There is no consensus in the industry on what the delivery method/initial infection vector is.


There have been several theories:  Unit 42 believes the most likely delivery method is method #2.


However, this is not conclusively provenLateral Movement


The WanaCrypt0r ransomware spreads itself by heavily scanning over TCP port 445 (associated with SMB) and attempting to exploit the ETERNALBLUE vulnerability on systems.


A successful attack against this vulnerability will infect the target system with the WanaCrypt0r ransomware, which will encrypt data on the target system and attempt to spread itself once again.


Multiple vendors report that the malware includes the ability to spread via port 445 scans and attacks against the ETERNALBLUE vulnerability not only on internal networks but also across the Internet.


These reports indicate that in addition to the internal lateral movement already outlined, the WanaCrypt0r ransomware will scan for port 445 on random external IP addresses and if it finds an IP address with an open port 445, it will then scan all devices on the same /24 IP range (i.e. that share the first three octets as that IP address with the open port 445).  In general, WanaCrypt0r does not have C2 capabilities but it does utilize the TOR network to communicate encryption keys for decryption upon payment of ransom.


It has been reported that the DOUBLEPULSAR backdoor (also from the Equation Group leak by Shadow Brokers) is installed and used to execute the malware after successful exploitation of a host via ETERNALBLUE, but this warrants further analysis.


Overall, WanaCrypt0r has been a notable incident within the security community, as the threat couples a wormable vulnerability/exploit with a ransomware family.


Users are urged to apply the necessary Microsoft patch to protect themselves against this threat.


For protections, customers are advised to view this blog post that outlines the various ways the Palo Alto Networks platform prevents this threat.  Cyber Threat Alliance member ElevenPaths has developed a tool which can be used to attempt to recover some files deleted by WanaCrypt0r.


You can find more information on this tool here.


Register for Ignite ’17 Security Conference  Vancouver, BC June 12–15, 2017


Ignite ’17 Security Conference is a live, four-day conference designed for today’s security professionals.


Hear from innovators and experts, gain real-world skills through hands-on sessions and interactive workshops, and find out how breach prevention is changing the security industry.


Visit the Ignite website for more information on tracks, workshops and marquee sessions.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!  By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


The latest episode of the Don’t Panic cybersecurity podcast is now live.


In this latest episode, Ryan goes back to the topic he talked about in his 2018 predictions piece “The Era of Software Supply-Chain Attacks Has Begun”: Software Supply Chain attacks.


As a reminder, “Don’t Panic,” is the official podcast of Unit 42, the Palo Alto Network threat intelligence team and features Palo Alto Networks CSO Rick Howard and Palo Alto Networks Senior Vice President, Threat Intelligence Ryan Olson.  You can find this episode and other Palo Alto Networks podcasts on iTunes, Google Play, or integrate the RSS feed into your favorite service.


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


Late last month reports surfaced that a new Internet Explorer vulnerability (CVE-2014-1776) was being exploited in targeted attacks.


The vulnerability allows an attacker to take full control over the system after a user views a web page in their browser.


According to Microsoft, it affects versions of Internet Explorer from version 6 to 11, meaning that almost all IE users are vulnerable to this bug.


This vulnerability is so widespread that Microsoft has released patches to protect Windows XP, for which Microsoft has ended support since April 8, 2014.


Researchers from Palo Alto Networks have investigated this exploit in depth and concluded that this is a Use-After-Free vulnerability that occurs when Internet Explorer tries to reuse a freed CMarkup object.


Attackers can manipulate memory allocations by using JavaScript to allocate an object that is freed before all references to that object are removed.


Once the object is free the Flash file will overwrite a length field in the vector object and allow arbitrary memory access.


After that the exploit uses a ROP chain to overwrite the virtual function table of a sound object to gain full control.


The exploit utilized several advanced exploit techniques to make it almost 100% reliable.


The exploit used in the wild contains two major parts, one is HTML which sets up the page to exploit, and the other is a Flash file which builds the memory layout in IE process and triggers the bug.


Two parts must be combined to ensure a successful attack.


