A free tool released by ESET ‘to help combat the recent ransomware, WannaCry (WannaCryptor).’
The press release goes on to say that:
ESET’s EternalBlue Vulnerability Checker can be used to determine whether your Windows machine is patched against EternalBlue, the exploit behind the WannaCry ransomware epidemic that is still being used to spread cryptocurrency mining software and other malware.
This obviously isn’t the only way to check, and it may not be the only tool of its kind out there – I haven’t been looking for such a tool. And clearly, checking for a specific vulnerability isn’t a substitute for a sound patching strategy, or for using security software that detects malware (including WannaCryptor) reasonably reliably. But while I haven’t tested it personally, I’d be very surprised (in view of my longstanding association with ESET) if this tool didn’t do what it says on the tin, so some people and organizations might well find this useful.
Wannacry in-memory key recovery for WinXP – Adrian Guinet warns:
“This software has only been tested and known to work under Windows XP. In order to work, your computer must not have been rebooted after being infected.
Please also note that you need some luck for this to work (see below), and so it might not work in every cases!”
However, wanakiwi claims to have tested it successfully with versions up to Windows 7, but points to some alternative information. WannaCry — Decrypting files with WanaKiwi + Demos
Dan Goodin for Ars Technica: Windows XP PCs infected by WCry can be decrypted without paying ransom – “Decryption tool is of limited value, because XP was unaffected by last week’s worm.”
John Leyden for The Register: There’s a ransom-free fix for WannaCrypt. Oh snap, you’ve rebooted your XP box – “Sooo… that’s not gonna work for you mate”
Because of the apparent seriousness of the issue, I borrowed my earlier blogs on this topic for ITsecurity UK. So it’s only fair that I borrow back a couple of updates from that article.
You may have seen that someone was able to ‘switch off’ the attack by registering a domain. (‘Accidental hero’ finds kill switch to stop spread of ransomware cyber-attack.) While it sounds as if this bought the world some time, it doesn’t mean there won’t be further attacks. I still recommend that you patch if you can.
There are reports of further variants, including one which is alleged not to include a kill switch. That might not be an accurate report, but certainly no-one should be relying on the neutralization of kill-switch domains rather than patching.
And if you have been caught out by the malware and were thinking of paying up, be warned that payment may not get your files back, according to Checkpoint: WannaCry – Paid Time Off?
Analysis by Microsoft here. MS recommends that you update to Windows 10 (no comment…) and/or apply the MS17-010 update. If that’s not possible, they recommend that you:
Hat tip to Artem Baranov for links to further information.