WannaCry and the accidental kill switch

The story

On May 12, 2017, ransomware called WannaCry began spreading from computer to computer on its own, using a flaw in how Windows shares files across a network. It encrypted files and demanded payment.

Among the hardest hit was Britain’s National Health Service. Hospitals and clinics lost access to systems, and thousands of appointments and operations were cancelled. Car factories, railways and phone companies in other countries were hit too.

That afternoon, a young British security researcher named Marcus Hutchins was looking at the code and noticed it tried to contact a web address that did not exist. He registered the address to see what would happen. Without meaning to, he had flipped a kill switch: the ransomware checked that address before spreading, and stopped spreading when it got an answer. That slowed the outbreak sharply. It did not unlock computers that were already infected, and copies changed to remove the check appeared within days.

The US and UK governments later blamed North Korea for the attack.

The fix already existed

Microsoft had released a fix for the flaw two months earlier. The computers that were hit had not installed it, or were running versions of Windows so old they no longer received updates.

The lesson today

WannaCry is the clearest example of why patching and replacing out-of-date systems matter. The attack spread across networks with no one clicking anything. The organizations that had installed the update were simply not affected.

Timely patching, regular checks for systems that are missing updates, and recovery steps that have been tested before they are needed are the safeguards that stop an outbreak like this from becoming a crisis.