<story><title>Accidentally Stopping a Global Cyber Attack</title><url>https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html</url></story><parent_chain><item><author>eterm</author><text>Under that same assumption of assuming maximum damage, what was the motivation for the malware author to put in a killswitch?</text></item><item><author>ufmace</author><text>I would think not. For something bad to happen from registering the domain, there would have to be some kind of weird booby-trap in the malware. What&amp;#x27;s the motivation for a malware author to do that? If they can do something worse, the incentive is to just do it, rather than wait for a security researcher to do something first that they may or may not ever do. It&amp;#x27;s not impossible, but it&amp;#x27;s a little ridiculous and wildly unprecedented in the field of malware analysis.&lt;p&gt;When there&amp;#x27;s a global infection spreading wildly and crippling essential organizations, you want everyone to act fast, not spend weeks making sure everything is perfect. If you see the malware connecting out to an unregistered domain, you just register it now. Whoever is first gets it, and the attacker could realize their mistake at any time. Even without knowing what this malware does with the connection, odds are 99.9% that the situation is better with the domain controlled by a security researcher than by a malware author. Punishing researchers if something done in good faith turned out badly would incentivize them to overanalyze everything and delay taking any potential beneficial action until it&amp;#x27;s too late.</text></item><item><author>dperfect</author><text>&amp;gt; the employee came back with the news that the registration of the domain had triggered the ransomware meaning we’d encrypted everyone’s files...&lt;p&gt;Even though this fortunately turned out to be false, what if it &lt;i&gt;had&lt;/i&gt; been true? Would the security researcher be held in any way accountable for activating the ransomware? If I were the author, I might be a bit more careful in the future before changing factors in the global environment[1] that have the potential to adversely affect the malware&amp;#x27;s behavior, but of course I&amp;#x27;m not a security researcher, so I really don&amp;#x27;t know.&lt;p&gt;[1] I suppose a domain could probably be made to &lt;i&gt;appear&lt;/i&gt; unregistered after being registered - depending on the actual check performed - but there are other binary signals (e.g., the existence of a certain address or value in the bitcoin blockchain) that might not be so easy to reverse.</text></item></parent_chain><comment><author>Scoundreller</author><text>The theory is that the malware wouldn&amp;#x27;t execute in sandboxes for malware analysis, since the analysis environment will accept all connections from the sandbox.&lt;p&gt;So, if connection = successful, then we&amp;#x27;re being analyzed and don&amp;#x27;t execute.&lt;p&gt;If connection = unsuccessful, then we&amp;#x27;re on a real workstation, execute!&lt;p&gt;Then the scheme fell apart when someone registered that domain, so all connections = successful and malware will not execute (but machine still infected).</text></comment>
<story><title>Accidentally Stopping a Global Cyber Attack</title><url>https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html</url></story><parent_chain><item><author>eterm</author><text>Under that same assumption of assuming maximum damage, what was the motivation for the malware author to put in a killswitch?</text></item><item><author>ufmace</author><text>I would think not. For something bad to happen from registering the domain, there would have to be some kind of weird booby-trap in the malware. What&amp;#x27;s the motivation for a malware author to do that? If they can do something worse, the incentive is to just do it, rather than wait for a security researcher to do something first that they may or may not ever do. It&amp;#x27;s not impossible, but it&amp;#x27;s a little ridiculous and wildly unprecedented in the field of malware analysis.&lt;p&gt;When there&amp;#x27;s a global infection spreading wildly and crippling essential organizations, you want everyone to act fast, not spend weeks making sure everything is perfect. If you see the malware connecting out to an unregistered domain, you just register it now. Whoever is first gets it, and the attacker could realize their mistake at any time. Even without knowing what this malware does with the connection, odds are 99.9% that the situation is better with the domain controlled by a security researcher than by a malware author. Punishing researchers if something done in good faith turned out badly would incentivize them to overanalyze everything and delay taking any potential beneficial action until it&amp;#x27;s too late.</text></item><item><author>dperfect</author><text>&amp;gt; the employee came back with the news that the registration of the domain had triggered the ransomware meaning we’d encrypted everyone’s files...&lt;p&gt;Even though this fortunately turned out to be false, what if it &lt;i&gt;had&lt;/i&gt; been true? Would the security researcher be held in any way accountable for activating the ransomware? If I were the author, I might be a bit more careful in the future before changing factors in the global environment[1] that have the potential to adversely affect the malware&amp;#x27;s behavior, but of course I&amp;#x27;m not a security researcher, so I really don&amp;#x27;t know.&lt;p&gt;[1] I suppose a domain could probably be made to &lt;i&gt;appear&lt;/i&gt; unregistered after being registered - depending on the actual check performed - but there are other binary signals (e.g., the existence of a certain address or value in the bitcoin blockchain) that might not be so easy to reverse.</text></item></parent_chain><comment><author>jldugger</author><text>Probably to prevent it from fucking their own computer network up. Just change your local resolver to be authoritative for the domain(s) in question, and bob&amp;#x27;s your uncle.&lt;p&gt;But next they&amp;#x27;ll likely use more domains, and more expensive ones, so that random security researchers can&amp;#x27;t just expense the registration on the corporate credit card. I know .ng costs 50k, but .np might be pretty comical to deploy if you&amp;#x27;re not really worried about a global off switch.</text></comment>