide by October 2, 2017, worth about USD 86,000","value":"238"}],"kev":"2022-02-10","key":"wannacry","name":"WannaCry","product":"Microsoft Windows (SMBv1)","sources":[{"de":"Microsoft-Sicherheitsbulletin MS17-010","title":"Microsoft security bulletin MS17-010","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010"},{"de":"Microsoft: die geleakten Angriffswerkzeuge und das Update, das sie unschädlich macht (April 2017)","title":"Microsoft: the leaked attack tools and the update that fixes them (April 2017)","url":"https://www.microsoft.com/en-us/msrc/blog/2017/04/protecting-customers-and-evaluating-risk"},{"de":"Microsoft: Hinweise für Kunden und Notfall-Patches zu WannaCrypt (Mai 2017)","title":"Microsoft: customer guidance and emergency patches for WannaCrypt (May 2017)","url":"https://www.microsoft.com/en-us/msrc/blog/2017/05/customer-guidance-for-wannacrypt-attacks"},{"de":"Microsoft: Die Exploits wurden der NSA gestohlen (Mai 2017)","title":"Microsoft: the exploits were stolen from the NSA (May 2017)","url":"https://blogs.microsoft.com/on-the-issues/2017/05/14/need-urgent-collective-action-keep-people-safe-online-lessons-last-weeks-cyberattack/"},{"de":"NVD: CVE-2017-0144","title":"NVD: CVE-2017-0144","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0144"},{"de":"Britischer Rechnungshof: Untersuchung zu WannaCry und dem NHS","title":"UK National Audit Office: investigation into WannaCry and the NHS","url":"https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/"},{"de":"Britischer Rechnungshof: vollständiger Bericht zu WannaCry und dem NHS (PDF)","title":"UK National Audit Office: full report on WannaCry and the NHS (PDF)","url":"https://www.nao.org.uk/wp-content/uploads/2017/10/Investigation-WannaCry-cyber-attack-and-the-NHS.pdf"},{"de":"Britisches Gesundheitsministerium: Fortschrittsbericht zur Cyber-Resilienz, mit der Kostenschätzung (PDF)","title":"UK Department of Health and Social Care: progress update on cyber resilience, with the cost estimate (PDF)","url":"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/747464/securing-cyber-resilience-in-health-and-care-september-2018-update.pdf"},{"de":"Bitcoin-Analyse der Lösegeldzahlungen an WannaCry und NotPetya (Computers \u0026 Security, 2018)","title":"Bitcoin analysis of WannaCry and NotPetya ransom payments (Computers \u0026 Security, 2018)","url":"https://arxiv.org/pdf/1804.01341"},{"de":"Cisco Talos: Analyse von WannaCry (Anbieterdaten)","title":"Cisco Talos: WannaCry analysis (vendor data)","url":"https://blog.talosintelligence.com/2017/05/wannacry.html"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","year":2017}},"description":"A worm used a leaked NSA attack tool and a Windows flaw to lock more than 200,000 computers. How it spread, what it cost the NHS, and the fix.","language":"en","latest_measurement":"2026-10-23","method":"latency-v3","method_page":"https://crackthe.net/method/","source":"https://crackthe.net/","text":"On May 12, 2017, a worm called WannaCry spread to more than 200,000 computers in at least 100 countries. A worm copies itself from computer to computer on its own; this one was also ransomware, which locks files and demands money to unlock them. It used a flaw in Windows file sharing that Microsoft had fixed two months earlier, and in England it disrupted the National Health Service (NHS) for days.\nHow it worked Windows computers share files and printers over a network protocol called SMB. Its first version, SMBv1, had several bugs in how it handled certain requests. The one WannaCry used is a size miscalculation: a crafted network packet overflows a buffer, a reserved piece of memory, inside the Windows kernel, the core of the system. Anyone who can reach port 445, the network door for file sharing, can run code with the highest rights. In practice, no password is needed.\nThe attack tool for this flaw, EternalBlue, came from tools stolen from the US National Security Agency (NSA), Microsoft said. A group calling itself the Shadow Brokers published it on April 14, 2017, together with other tools. Microsoft confirmed that its security update MS17-010 of March 14 already fixed all of them.\nWannaCry packed EternalBlue and DoublePulsar, a backdoor that gives attackers a hidden way back in, into a worm. Each infected computer scanned its own network and random internet addresses for an open port 445 and copied itself on. On every new victim, it encrypted the files, each with its own key, and locked those keys with a lock that only the attackers could open. The ransom note demanded 300 US dollars in Bitcoin, 600 dollars after three days, and threatened to delete the files after seven days.\nInfected computersearches its network and the internet for port 445 SMB version 1a crafted packet overflows a buffer in the kernel New victimfiles encrypted, 300 US dollars demanded Next roundthe new victim starts searching too No one had to click anything: an open port 445 and a missing update were enough. Before it did anything, the worm tried to reach a long web address that no one had registered, and stopped if that worked. That check would turn out to be its off switch.\nReach and damage The UK National Audit Office (NAO), which checks public spending, counted more than 200,000 affected computers in at least 100 countries. Its report on the NHS shows what the worm did to one large organization.\nIn England, 34 NHS trusts, the bodies that run hospitals and other health services, were infected and locked out of devices, and 46 more were disrupted without being infected: at least 80 of 236 trusts. A further 603 primary care and other NHS organizations were infected, including 595 GP practices, the offices of family doctors. The worm also infected 1,220 pieces of diagnostic equipment, 1 % of all such NHS equipment. Five hospital trusts had to send emergency ambulances to other hospitals.\nNHS England identified 6,912 cancelled appointments in the first week and estimated the total at around 19,494.\nNHS appointments cancelled because of WannaCry Identified by NHS England, May 12 to 186,912 Estimated in total19,494 Source: UK National Audit Office. The total is an estimate based on the cancellations that were found.\nThe UK Department of Health and Social Care estimates the cost to the NHS at about GBP 92 million: GBP 19 million of lost patient care and GBP 73 million of IT costs. Most of it, GBP 72 million, arose after the attack.\nNo NHS organization paid the ransom. Worldwide, few victims did: an analysis of the worm\u0026rsquo;s three Bitcoin addresses counted 238 ransom payments up to October 2, 2017, worth about USD 86,000 at the exchange rates of the day.\nRansom payments to WannaCry, May 12 to October 2, 2017 Payments of USD 300192 Payments of USD 60046 Source: Bitcoin payment analysis, Computers \u0026amp; Security, 2018. Together 47.17 Bitcoin, worth USD 86,076.76 at daily average prices.\nThe fix and the response Microsoft had fixed the flaw on March 14, 2017, with security update MS17-010, rated critical for all supported versions of Windows. Every infected NHS organization had run unpatched or unsupported Windows, the NAO found.\nOn the evening of May 12, a UK security researcher activated the kill switch by registering the web address the worm checked for. From then on, new infections stopped locking devices. NHS England had declared a national major incident at 4 p.m. that day; it stood the incident down on May 19. By the evening of May 14, 3,486 GP practices, 44 %, had installed the necessary patches.\nOn May 13, Microsoft released emergency patches for Windows XP, Windows 8, and Windows Server 2003, versions it no longer supported.\nThe NVD, the US National Vulnerability Database, rates the flaw 8.8 out of 10. Its score assumes that the attacker needs a basic user account; Microsoft says an attacker without one can use the flaw.\nWhat happened next About six weeks later, the same Windows flaw helped spread NotPetya, which hit companies in Ukraine and 64 more countries.","title":"WannaCry: the ransomware worm that hit the NHS","url":"https://crackthe.net/vulnerabilities/wannacry/"}