WannaCry Ransomware Only Works if You Haven't Updated Your Computer in Months

As the world goes into a frenzy over the latest strain of WannaCry ransomware, it might be a good time to remember to update all your devices. Yes, those little reminders your phone and computer throw at you every now and then to update your junk can be really annoying, but not without merit.

WannaCry, aka WannaCrypt, as the exploit is aptly named, is built off of exploits found in the Shadow Brokers' NSA leak from last month. The leak included a couple of Windows SMB zero days, but Microsoft had already released a patch for the vulnerabilities back in March — even for older versions that don't get software updates anymore.

The people vulnerable to the variations of WannaCry ransomware are those who are on old unsupported operating systems like Windows XP, or those who for some reason disabled Windows Update. (PSA: Don't disable Windows Update.)

So, now is a great time to remind everyone — especially all the white hat hackers in training here — how important it is to let Windows Update do its thing every other Tuesday. If you're not on Windows 10 yet, then now's also a great time to upgrade.

If you're still using Windows 8 and Windows 7, then you are safe too, but only if you ran the Windows update from a couple months back. If you haven't updated Windows 8 and Windows 7, then make sure to do that immediately.

If you are running an older version of Windows such as Windows XP or Windows Server 2003, then Microsoft also released updates for those versions, too.

Updating your devices always kinda feels like the last thing you ever want to do, and black hats know this. Even those in the IT security field let this slide sometimes, as is obvious to the number of corporate computers being riddled with ransomware over the last week. So be aware, and go ahead and start updating your stuff — and your clients' stuff — before you are ransomed into approximately 0.16 bitcoins for each device. That's $300 per computer you wouldn't want to pony up.

According to Microsoft:

As cybercriminals become more sophisticated, there is simply no way for customers to protect themselves against threats unless they update their systems. Otherwise they're literally fighting the problems of the present with tools from the past.

WannaCry, in its current variation, is specific to Windows only. It's not a threat to mobile OSes such as Android and iOS, though, and won't wreak havoc on your Linux distro. But don't just assume that there never will be a cyber attack to infect your other devices. There most certainly will be. It's always good to be prepared when it comes to protecting your sensitive data on your devices by keeping them updated.

Finally, if the NSA knew their tools were stolen and that they were going to be leaked, why didn't they think to alert Microsoft to these vulnerabilities? Why are governments around the world undermining citizens' privacy and security to stockpile cyberweapons? These are questions we have long been asking and still have yet to find an answer to.

[T]his attack provides yet another example of why the stockpiling of vulnerabilities by governments is such a problem. This is an emerging pattern in 2017. We have seen vulnerabilities stored by the CIA show up on WikiLeaks, and now this vulnerability stolen from the NSA has affected customers around the world. Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage. An equivalent scenario with conventional weapons would be the U.S. military having some of its Tomahawk missiles stolen.

• Follow Null Byte on Twitter and Google+
• Follow WonderHowTo on Facebook, Twitter, Pinterest, and Google+

Cover image via Carolm/Pixabay