WannaCry Ransomware and MS17-010 Vulnerability
On Friday 12 May 2017 a large ransomware attack dubbed “WannaCry” was launched targeting more than 200,000 computers worldwide, including industries such as banks, hospitals and large telecom companies. Figure 1: “WannaCry” ransom massage Infection Methods One of the main infection methods of this ransomware is by exploiting a recently patched Microsoft Windows SMB vulnerability (MS17-010). This vulnerability was publicly discovered as a result of the Shadow Brokers leaks that happened in April this year. Another possible method of infection is by phishing emails being sent to arbitrary recipients. Either way, once this ransomware gets on a network it exploits the aforementioned windows vulnerability in order to spread further into the network and infect more computers. Figure 2: Shodan search for Windows SMB service exposed directly to the internet Mitigation using BIG-IP BIG-IP is able to mitigate the Windows exploitation attempt and prevent the WannaCry ransomware infection by using the attached iApp which contains an iRule, the iRule detects a part of the kernel shellcode in the exploit and drops the packets containing it. sys application template WannaCry_Blocker_v2 { actions { definition { html-help { <h3>WannaCry Blocker</h3> <p>This iApp installs the WannaCry Blocker iRule which will detect, block,* log, and count attempts to exploit CVE-2017-0144 “WannaCry.”</p> <p>Attach <i><b>both</b></i> the WannaCry Blocker iRule <i>and</i> the default Stream Profile /Common/stream to a TCP virtual server (the virtual server must not have an HTTP Profile).</p> <p>The WannaCry Blocker iRule logs the source IP address and geolocation of each possible attack and counts attacks (per-virtual-server) using iStats.</p> <p><b>*</b> The WannaCry iRule blocks WannaCry attacks. It also has an option to log attacks then allow them to proceed, if you really want to do that.</p> } implementation { package require iapp 1.1.1 iapp::template start # Prepared by Mark Quevedo, f5 Networks #------------------------------------------------------------ set ir_wcry { # WannaCry Blocker iRule # # Attach this iRule along with the defaul Stream Profile # /Common/stream to a TCP virtual server to detect, block,* # log, and count CVE-2017-0144 "WannaCry" attacks. (The # virtual server must not have an HTTP Profile.) # # This iRule logs the source IP address and geolocation of each # attack and counts attacks (per-virtual-server) using iStats. # # * Normally this iRule blocks WannaCry attacks. If you really # wish to allow such attacks to proceed (to a honeypot, maybe?) # after they are logged, set the variable static::allow_wannacry # to '1' in the RULE_INIT event. # # Written by Mark Quevedo, f5 Networks # when RULE_INIT { # if static::allow_wannacry is set to 1 (true) (see next line) # then WannaCry attacks are not blocked, just logged and counted set static::allow_wannacry @@@@@ # Stream Profile target sequences here are TCL regular expressions. # TMOS maps payload octets as if they were ISO-8859-1 to Unicode chars set target_list { {\u00b9\u0082\u0000\u0000\u00c0\u000f\u0032\u0048\u00bb\u00f8\u000f\u00d0\u00ff{5}\u0089\u0053\u0004\u0089\u0003\u0048\u008d\u0005\u000a\u0000} {\u0010\u0000{4}\u00ff{4}\u0000{12}\u004a\u0000{3}\u004a\u0000\u0002\u0000\u0023\u0000{3}\u0007\u0000\u005c\u0050\u0049\u0050\u0045\u005c\u0000} } set static::wcry_targets "" append static::wcry_targets "/" [join $target_list "// /"] "//" } ; #RULE_INIT when CLIENT_ACCEPTED { STREAM::expression $static::wcry_targets STREAM::enable } ; #CLIENT_ACCEPTED when STREAM_MATCHED { if {$static::allow_wannacry} { STREAM::replace ; # no arg means don't replace, therefore allow set blocked "" } else { reject ; # block apparent WannaCry attack set blocked "blocked\x20" } set client_ip [IP::client_addr] set client_port [TCP::client_port] set local_ip [IP::local_addr] set local_port [TCP::local_port] set geo [whereis $client_ip continent country city isp latitude longitude] log local0.info "[virtual] ${blocked}apparent WannaCry attack from ${client_ip}_${client_port} to ${local_ip}_${local_port} (source IP geolocation: [join $geo "|"])" ISTATS::incr "ltm.virtual [virtual] c wannacry" 1 } ; #STREAM_MATCHED } ; #ir_wcry #------------------------------------------------------------ # create/update iRule regsub -all {@@@@@} $ir_wcry [expr {!$::intro__block}] patched iapp::conf "create ltm rule WannaCry-Blocker { ${patched} }" iapp::template end } presentation { section intro { message note1 "This iApp installs the WannaCry Blocker iRule which will detect, block,* log, and count attempts to exploit CVE-2017-0144 'WannaCry'." message note2 "Attach BOTH the WannaCry Blocker iRule AND the default Stream Profile /Common/stream OUTSIDE OF THIS iAPP to any TCP virtual server (the virtual server must not have an HTTP Profile)." message note3 "The WannaCry Blocker iRule logs the source IP address and geolocation of each possible attack, and counts attacks (per-virtual-server) using iStats." message note4 "* Normally the WannaCry Blocker iRule (WannaCry-Blocker) blocks WannaCry attacks in addition to logging and counting them. If you really wish to allow such attacks to proceed (to a honeypot, perhaps?) after they are logged, you may configure the WannaCry Blocker iRule here to log WannaCry attacks then allow them to proceed." choice block display "xxlarge" { "Yes! Block WannaCry attacks; also log and count them" => "1", "No. Log and count WannaCry attacks but do NOT block them (INSECURE)" => "0" } } text { intro "Welcome to the WannaCry Blocker iApp template v2" intro.note1 "Description" intro.note2 "" intro.note3 "" intro.note4 "" intro.block "Do you want the WannaCry Blocker iRule to block WannaCry attacks?" } } role-acl { admin } run-as none } } requires-bigip-version-max none requires-bigip-version-min 11.0.0 requires-modules { ltm } description "WannaCry Blocker to detect/block/log/count CVE-2017-0144 'WannaCry' attacks" } Figure 3:iApp template for logging and blocking MS17-010 exploitation attempts Figure 4:Exploit attempt against BIG-IP which has the iRule configured It is important to emphasize that BIG-IP is not vulnerable to this Windows SMB vulnerability as it doesn’t run Windows OS.
