#1131 2017 · Marcus Hutchins (security researcher, MalwareTech) · Cybersecurity
A researcher stopped a global ransomware attack by buying a $10.69 domain in its code
the problem
WannaCry ransomware was infecting hundreds of thousands of computers across 150+ countries within hours
background
On 12 May 2017 the WannaCry ransomware worm began spreading across the internet, exploiting a leaked NSA Windows vulnerability to encrypt files on infected machines and demand payment, and within a day it had crippled Britain's National Health Service, Spanish telecom Telefónica, FedEx, Renault's factories and government systems worldwide. It spread machine-to-machine without any user clicking anything, so the normal defenses — patching, antivirus signatures, user warnings — were all too slow to stop an outbreak already moving at network speed.
23-year-old British researcher Marcus Hutchins, working from his parents' house in Devon, pulled a sample of the malware apart and noticed it queried a long, nonsensical domain name before doing anything else — a domain that, when he checked, had never been registered.
what everyone would do
Patch every vulnerable machine and push antivirus signature updates, the standard response to a malware outbreak. It couldn't work fast enough here because WannaCry was already spreading machine-to-machine across 150 countries at network speed, and updating every exposed system worldwide before the worm reached it was never going to happen in time.
what they saw
Hutchins noticed the malware checked an unregistered domain before acting. He didn't need to out-patch a worm spreading at network speed; he needed to own the one address it was already programmed to trust.
the move
Hutchins registered the unclaimed domain for $10.69 mainly to log the infected machines contacting it for research purposes, a routine sinkholing technique. He didn't know the domain check was the malware's built-in kill switch — apparently written by its authors as an anti-analysis trick to detect sandboxed environments — until infected computers around the world stopped encrypting files the moment his registration made the domain resolve.
why it works
WannaCry's authors had built a domain check into every copy of the worm, intending it as a way to detect security researchers' sandboxed analysis environments, which typically fake DNS responses for any domain queried. But because the actual domain had never been registered, every real-world infection was also making that same check and getting a 'domain doesn't exist' response — meaning the kill switch was live everywhere, waiting for anyone to claim the address. Registering it flipped every infected machine's own built-in check from false to true simultaneously, which is why a single $10.69 purchase reached machines a global patch rollout couldn't have touched in time.
the payoff
The registration halted WannaCry's spread within hours, after it had already hit more than 230,000 computers in over 150 countries.
where it breaks
The mechanism only works when the adversarial system contains an artifact — a domain, a file, a credential — that a third party can legally acquire and that the system checks unconditionally; malware without such a hardcoded dependency offers no equivalent lever. It also requires the artifact to be unclaimed and inexpensive enough to grab quickly, and it can be neutralized instantly if the attacker updates the code to route around the exact address that was just seized, which is exactly what WannaCry's operators tried within days.
what came after
Hutchins was hailed as the accidental hero who stopped WannaCry, and the incident became a landmark case study in how ransomware kill switches, sinkholing and domain registration are used defensively across the cybersecurity industry; he was later prosecuted and pleaded guilty to unrelated malware charges from his teenage years, a fact that doesn't change what the domain registration did that day.
references
- [1]The sinkhole that saved the internetTechCrunch, 2019techcrunch.com
- [2]'WannaCry hero' sentenced for selling Kronos malwareTechCrunch, 2019techcrunch.com