WannaCry: The Ransomware That Stopped the NHS

The ransomware is the story of the week, and the story is the Friday: the May 12 attack that hit the hospitals and the banks and the factories, the worm that spread without a click, the screens that lit up with the red demand, the machines that locked and the data that waited. The ransomware is WannaCry, and WannaCry is the biggest outbreak the internet has seen: more than 200,000 machines in 150 countries, the National Health Service in England with 47 trusts directly affected and 13 other NHS organisations, roughly 19,000 appointments cancelled, the operations postponed, the ambulances diverted. The outbreak is the May 2017 story, and the story is the lesson: the patching that was postponed, the legacy systems that were trusted, the worm that travelled through the gaps.

This article is the story of the outbreak: how the worm spread, why the NHS was exposed, and what every engineering team should change.

1. The Friday That Hospitals Stopped

The Friday is the anchor, and the anchor is the date: May 12, 2017, the day the screens went red across the NHS, the day the phones rang in the IT departments, the day the appointments were cancelled by the thousands. The Friday is the timeline: the first infections at the lunch hour, the spread through the afternoon, the trusts that shut down the systems to contain the damage, the staff that fell back on paper records and pens. The Friday is the NHS reality: 47 trusts directly affected, 13 other NHS organisations caught in the wave, roughly 19,000 appointments cancelled, the patients who waited longer.

The Friday is also the shock: the attack that was not aimed at the hospitals, that hit them because they were exposed, that treated the National Health Service as collateral damage. The Friday is the lesson in the making: the organisation that everyone trusted, the systems that everyone assumed, the weekend that became a national incident. The Friday that hospitals stopped was the opening, and the opening was the warning.

2. How the Worm Spread

The worm is the technique, and the technique is EternalBlue: the exploit that targeted the SMBv1 file sharing protocol, the vulnerability that Microsoft had patched in March with the MS17-010 update, the code that the Shadow Brokers leaked in April, the tool that was stolen from the NSA. The worm is the April 2017 leak: the hacking tools dumped online, the exploit that became public, the race between the defenders and the attackers, the race that the attackers won. The worm is the spread: the machine that was infected, the machine that scanned the network, the neighbour that was found, the lateral movement through the SMB ports, the infection that travelled without the user touching anything.

The worm is also the irony: the patch that existed, the update that was released in March, the systems that were never updated, the Windows 7 machines that carried the vulnerable protocol, the organisations that delayed the maintenance. The worm is the technical lesson: the exploit that needed no click, the malware that moved on its own, the network that carried the attack, the patching that was the only defence. The worm that spread was the method, and the method was the exposure.

3. Why the NHS Was Exposed

The exposure is the history, and the history is the legacy: the NHS that ran Windows XP in places, the operating system that Microsoft stopped supporting in April 2014, the machines that kept running without the updates, the trusts that could not afford the replacements, the budget that never quite stretched. The exposure is the May 2017 emergency: Microsoft releasing a patch for the unsupported Windows XP, the extraordinary step that showed the scale of the problem, the hospitals that scrambled to update, the systems that could not be updated at all. The exposure is the reality: the imaging equipment that ran the old software, the devices that were never designed for the network, the estate that was decades old.

The exposure is also the discipline: the patch that was released in March, the update that was not applied, the maintenance windows that slipped, the risk that was accepted because the attack seemed unlikely. The exposure is the NHS lesson: the organisations that run the critical infrastructure, the systems that are never replaced, the patching that is postponed until the emergency, the price that is paid in the crisis. The exposure that was revealed was the legacy, and the legacy was the risk.

4. The Kill Switch Hero

The hero is the researcher, and the researcher is the young: Marcus Hutchins, 22 years old, the British security analyst who blogged as MalwareTech, the observer who watched the worm from a house in the south of England. The hero is the May 12 discovery: the domain found inside the code, the long nonsense address that the malware checked before it spread, the registration that cost a few dollars, the sinkhole that began to swallow the traffic. The hero is the timing: roughly 3pm UTC on the Friday, the hours after the outbreak began, the registration that slowed the spread around the world, the attack that lost its command and control.

