- Date: Friday, 12 May 2017
- Ransom: $300 in Bitcoin per machine, doubling after three days
- Paid by the NHS: Nothing
The background
The National Health Service is not a technology company. It is a healthcare provider that happens to depend entirely on technology to function. By May 2017, every patient record, every appointment, every prescription, and every scan flowed through systems that had been built, patched, upgraded, and occasionally left alone for longer than anyone was comfortable admitting.
The NHS ran on Windows. A great deal of the NHS ran on old Windows. Some of it ran on Windows XP, an operating system that had already passed out of support. Some machines were patched regularly. Some were patched when someone remembered. Some were connected to equipment that could not be patched without invalidating the warranty on a scanner that cost more than a house.
This was not a secret. It was not a surprise. It was the ordinary condition of a large, federated organisation trying to deliver healthcare on a budget that never quite stretched to replacing everything that needed replacing. The IT estate was a geological record of every funding decision, every procurement delay, and every time "we'll sort that out next quarter" became "we'll sort that out next year."
The N3 network connected NHS organisations across the country. It was designed for speed and interoperability, not for assuming that every machine on it might be hostile. When you are trying to get a scan from one hospital to another so a patient can be treated, you optimise for getting the data through. When you are trying to defend against ransomware, you optimise for segmentation and isolation. These are not the same problem, and they do not have the same solution.
By Friday, 12 May 2017, the NHS was running the IT estate it had, not the IT estate it wanted. What arrived that day did not care about the difference.
What actually happened
WannaCry began encrypting files on NHS computers on Friday, 12 May 2017. It was not subtle. It was not targeted. It was a ransomware worm that spread itself automatically, encrypting files as it went and demanding $300 in Bitcoin per machine. If you did not pay within three days, the price doubled. If you did not pay within seven days, the files were gone.
The ransomware spread via the internet, including across the N3 NHS broadband network that connected organisations together. It also arrived via phishing emails, the oldest delivery mechanism in the attacker's playbook. It did not spread via NHSmail; there were no instances of infection through the NHS email system itself. But it did not need NHSmail. It had EternalBlue.
EternalBlue was an exploit developed by the NSA for attacking Windows systems. It targeted a vulnerability in the Server Message Block protocol that Windows used for file sharing. If you could reach a vulnerable Windows machine over the network, you could execute code on it without any user interaction. No click required. No attachment opened. Just network access and an unpatched system.
EternalBlue had been leaked before May 2017 by a group calling itself the Shadow Brokers. The NSA had lost control of its own weapon, and now that weapon was available to anyone who wanted it. Microsoft had released a patch. The patch had been available for weeks. What WannaCry found was every machine where that patch had not been applied, and every machine running an operating system old enough that it was no longer receiving patches at all.
Windows XP had been a good operating system in its time. That time had ended. But Windows XP was still running in the NHS, on machines connected to medical equipment, on workstations that had been installed and never touched again, on systems where "if it isn't broken, don't fix it" had become "if it still boots, leave it alone."
WannaCry spread fast. When you can move from machine to machine without anyone clicking anything, and when the network is flat enough that reaching one machine gives you access to many others, speed is what you get. Within hours, NHS organisations across the country were seeing the same blue screen with the same demand: pay us in Bitcoin, or lose your files.
None of them paid. The NHS does not negotiate with ransomware. It also does not keep $300 in Bitcoin sitting around on the off chance.
Within 12 hours of the attack beginning, a cybersecurity researcher discovered something strange. The malware was checking whether a particular domain name existed. If the domain was registered, the malware stopped spreading. If the domain was unregistered, it continued. The researcher registered the domain. The domain cost about ten pounds. The spread of WannaCry stopped.
A global ransomware outbreak that had hit healthcare systems, businesses, and government organisations across multiple countries was halted by someone buying a web address. The kill switch was not part of anyone's incident response plan. It was not a defensive measure that the NHS had deployed. It was an accident of how the malware had been written, discovered by someone with the curiosity to look and the presence of mind to act.
The people in the room
Nobody woke up on Friday, 12 May 2017 planning to let ransomware loose on a national health service. The decisions that made WannaCry possible were made months and years earlier, by people solving different problems under different constraints.
