WannaCry was a ransomware attack that began on May 12, 2017 and spread through a Windows SMBv1 flaw named MS17-010. Microsoft released the patch on March 14, 2017 so patched PCs were protected. CISA advises that you patch, disable SMBv1 where patching is impossible and store backups outside the network. Paying the ransom does not guarantee file recovery.
WannaCry locked files on thousands of PCs in May 2017 and still teaches a clear lesson. Missing updates let ransomware spread across a network without a single click.
This guide explains the attack and the protection steps that CISA and Microsoft published.
What was the WannaCry Ransomware Attack?
CISA reports that WannaCry was discovered on May 12, 2017. It spreads by exploiting a Windows SMBv1 vulnerability tracked as MS17-010, and phishing is a possible way in. Attackers demanded about 0.1781 bitcoin, roughly 300 dollars at the time. See the CISA alert.
Which Windows Versions were Affected?
Microsoft states that it patched Vista, Windows 7, Windows 8.1, Windows 10 and the matching server versions through MS17-010 in March 2017. Windows XP, Windows 8 and Windows Server 2003 received the patch separately on May 13, 2017. Microsoft also states that Windows 10 customers were not targeted in this attack. See Microsoft customer guidance.
How do You Protect a PC From This Kind of Attack?
- Install the MS17-010 update or confirm that Windows Update installed it.
- Update your anti-malware software. Microsoft states that Windows Defender detects the threat as Ransom:Win32/WannaCrypt.
- Disable SMBv1 where you cannot patch and filter TCP 445, TCP 139 and UDP 137-138 at network boundaries.
- Segment your network and use least privilege access.
- Store backups in a separate location and test them on a schedule.
CISA warns that stopping SMB traffic can disrupt access to shared files and devices. Weigh that tradeoff before you edit firewall rules.
Should You Pay the Ransom?
No. CISA states that payment does not guarantee file recovery and only sends money to the attackers. Decrypting files also does not remove the infection.
What do You Do if a PC is Infected?
- Disconnect the PC. Unplug the network cable and disable Wi-Fi.
- Scan the PC. Microsoft released an updated Malicious Software Removal Tool on May 22, 2017 that detects and removes WannaCrypt.
- Restore your files. Use a clean backup that sits outside the network.
This list is practical advice built on the sources above. For wider ransomware planning see how to build a ransomware playbook and how a ransomware attack works.
Frequently Asked Questions
What was WannaCry?
WannaCry was a ransomware attack discovered on May 12, 2017. It spread through a Windows SMBv1 vulnerability tracked as MS17-010.
How did WannaCry Spread?
CISA states that it exploits the SMBv1 vulnerability MS17-010 and that phishing is a possible way in.
Does Windows Update Stop WannaCry?
Yes. Microsoft states that systems with Windows Update enabled are protected by the MS17-010 patch.
Should I Pay the Ransom?
No. CISA states that payment gives no promise of file recovery and only sends money to the attackers.
How do I Prepare for the Next Ransomware Attack?
Patch Windows, disable SMBv1 where possible and store tested backups outside the network.
Key Takeaways
- WannaCry spread through the Windows SMBv1 flaw MS17-010.
- Microsoft released the patch on March 14, 2017.
- Disable SMBv1 and filter SMB ports when you cannot patch.
- Backups outside the network make recovery possible.
- Payment gives no promise that files return.
Sources and References
This guide follows CISA and Microsoft publications.