{"id":48728,"date":"2018-03-30T13:30:52","date_gmt":"2018-03-30T13:30:52","guid":{"rendered":"https:\/\/one.sightlinemg.com\/defensenews\/uncategorized\/2018\/03\/30\/the-other-problem-that-wannacry-exposes\/"},"modified":"2026-08-08T18:33:10","modified_gmt":"2026-08-08T18:33:10","slug":"the-other-problem-that-wannacry-exposes","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/defensenews\/cyber\/2018\/03\/30\/the-other-problem-that-wannacry-exposes\/","title":{"rendered":"The other problem that WannaCry exposes"},"content":{"rendered":"\n

Modern airplanes are, like so much else, bundles of metal wrapped around code. So when news got out Wednesday afternoon that Boeing had been hit by the Wannacry worm, a brief panic and hysteria swept the aviation world: did the worm get into aircraft software? Could a worm in aircraft software demand ransom in flight? Would pilots have to shell out a ransom in bitcoin mid-flight in order to land? Fortunately, it appears that Boeing patched and quarantined the attack, so none of this came to pass, but it\u2019s as good an opportunity as any to talk about what happens when the fifth domain meets the third domain.<\/p>\n\n\n\n

First, let\u2019s clear up what happened at Boeing. From Dominic Gates at Seattle Times, who broke the story<\/a>:<\/p>\n\n\n\n\n\n\n\n

Earlier in the day, when the cyberattack struck, the reaction was anything but calm.<\/p>\n\n\n\n

The Wannacry virus made headlines in May 2017 when it hit hospitals in the UK<\/a>, replacing vital displays with a message that files on the computer were encrypted and would be destroyed unless a ransom was paid (in Bitcoin, of course). The 2017 attack was halted when a security researcher registered the domain programmed into the worm as a killswitch, which then promptly stopped that attack. Why did the worm have a killswitch? Rather than a singularly built malicious tool, WannaCry was based on EternalBlue<\/a>, a Microsoft discovered by the NSA and kept secret until it was stolen and exposed by Shadow Brokers, a hacking group, in early 2017. Those releases almost immediately found their way into the repertoires of Russia and China<\/a> and other nations with extensive cyber capabilities. In December 2017, the United States pinned the May WannaCry attack on North Korea<\/a>.<\/p>\n\n\n\n

WannaCry is hardly the first or last bit of code fashioned into a weapon of industrial sabotage. Once inside a network, it can can spread until either it checks the killswitch domain or until the software is patched, as happened at Boeing on Wednesday. The latter part is especially important, because not every EternalBlue exploit or WannaCry variant will include the killswitch.<\/p>\n\n\n\n

With the attack so recent, we are still a ways away from a clear analysis of who launched the attack, what systems specifically they targeted, and how the attackers got in. Diagnosing, building adaptations, and labeling attackers can sometimes take years; earlier this month, US-CERT formally published attribution and countermeasures to a years-long cyber intrusion from Russia that started in 2016 and which targeted, among other sectors<\/a>, the aviation industry.<\/p>\n\n\n\t