The WannaCry ransomware contains a killswitch, a URL that when registered, caused the malware to shutdown.
Question is, who put in the killswitch?
Was it the bad guys? Was it the NSA? Could it have been anyone else?
The WannaCry ransomware contains a killswitch, a URL that when registered, caused the malware to shutdown.
Question is, who put in the killswitch?
Was it the bad guys? Was it the NSA? Could it have been anyone else?
The bad guys put the killswitch in their own malware. It couldn't be anyone else, since that malware's vulnerability was in the malware's code.
It's common practice for malwares to check if you're in a sandboxed environment to prevent reverse-engineering (via MITM, for example), and to ease development.
They failed to implement a correct check, since the registration of one domain led to the malware being unable to encrypt anything.
I'm guessing it was the NSA.
For one of two reasons.
As a responsible state actor, at a minimum, they would have wanted to have a way to shutdown the malware if anything went wrong. So they put in this URL.
They may not have intended for it to be a killswitch. It may actually be a intended for a Comand and Control Centre, but if so, it won't be responding correctly, which could mean the killswitch behaviour is accidental.
And then,when the bad guys repackaged NSA's exploit (the code that takes advantage of the vulnerability in Microsoft's code) into their own malware, they didn't realise that it contained this behaviour or they would have removed it or replaced the hardcoded domain name with an IP address. (Domain names rapidly get handed over to the authorities in cases like this.)
It does make sense for NSA to have done this. Having a self-destruct is common practice in rockets.
It doesn't make sense for the bad guys to have done this. Though it could have happened by accident, as per Benoit's answer.
And I don't see how anyone else could have done it.