Patching a Windows machine is straightforward when that machine is a laptop in an office. Patching a Windows machine connected to a medical device that cost six figures and has a support contract that forbids unauthorised software changes is a different conversation. You can patch it and void the warranty, or you can leave it alone and accept the risk. Both options are bad. One of them keeps the scanner working tomorrow morning.
Upgrading an entire estate from Windows XP to something supported costs money that was needed for staff, for equipment, for keeping hospitals running. The business case for "we need to upgrade these computers before something bad happens" competes with "we need to hire another nurse." One of those is visible. One of those saves lives you can count. The other prevents a disaster you cannot prove would have happened.
Segmenting a network so that one infected machine cannot reach a hundred others is good security architecture. It also makes it harder to move patient data between systems, harder to integrate new services, harder to do the things that healthcare requires you to do quickly. Every security control is also a barrier. Every barrier slows something down. Somewhere, someone made the call that speed mattered more.
These were not stupid decisions. They were difficult decisions made by people trying to keep a healthcare system running on insufficient budget with insufficient time. The problem is that ransomware does not care about your constraints.
The damage
- Ransom demanded: $300 in Bitcoin per machine, doubling after three days
- Ransom paid by NHS organisations: none
- Attack halted within 12 hours of beginning by activation of a kill switch
What actually went wrong
WannaCry did not defeat the NHS's defences. It walked through a door that had been left open for years. The exploit it used, EternalBlue, targeted a Windows vulnerability for which a patch already existed. Microsoft had released that patch before WannaCry struck. The machines that WannaCry infected were either unpatched, or running operating systems old enough that they were no longer supported at all.
This is the uncomfortable part of the story. WannaCry was not a sophisticated attack against a hardened target. It was an ordinary attack, using a leaked NSA exploit that was already public knowledge, against an estate where patching had fallen behind. The vulnerability was known. The fix was available. What was missing was the application of that fix to every machine that needed it.
The problem was not that the NHS lacked cybersecurity tools. The problem was that those tools are only as good as the estate they are protecting. When your estate includes machines running Windows XP, machines that cannot be patched because they are connected to medical equipment with restrictive support contracts, and machines that simply have not been patched because there are not enough hours in the day, you are not defending a perimeter. You are defending a patchwork.
The N3 network was designed for interoperability. It was designed to move data quickly between NHS organisations. It was not designed assuming that every machine connected to it might already be compromised. When WannaCry reached one vulnerable machine, it could reach many others. Network segmentation would have limited the spread. Network segmentation also makes everything harder to connect. The NHS had chosen to optimise for connectivity.
Microsoft took the unusual step of releasing a patch for Windows XP and other unsupported systems after WannaCry hit. Microsoft does not normally patch operating systems it has already stopped supporting. The fact that it did so tells you how far outside normal the situation had become. The patch that should have been applied months earlier to supported systems was now being released for systems that should not have been running at all.
The kill switch was accidental. The malware was checking for the existence of a particular domain, probably as an anti-analysis measure to detect when it was being run in a sandbox. When a researcher registered that domain, the malware stopped spreading. This was not a defensive measure. It was not part of any cybersecurity checklist. It was luck, combined with the curiosity of someone who looked closely enough to notice what the malware was doing.
What small businesses can learn
- Patching is not maintenance work you defer when you are busy. The vulnerability that WannaCry exploited had a fix available before the attack happened. What it found was machines where that fix had not been applied. If you are running systems that still work but are no longer supported, you are not being thrifty. You are accepting risk that you may not survive.
- Asset inventory is unglamorous and essential. You cannot patch what you do not know you have. An accurate list of every machine, every operating system version, and every piece of software running in your environment is the foundation of every other security measure. If you discover what you are running only after something breaks, it is too late.
- Network segmentation limits blast radius. When one machine can talk to every other machine without restriction, one infection becomes many infections. Segmenting your network so that different systems are isolated from each other will not prevent every attack, but it will stop an infection on one machine from becoming an infection on all of them. This is harder to set up and makes some legitimate workflows more awkward. It is still worth doing.
- Know what you cannot patch and why. Some systems cannot be patched because doing so would void a warranty or break compatibility with critical equipment. That is a real constraint. The answer is not to pretend the risk does not exist. The answer is to isolate those systems, monitor them more closely, and have a plan for what happens when they are compromised, because eventually they will be.