CASE-06 · Case Study — WannaCry: The Worm That Patched Itself Out

What happened

In May 2017, a piece of ransomware called WannaCry spread across the internet in a single day. What set it apart from ordinary ransomware was its method of travel: it was a worm. It did not need anyone to open an attachment or click a link. Once it reached one vulnerable machine, it scanned for others and copied itself onward, machine to machine, with no human in the loop. That self-propagation is why it moved at internet speed rather than inbox speed.

Within hours it had encrypted files on more than 200,000 machines across roughly 150 countries. Among the victims were parts of the United Kingdom's National Health Service, where hospital and clinic systems locked up, appointments and procedures were disrupted, and some facilities had to divert patients. The outbreak was cut short almost by accident: a security researcher analyzing the malware noticed it first tried to reach an unregistered web address, registered that domain, and discovered it acted as a kill switch — with the domain now resolving, the worm stopped spreading.

See it — the incident timeline

timeline
    title WannaCry — 2017
    March 2017 : Microsoft ships MS17-010, patching SMBv1
    May 12 2017 : WannaCry launches, spreading via the EternalBlue worm
    Within hours : 200,000+ machines locked across ~150 countries
    Same day : NHS services disrupted; kill-switch domain registered, spread halts

The root cause

WannaCry propagated using an exploit named EternalBlue, which targeted a flaw in SMBv1 — version one of the Server Message Block file-sharing protocol. SMBv1 is old, and on many networks it was still enabled and, worse, reachable from the internet or freely across flat internal networks. That reachable, unpatched legacy protocol was the door the worm walked through.

The decisive detail is the timeline. Microsoft had already released the fix. MS17-010 shipped in March 2017, about two months before the outbreak, and it closed exactly the SMBv1 vulnerability EternalBlue abused. So the root cause was not a novel zero-day and not a brilliant new technique. It was mundane: unpatched, internet-exposed, legacy SMBv1 on machines that had had a patch available for two months. The vulnerability was known, cataloged, and fixed upstream — it simply had not been deployed.

The control that would have stopped it

The defenses here are unglamorous and well understood, which is precisely the point. Any one of three ordinary controls would have broken the worm's path:

• Apply the patch. Installing MS17-010 removed the SMBv1 vulnerability EternalBlue relied on. A current patch level alone would have immunized the host.
• Disable SMBv1. The protocol was legacy and rarely needed; turning it off entirely removes the attack surface rather than merely patching it.
• Block SMB at the perimeter. SMB ports have no business being reachable from the internet. Filtering them at the edge — and segmenting internal networks — starves a worm of the open path it needs to jump host to host.

Notice that these are layered: patching fixes the flaw, disabling the protocol removes the feature, and blocking at the perimeter removes the route. Defense in depth means any single one of them, applied in time, would have blunted the outbreak.

The blast radius

The documented impact was large. WannaCry locked files on more than 200,000 machines across roughly 150 countries, and it did so in about a day. In the UK, the attack disrupted parts of the NHS, affecting hospital and clinic operations and forcing some sites to turn patients away. The spread was ultimately halted not by a coordinated patch campaign but by the chance discovery and registration of the hard-coded kill-switch domain hidden in the malware.

See it

The timeline above tells the whole story in four beats: the fix shipped in March, the worm launched in May, it reached hundreds of thousands of machines within hours, and it was stopped the same day by a kill switch — not by any defender's patch. The gap between "fix available" and "fix installed" was the entire incident.

The lesson

A patch you have not installed protects no one.

WannaCry is the canonical reminder that a fixed vulnerability is only fixed on the machines that actually receive the fix. The knowledge existed; the deployment did not. Security work is not finished when a patch is available — it is finished when it is applied everywhere, when unneeded legacy protocols are switched off, and when dangerous services are unreachable from where attackers live.

Where it rhymes

This maps directly onto OWASP A06:2021 — Vulnerable and Outdated Components, and onto the discipline of patch management and attack surface reduction. In ATT&CK terms, the worm's movement is Lateral Movement via a remote service exploit (T1210, Exploitation of Remote Services), which perimeter filtering and network segmentation are designed to contain. The same shape recurs whenever a known, patched flaw lingers on production systems — the fix exists, the clock runs, and the gap is deployment, not discovery.

Named concepts: patch management, vulnerable and outdated components, attack surface reduction, network segmentation.