Are We Facing a New WannaCry?

You probably remember the cyber attack called WannaCry in 2017: the attack that infected more than 200,000 computers in over 150 countries.

Acronis reports that the attack, which caused more than 92 million pounds of damage in the UK alone, cost about 6 billion pounds worldwide.

WannaCry, which appears as ransomware, usually infects target systems through malicious emails. A document or link is attached to these emails and the user is asked to open it. When the user does so, the program inside the document or link is activated. This program then starts looking for vulnerabilities on the user’s computer or on other devices in the network the computer belongs to.

If this malware finds a vulnerability that can be exploited, it immediately starts exploiting it and creates a backdoor between the hacker who prepared it and the infected computer. Through this backdoor the hacker can steal information from the system, encrypt the system and render it unusable, or both.

The vulnerability exploited in the WannaCry attack was a vulnerability in the Microsoft Windows operating system. This vulnerability, which brought the UK’s health system, the NHS, to a standstill, had been fixed by Microsoft. But Microsoft fixing the vulnerability was not enough. The updates closing it also had to be applied to NHS staff computers. The NHS had not installed the recommended update and suffered the biggest cyber attack in its history.

It seems quite possible that something similar will happen in the coming days with even greater impact. The reason I say this is the zero-day vulnerability that emerged on 10 December 2021.

Since that date, the IT world has been in turmoil over a vulnerability in a piece of software used by almost every company providing services over the internet. Because the piece of software is so widely used and the vulnerability so easy to exploit, it was given a severity score of 10 out of 10 by the US National Vulnerability Database (NVD), regarded as the authority.

By exploiting this vulnerability, a hacker can gain the capability to take full control of the network in the target system remotely. The attacker does not need to be physically on the system’s network. This may especially whet the appetite of state-sponsored hacker groups, because they know that the targeted country will impose no sanctions on them as a result of the attack.

Known as Log4j, this piece of software is used in IT to keep logs (records) in the system. To work quickly, software developers can take program components or libraries prepared by others and integrate them into their own programs instead of writing the whole program themselves. Log4j is one such library. Instead of writing such a component themselves, developers download it from the relevant web page and use it.

When the vulnerability was disclosed, the developers of this component released an update the same day and asked users to apply it as soon as possible. But looking at the report published by the NVD on 14 December 2021, it can be seen that the vulnerability was not completely fixed and that the same program was updated again.

According to a report published by the international cybersecurity company ESET, there are very high levels of attack attempts to exploit this vulnerability, targeting especially the US, the UK, Türkiye and Germany.

Applying such an update looks set to be very difficult, especially as the end of the year approaches, because towards the end of the year companies enter a process known as a change freeze, in which any change that would affect the system is frozen. This means that many companies may postpone this update until the change freeze is over.

Looking at investigations into the WannaCry attack, it can be seen that public bodies providing services such as healthcare, and other public institutions, were very slow in updating their operating systems. This creates a huge cyber attack surface for hackers.

It seems that the vulnerability in Log4j will not be fixed easily either, and that a very tight race against time between hackers and the good users in the IT field will continue in the days ahead.

The advice that can be given to companies and public institutions and bodies using this piece of software is not to let it drop off their agenda until the vulnerability has been fully fixed.