WannaCry: a domain registered by a researcher slows down a global epidemic

On May 12, 2017, WannaCry encrypts files and asks for money to make them accessible. Organizations in several countries are affected. In the English health system, the attack disrupts facilities and appointments: the danger is also measured in delayed care.

The program exploits a Windows vulnerability to move between vulnerable computers. A correction already existed. The National Audit Office report shows that security alerts did not translate everywhere into sufficient protection of the affected machines.

By analyzing a sample, researcher Marcus Hutchins identifies a domain name and registers it. He discovers that this operation triggers a condition that interrupts the operation of the studied variant. The gesture slows down its spread, but does not decrypt the files already reached.

IT teams still need to isolate systems, apply patches, and restore services. The discovery of a stopping mechanism does not mean that a universal remedy protects against all possible variants or repairs each infected post.

According to the official report, at least 81 out of 236 hospitals have been affected, either directly or indirectly. U.S. officials have linked WannaCry to North Korean actors in their accusations. This connection should not be confused with the role of the researcher who has slowed its diffusion.

The episode contrasts two temporalities: weeks during which a patch could have been installed, and then a few hours during which an individual discovery avoids further propagation. The domain name does not erase the cost of the previously accumulated delay.