Windows 7 PCs Account For 98 Percent Of All WannaCry Infections (tr)

Hot Hardware ^ | May 21, 2017 | Paul Lilly

[dayglored]

For a quick minute, it looked as though a strain of ransomware that was seemingly stolen from the United States National Security Agency (NSA) was going to be a major problem for PCs around the world, and in particular Windows XP systems. Microsoft even made the unusual move of releasing an emergency patch for Windows XP even though it stopped supporting the legacy OS a long time ago. But now a week after the initial WannaCry outbreak it's been discovered that Windows 7 PCs were the hardest hit.

A researcher for Kaspersky Lab posted a message on Twitter saying "the Windows XP count is insignificant," adding that Windows 7 took the brunt of the ransomware's activity. When looking at the overall infection rate, various builds of Windows 7 collectively accounted for more than 98 percent of PCs to be hit by WannaCry.

Source: Kaspersky/Costin Raiu

Also referred to as WannaCrypt, WCry, and a handful of other names, WannaCry made headlines after quickly spreading tens of thousands of PCs in dozens of countries in just a few hours. The ransomware infiltrated several hospitals in the United Kingdom, some of which had to turn down patients and send staff home because the systems they rely on (and store patient records on) had been hijacked.

WannaCry is believed to be one of several cyber tools that was previously swiped from the NSA and leaked to the web by an Italian hacking group. What made WannaCry especially nasty is that it was able to spread in a worm-like fashion across networks. However, the threat was relatively short lived.

A security researcher noticed that WannaCry was pinging a specific domain, one that was not registered. In an attempt to learn more about the ransomware, he registered the domain with intention of observing its activity. In doing so, he inadvertently neutralized the outbreak. As it turns out, the malware's author coded in a so-called kill switch, presumably in case he ever wanted to stop it from spreading. The way it worked is WannaCry would check to see if a specific domain was active before getting busy encrypting an infected system. If it determined the domain was active, it would stop what it was doing.

According to Elliptic, WannaCry has only collected a little more than $100,000 in Bitcoin. While not exactly chump change, it had the potential to collect much more, except for a combination of the discovery of the kill switch, owners of infected PCs opting to wipe their system clean, and the presence of a tool on GitHub that can help people recover data on infected systems.

[dayglored]

> Really tired of your MS BS.

Mind giving me a clue what you're referring to?

[dayglored]

> Win 7 is better than the current versions. So naturally that one gets hit.

Nah, more likely:

• Win7 accounts for 50% of the computers in use. Win10 is about 25%. Everything else is in the noise. So even if all else was equal, Win7 would account for 2/3 of the infected machines.

• But everything else WASN'T equal -- the Win10 machines were getting patched automatically. They were immune.

• So the only thing left to infect were the Win7 machines that hadn't been patched.

[dayglored]

> Maybe MSFT is the origin, pushing folks to go to W10.Just a thought.

I doubt it. They have more subtle and effective ways of encouraging Win7 users to migrate to Win10.

My "tin-foil hat" reference was just a joke. Actually, I read that thought in a user comment to that effect on the page I got this article from, and laughed, so I decided to throw it in here.

[dayglored]

> Windows 7 must be swiss cheese to hackers.

Any operating system is swiss cheese if it isn't understood by the people who maintain it. The Windows NT operating system had a wonderful beginning, but was not written for security. Then it was bludgeoned and compromised in the mid-90's to make it more user-friendly and responsive, and Microsoft started losing track of what was actually going on inside it. By the time Vista came out, it was wildly out of control, and in the mass exodus of top engineering people when Vista shipped, one was quoted as saying "Nobody at Microsoft really understands how Windows works any more".

That same NT codebase is what is running Win7, Win8, and Win10. Granted, it's much improved through those iterations (we're talking the underlying codebase of the operating system, not the GUI). But it's still a mystery to everyone outside Microsoft, and most of those inside.

Mac software suffers from the same proprietary nature, but it's built over open-source UNIX which is solid and secure. Linux is probably in the best shape in these regards. But every operating system has bugs, and they all need patches.

My personal hope is that that someday, Microsoft chucks out the albatross of the NT codebase and migrates their systems to something that is intrinsically more secure and stable by design. Hell, they could do what Apple did, use UNIX as the base and run their GUI and userland stuff on it. Windows could make a quantum leap that way, IMO.

I really want Microsoft to succeed by improving Windows, and I personally think that is best done with a total revamping of the architectural structure. They've got a lot of brilliant people there. They could do it if they wanted to. I'm not holding my breath, though.

[867V309]

Mind giving me a clue what you're referring to?

Not at all.

Ever hear of MSNBC? Know what the MS part is?

microsh!t is a known evil, and W10 is a known deep state spy. Wake up to what is around you.

