WannaCry, start to finish: a leaked spy tool, an unapplied patch and a $10.69 off switch

On May 12, 2017, a piece of ransomware reached more than 200,000 computers in about 150 countries in a single afternoon, and the fix that would have stopped it had been sitting on Microsoft's website for 2 months.^[2][11] This long read follows WannaCry from a leaked spy agency tool to England's hospitals, the accidental off switch, the arrest nobody expected, the attribution to North Korea, and the one control that would have kept it out.

The stolen spy tool behind WannaCry

Someone then attached the leaked exploit to ransomware, software that scrambles files and demands payment to unscramble them. The result was a worm, meaning a program that copies itself from machine to machine with no human help. Each infected computer locked its owner's files, displayed a ransom note asking for bitcoin, and went looking for the next vulnerable neighbor on the network and on the internet.^[11] There was no email to delete and no link to avoid. One unpatched computer with file sharing exposed was enough.

How WannaCry hit England's hospitals

The worm began spreading on Friday, May 12, 2017.^[1] Within hours it had reached companies across Europe and beyond. Spain's largest telephone company told staff to shut down their computers, carmaker Renault halted production at some plants in France, Nissan's factory in Sunderland in northern England was hit, and ransom notes appeared on departure boards at German rail stations.^[4]

England's National Health Service took the worst of it. The National Audit Office, the government's spending watchdog, later found that at least 81 of the 236 hospital trusts in England were affected, about a third of the total, along with 603 primary care and other NHS organizations, including 595 family doctor practices.^[1] Five emergency departments, in London, Essex, Hertfordshire, Hampshire and Cumbria, had to send some patients elsewhere. The audit office could identify 6,912 cancelled appointments directly and estimated the true figure at more than 19,000.^[1]

The common thread was plain. Every NHS organization the audit office examined had been infected through Windows systems that were either missing the March update or too old to receive it.^[1] Nobody in the NHS paid the ransom, and the audit office found no evidence that patient data had been taken.^[1] The worm was not after records. It simply locked whatever it reached, and in a hospital what it reached were the systems used to book scans, read results and move patients.

The $10.69 kill switch

That same afternoon a 22-year-old malware researcher working from his home in England was picking apart a sample of the worm. He noticed that before it did anything, each copy tried to contact a long, nonsense web address that nobody owned. He registered the address for $10.69, a routine habit he used to watch what malware was doing.^[5] It turned out to be an off switch. Once the address answered, new copies of the worm that could reach it stopped instead of encrypting files.^[5][10]

The audit office credited that registration, which took effect between May 12 and May 15, with halting the attack and preventing much wider disruption.^[1] It was not a cure. Machines already locked stayed locked, and a copy running on a network cut off from the internet could not see the answer. Between May 15 and mid-September, 92 NHS organizations, including 21 trusts, were still found contacting the address, a sign the worm was sitting on their machines.^[1]

Microsoft also took an unusual step. On May 13 it released an emergency fix for Windows XP and other systems it had long since stopped supporting, so that organizations still running them had some protection.^[6] Microsoft's president used the moment to criticize governments for keeping software flaws secret instead of reporting them, comparing the leak to the theft of military weapons.^[7]

The ransom, the bill and the researcher's arrest

For an attack that spanned the globe, the ransom haul was small. The 3 bitcoin wallets named in the ransom note took in roughly $140,000 in total, and in early August 2017 they were emptied in a series of withdrawals.^[8] The design of the payment system made it hard for the attackers to tell who had paid, which is one reason paying was never a reliable way to get files back.

The real cost landed on the victims. In October 2018 the Department of Health and Social Care estimated that WannaCry cost the NHS about 92 million pounds: about 19 million in lost output while services were disrupted and about 73 million in IT repair and support afterward. Officials called it a broad estimate.^[14]

The researcher's story took a turn of its own. In early August 2017, after attending security conferences in Las Vegas, he was arrested by the FBI on charges that had nothing to do with WannaCry. Prosecutors said that years earlier he had helped create and sell banking malware that stole login details.^[9] In April 2019 he pleaded guilty to 2 counts.^[15] On July 26, 2019, a federal judge in Wisconsin sentenced him to time served and 1 year of supervised release, and said his role in stopping WannaCry weighed heavily against the harm of the malware he admitted writing.^[10]

How WannaCry was traced to North Korea

On December 19, 2017, the British government said it was highly likely that a North Korean group was behind WannaCry, and the White House publicly attributed the attack to North Korea the same week.^[12][13]

On September 6, 2018, the Justice Department charged a North Korean computer programmer who, prosecutors say, worked for a government front company and belonged to a team behind a string of attacks, including WannaCry, the 2014 attack on Sony Pictures and the $81 million theft from Bangladesh Bank in 2016.^[11] Investigators linked the cases through shared code and shared infrastructure, such as the same accounts and servers turning up in more than one operation.^[11] The defendant has not been brought to a U.S. court, and the charges remain allegations.

The attribution did not change what the NHS had learned about itself. The audit office noted that before the attack there was no formal process for checking whether local NHS bodies had actually acted on critical security alerts.^[1] The warnings had gone out. Nobody was tracking whether they landed.

What would have stopped the worm

Put the sequence side by side. The flaw was public and fixed in March. The exploit was public in April. The worm arrived in May. At every step, a machine that had installed the March update was safe from this particular attack, and a machine running an unsupported system that could not be updated was a standing invitation.^[1][2]

The worm also moved as far as it did because the file-sharing service was reachable from places it never needed to be reached from: from the open internet, and between computers inside a network that had no reason to talk to each other. Closing that door at the edge of the network, and limiting it inside, would have slowed the spread even where patching lagged.^[1]

WannaCry was stopped by luck and a $10.69 web address. It could have been stopped weeks earlier by a routine update that had already been written, tested and published.

Timeline

The missing control

What it means now

WannaCry is remembered for its lucky ending, but the lesson is in its beginning. The flaw was known, the fix was free, and the warnings had been sent. The gap was between a warning and a finished job, and nobody was measuring it.

Most small businesses will never be targeted by a spy agency's leaked tools. They do not need to be. Worms and ransomware crews scan the whole internet for the same unpatched doors, and they do not check who owns the building. An update installed this week is still the cheapest security there is.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.