The hero is also the humility: the researcher who said he was just trying to understand the malware, who watched the infections pour into the sinkhole, who did not set out to stop the attack. The hero is the reminder: the defenders who are often the young and the curious, the people who look at the code because they want to know, the community that works in the open. The kill switch that was found was the luck, and the luck was the skill.

5. The Ransom Economics

The ransom is the demand, and the demand is the price: $300 in Bitcoin per machine, the cryptocurrency that is hard to trace, the payment that unlocks the files, the countdown that pressures the victim, the business model of the attack. The ransom is the economics: the machines that were locked, the files that were encrypted, the organisations that weighed the payment against the recovery, the backups that decided the answer. The ransom is the reality: the few who paid, the many who did not, the wallets that stayed mostly empty, the campaign that earned a fraction of the damage it caused.

The ransom is also the design: the Bitcoin addresses that were public, the payments that could be watched, the researchers who tracked the flow, the attackers who waited for the money that barely came. The ransom is the lesson: the ransomware that is a business, the criminals who run it like a company, the payments that fund the next attack, the backups that make the payment unnecessary. The ransom that was demanded was the model, and the model was the crime.

6. The Global Map

The map is the spread, and the spread is the scale: more than 200,000 machines in 150 countries, the numbers that grew through the weekend, the estimates that kept climbing, the outbreak that became the largest of its kind. The map is the names: Telefonica in Spain, the telecom that told the staff to switch off the computers, FedEx that felt the delays, Renault that stopped the production lines in France, Deutsche Bahn that showed the error screens at the stations, the companies that appeared one by one. The map is the May 2017 picture: the attack that hit the hospitals and the banks and the factories, the countries with the modern networks and the countries without.

The map is also the warning: the worm that did not care about borders, the malware that moved through the connected world, the internet that is one network, the defences that are only as strong as the weakest machine. The map is the scale lesson: the 200,000 machines that were the count, the millions that were exposed, the patch that was the difference between the infected and the spared. The map that was drawn was the reach, and the reach was the lesson.

7. What Security Teams Should Change

The change is the practice, and the practice is the patch: the updates that must be applied, the windows that must be kept, the inventory that must be known, the systems that must be tracked, the discipline that stops the worm. The change is the segmentation: the networks that must be divided, the hospital machines that must not reach the internet, the critical systems that must be isolated, the blast radius that must be contained. The change is the backup: the copies that must exist, the restores that must be tested, the recovery that must be faster than the ransom, the plan that must be rehearsed.

The change is also the leadership: the security that must be funded, the legacy that must be retired, the risk that must be named, the board that must understand, the budget that must follow the threat. The change is the May 2017 lesson: the teams that were overwhelmed, the organisations that were exposed, the ones that survived because they had prepared, the difference that the preparation made. The change that is needed was the lesson, and the lesson was the list.

8. The Engineering Lesson About Patching

The lesson is the engineering, and the engineering is the boring: the patch that is applied, the update that is tested, the maintenance that is scheduled, the work that is invisible and unglamorous and vital. The lesson is the timeline: the vulnerability that Microsoft patched in March, the exploit that the Shadow Brokers leaked in April, the worm that struck in May, the chain that was broken by one update. The lesson is the priority: the patching that is postponed, the risk that is deferred, the attack that arrives on the attacker's schedule, the cost that is paid in the emergency.

The lesson is also the system: the legacy that must be managed, the unsupported that must be replaced, the inventory that must be complete, the culture that must treat the patch as the foundation. The lesson is the May 2017 meaning: the worm that stopped the NHS, the update that would have stopped the worm, the discipline that was missing, the price that was paid. WannaCry is the 2017 story, and the story is the lesson: the boring work that saves the day, the patch that is the defence, the systems that will be tested again, the teams that will be ready.

Tags

#technology #engineering