The attack separated critical code into different pieces so that researchers could not reproduce the original exploit until they have both files.


The techniques used in this exploit are similar to those used in other recent attacks.


Last year, exploitation of CVE-2013-3163 targeted Internet Explorer 8 and earlier this year, we found exploitation of CVE-2014-0322 in Internet Explorer 10.


Similarities in each of these exploits indicate that they may have been created by the same author.


All three exploits share the same exploit techniques:  All the Flash files used across the exploits have similar structures and even the same variable names.


For example, they all use the Timer object to check if a Vector object is modified.


The Timers are all set to repeat every one second for 4,096 seconds.


The Vector object is named ‘s’ and the Sound object is named “ss” in the Flash files used in all three exploits.


The following code is snippet from the disassembled ActionScript code of CVE-2014-1776.


Neither of these variables is actually used in this exploit.


If we go back and examine the exploit code for CVE-2013-3163, we see that the string ‘org’ was originally used as the trigger, and the variable ‘found’ was originally used as a flag indicating if the Vector object was modified.


It appears that the attacker reused the code from the earlier exploit and forgot to remove the unnecessary variables.


s[_local28][(((_local41 - _local12) / 4) + 9)] = _local9;  s[_local28][(((_local41 - _local12) / 4) + 10)]


= 13078672;


s[_local28][(((_local41 - _local12) / 4) + 11)]


= _


s[_local28][(((_local41 - _local12) / 4) + 12)]


= 3096481936;


s[_local28][(((_local41 - _local12) / 4) + 13)]


= (this.m_longArrBase - 8);


s[_local28][(((_local41 - _local12) / 4) + 14)]


s[_local28][(((_local41 - _local12) / 4) + 15)]


= this.m_rawLen;


s[_local28][(((_local41 - _local12) / 4) + 16)]


= 3968066955;


s[_local28][(((_local41 - _local12) / 4) + 17)]


= 753635372;


The exploit uses the code above to restore the corrupted object and save the stack frame on the heap so that the process would not crash after the exploit is successful.


All three exploits use the same method and similar addresses to achieve that goal, even including the same hard coded assembly and registers.


_local10 = this.m_ZwProtectAddr;  _local41 = _local6;  s[_local28][((((_local6 - _local12) / 4) - 2) - 4)] = (_local41 & 0xFFFFF000);  s[_local28][((((_local6 - _local12) / 4) - 1) - 4)] = 0x3000;  s[_local28][((_local6 - _local12) / 4)] = _local10;  s[_local28][(((_local6 - _local12) / 4) + 1)] = (_local41 + 28);  The code above shows the Flash code setting up the ROP chain to bypass DEP and includes another interesting marker.


Normally programmers begin counting at 0 when referencing arrays, but in all three exploits they began at -2, which is quite unusual.


Additionally, each sample uses a Sound object named ‘snd’ to gain control, and they all invoke the function toString().


The many similarities between these exploits lead us to believe they were written by the same actor or group.


Or at the very least, a common template has been used to craft exploits for the three Internet Explorer vulnerabilities we analyzed.


This re-use of techniques is common among exploits, even if they were not developed by the same group, and Palo Alto Networks employs a unique payload-based signature detection methodology, which is able to look at the behaviors of an exploit to prevent similar attacks in the future.


Palo Alto Networks customers with a Threat Prevention subscription were automatically protected from exploitation of these vulnerabilities:  We suggest customers ensure they are running the latest content version on their devices and apply the patches Microsoft released on May 1, 2014.  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


In October 2017, Palo Alto Networks Unit 42 published research showing how attackers were adapting attack techniques to generate cryptocurrency for themselves.


In that research, we also showed how these attacks were very broad and grew very quickly.


At the time, we said that the sudden, surging value of cryptocurrencies was likely behind the sudden, strong rise of these new attacks.


We said that if cryptocurrency values continue to remain high, we could expect to see attackers continue to focus on finding ways to carry out attacks to gain cryptocurrency, and that those attacks would continue to adapt proven attack techniques.