[dayglored]

>> Mind giving me a clue what you're referring to?

> Not at all. Ever hear of MSNBC? Know what the MS part is? microsh!t is a known evil, and W10 is a known deep state spy. Wake up to what is around you.

OHHHH, okay. Whew. For a minute there I thought you were one of the folks who give me a hard time for posting articles about all the things that are wrong with Microsoft and Windows. (I get called a "Microsoft Hater" or "Windows Hater" pretty often. Even had a few people on my Windows Ping List drop off for that reason, telling me to go to hell in the process.)

I actually am fully aware of the things you describe (MSNBC, Win10 spyware, etc.). And that Microsoft has demonstrated malicious intent for decades. I've spent my entire working life (I'm 65 at present) engineering and supporting computers and computer-based products. And have made a great deal of my living dealing with Microsoft products. You're welcome to check my FR profile page if you want the gory details. You'll see that I'm anything but a Windows/Microsoft fanboi.

I post articles about Windows and Microsoft because, despite being mainly a Unix/Linux type techie, I run the Windows Ping List here at FR. And the reason I do that is simple: For many years I bemoaned the fact that there wasn't a Windows Ping List to alert Windows users to things of interest, mainly of course security issues and other problems, but also new releases that might be of interest. Since nobody else was picking up the ball and doing the list, I decided to do it myself. You can take a look at the early threads on the list and see that I was very upfront about the fact that I'm not personally a Windows fan, but I do believe I've been overall pretty fair.

The majority of the Windows/Microsoft threads I've posted (many hundreds) are not pro-Windows or pro-Microsoft. I don't hate anybody, and I certainly don't waste my time hating a piece of software. But my fellow FReepers have expressed a desire to be informed about what's going on with Windows, and I'm happy to provide that service.

Does that help explain what's up with "my MS BS"? :-)

Best FRegards,
Dayglored

[867V309]

You'll see that I'm anything but a Windows/Microsoft fanboi.

You could have fooled me.

[dayglored]

> You could have fooled me.

Wow. Okay, well I'm not out to fool anybody.

Like I said on the profile page, I'm not anybody's fanboi. At the moment I'm typing on a MacMini running OS X, with two VMs going, one Windows 7, the other CentOS 6 (Linux). Because I do a lot of things that require all of those. I'm remotely VPN'ed into my Linux box at work.

The software company I work for is completely heterogeneous, and as a System Admin I deal daily with Ubuntu Linux, Unix (FreeBSD, NetBSD), Solaris, Mac OS X, and Windows 7 and 10. I don't have time to play favorites.

My workstation there is, by my choice, CentOS Linux, because of all the above, I am most comfortable doing IT work in that environment. I has its limits for media (video and audio support are still, alas, pretty lame) but my employer doesn't pay me to watch videos.

If I had to choose only one operating system and no other for my personal use, it would probably be Mac OS X, because in addition to a very good GUI, it has real UNIX under the hood, and I can run my scores of POSIX utilities, decades of C programs and shell scripts, and other such things, in a true X11 environment. I consider it the best overall combination of ingredients, and their hardware is excellent, in my experience.

And that's why the actual Windows fanbois give me a hard time. They accuse me of hating Windows (I don't). They accuse me of hating Microsoft (I think Microsoft has a history of doing evil things, but I don't waste time with hating.)

So it's kind of refreshing to be called a Windows fanboi, as you did. It's completely untrue, but at least it's a change from the other accusations. :-)

Have a great evening, I'm on the East Coast and need to get some sleep before I get up for work. Cheers!

[867V309]

Wow. Okay, well I'm not out to fool anybody.

And yet, you never acknowledge any of the spycraft evil going on at microsuck.

Trust me, regarding your previous employment/field of work/expertise: nobody cares. so give it a rest.

Most everyone knows W10 is spyware, and your defending it only makes you look fanboi.

[dayglored]

“Defending Microsoft’s spyware”?? Me?? You must have missed all the threads I posted, and the negative comments I made about Win10’s spyware a.k.a. telemetry, many months ago.

I have attempted to separate the known-true from the speculative, and inform people how to turn off the damned telemetry if they have to use Win10. I’ve characterized some of MS’s actions as evil, have warned folks against using Win10, etc. so I don’t know what more you would have me do.

Meanwhile, your false accusations are no longer very funny, and you are barking up the wrong tree. There are plenty of actual Windows and Microsoft fanboys on FR, and you’re welcome to harangue them. But I’m not one of them. I appreciate your conversation and acknowledge your position, but I’m bowing out at this point. Good night.

[867V309]

but I’m bowing out at this point. Good night.

Again?

[dayglored]

Yep, this time for real.

[thoughtomator]

In terms of malware threat level, I regard Windows Update to be far more insidious and dangerous than anything found in the wild.

