Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 630461" data-attributes="member: 32260"><a href="https://zerosum0x0.blogspot.com/2017/04/doublepulsar-initial-smb-backdoor-ring.html" target="_blank">zerosum0x0: DoublePulsar Initial SMB Backdoor Ring 0 Shellcode Analysis</a><a href="https://threatpost.com/nsas-doublepulsar-kernel-exploit-in-use-internet-wide/125165/" target="_blank">NSA’s DoublePulsar Kernel Exploit In Use Internet-Wide</a>From the above articles, I learned that:<ol>
<li data-xf-list-type="ol">Wannacry uses SMB1 vulnerability based on EternalBlue exploit and DoublePulsar memory backdoor (persistent due to changing the Registry).</li>
<li data-xf-list-type="ol">The DoublePulsar lives in memory, until the machine is rebooted.</li>
<li data-xf-list-type="ol">If the machine is infected, DoublePulsar can load and execute a payload.</li>
</ol>So, it seems that Wannacry can be stopped by Default Deny SRP/Hard_Configurator (with blocking DLLs setting). But, DoublePulsar backdoor cannot be stopped.EDITI reedited the above text, because Wannacry uses also the persistence mechanism (EternalBlue exploit).<a href="http://www.pandasecurity.com/mediacenter/news/infographic-wannacry-cyberattack/" target="_blank">Ransomware Infographic: An Anatomy of the WannaCry Cyberattack</a></blockquote>

[QUOTE="Andy Ful, post: 630461, member: 32260"] [URL='https://zerosum0x0.blogspot.com/2017/04/doublepulsar-initial-smb-backdoor-ring.html']zerosum0x0: DoublePulsar Initial SMB Backdoor Ring 0 Shellcode Analysis[/URL] [URL='https://threatpost.com/nsas-doublepulsar-kernel-exploit-in-use-internet-wide/125165/']NSA’s DoublePulsar Kernel Exploit In Use Internet-Wide[/URL] From the above articles, I learned that: [LIST=1] [*]Wannacry uses SMB1 vulnerability based on EternalBlue exploit and DoublePulsar memory backdoor (persistent due to changing the Registry). [*]The DoublePulsar lives in memory, until the machine is rebooted. [*]If the machine is infected, DoublePulsar can load and execute a payload. [/LIST] So, it seems that Wannacry can be stopped by Default Deny SRP/Hard_Configurator (with blocking DLLs setting). But, DoublePulsar backdoor cannot be stopped. EDIT I reedited the above text, because Wannacry uses also the persistence mechanism (EternalBlue exploit). [URL='http://www.pandasecurity.com/mediacenter/news/infographic-wannacry-cyberattack/']Ransomware Infographic: An Anatomy of the WannaCry Cyberattack[/URL] [/QUOTE]

Verification