[thoughtomator]

Making a software recommendation, of software you do not have the ability to QA yourself, to strangers running software configurations you are not aware of and have no ability to inspect, observe, or troubleshoot, is an all-risk, no-benefit play.

If you’re going to stay in this industry you need to develop much much a better sense of liability and risk management, because it is inevitable that recklessness in this regard will come back to bite you sooner or later.

[867V309]

Yep, this time for real.

I'd say, "sorry, you've lost all credibility," but that happened at post #1.

[dayglored]

> I'd say, "sorry, you've lost all credibility," but that happened at post #1.

LOL. Hey, good job of baiting me last night. I should know better (it was reminiscent of FReeper dennisw, who was famous for trolling folks on the Apple threads), but I was pretty tired.

See ya on another thread some time... :-)

[dayglored]

> Making a software recommendation, of software you do not have the ability to QA yourself, to strangers running software configurations you are not aware of and have no ability to inspect, observe, or troubleshoot, is an all-risk, no-benefit play. If you’re going to stay in this industry you need to develop much much a better sense of liability and risk management, because it is inevitable that recklessness in this regard will come back to bite you sooner or later.

Your comment astonishes me.

Do you consider it "reckless" to remind people who use Windows, to either a) install the security updates or b) get on another operating system?

What other choices would you offer -- to folks who aren't highly technical -- that you consider more responsible? Windows users no longer have the option of easily picking and choosing among updates; they're all rolled into one monthly blob. Shall we tell them, "Don't install those nasty updates, just be REALLY REALLY careful whenever clicking links or opening email?" That's not a useful strategy for most people. "Disconnect from the internet entirely" might be useful, but highly counterproductive to why they have the computer in the first place.

Don't just criticize me -- that accomplishes nothing. Offer something more useful. Windows updates and related security matters are complex issues, for folks who run Windows. Surely with all your apparent experience (how long have -you- been "in this industry"?), you can do better than to just attack me.

Lend a hand here, please. I don't understand where you're coming from.

[thoughtomator]

What happens if someone follows your advice, and immediately after their computer stops working?

Who owns that problem?

[dayglored]

> What happens if someone follows your advice, and immediately after their computer stops working? Who owns that problem?

Total red herring.

Case in point #1: I currently own (personally) five Win7 and one Win10 installation; two Win7s are on metal (a laptop and a desktop), and the others are VMs. All are patched up to date, and none have ever stopped working.

Case in point #2: At my job, I tend to about 75 Windows 7 and 10 machines, mostly on-the-metal desktops and laptops, the rest VMs. All are patched up to date, and none have ever stopped working. None, ever.

The above machines run the gamut in hardware, brand, peripherals, options, etc. If the problem you fear was even somewhat common, I'd have experienced it.

Windows 7 updates nearly always require a reboot. When it doesn't come up after a reboot, the problem is almost always a kernel-level driver conflict. In most cases, it clears itself after one BSOD/reboot. In a few cases, it's necessary to restart in "Safe Mode", an option shown on the next boot screen. The majority of those who have experienced a BSOD had installed third-party device drivers which had a conflict with an update that also affected that hardware. That's what Safe Mode startup is for.

The vast majority of Windows 7 users never experience an update-related issue of "the computer stopped working" -- as in "Windows doesn't come up at all". Moreover, a lot of those turn out to be memory or other hardware issues unrelated to the update, but the reboot required by the update brought the hardware issue into play.

The actual percentage of Windows 7 users whose machines stop working completely due to an update is extremely small. And those few unfortunates generally find a way (another computer or a friend's computer) to contact Microsoft support, which is generally quite good at getting it going again. Microsoft "owns" those problems, and it's on them to fix them.

I suspect your sense of perspective is somewhat skewed by your dislike of Windows, or of Microsoft, or something similar.

Question #1: Do you seriously propose recommending that ALL ~1 billion Win7 users NOT install the security updates, because an extremely small percentage of users experience serious trouble?

Question #2: What operating system do you run, that is immune to "non-start issues"?

[thoughtomator]

It’s not even slightly a red herring. It’s a real-world situation, the kind that is common with so many people running so many different types of software and knowing so little about how to operate their computers.

Now what if the machine in question was business-critical for somebody?

Can’t count how many times I went into a situation to do one simple and routine thing, and then had to fix an entire environment because that one thing sent an unstable situation over the edge. The situation described above is not hypothetical or theoretical, it is an actual situation I have encountered multiple times doing IT support over the years.

As a result of this variability of environment, generally correct advice can be bad in any particular case.

My comments are completely platform-neutral and apply to all systems and platforms. One simply cannot make a responsible recommendation for any particular case without knowing the whole of the situation.