How Fast Does Malware Leveraging EternalBlue Propagate? The case of WannaCry and NotPetya - INSA Rennes - Institut National des Sciences Appliquées de Rennes
Communication Dans Un Congrès Année : 2024

How Fast Does Malware Leveraging EternalBlue Propagate? The case of WannaCry and NotPetya

Résumé

Malware attacks pose a critical threat to digital infrastructures particularly given their potential for widespread and fast propagation. Mitigating them involves limiting their expansion, which requires a thorough understanding of their propagation mechanisms. However, few studies have been conducted on their propagation behaviors in large-scale networks. In this paper, we present the results of an empirical study focusing on the propagation strategy of WannaCry and NotPetya, two malware instances leveraging EternalBlue, an exploit developed by the NSA and stolen by The Shadow Brokers hacker group, which has been used to implement rapid spreading in some malware instances. Our experiments qualify the speed of infection, epidemic behavior, and spreading strategies in a local network of 50 VMs. We have especially measured for WannyCry that (1) nearly 20% of infections are processed in less than 50 seconds, and (2) up to 16 hosts are infected in a 100-second period. Our results provide meaningful insights on malware propagation to support the design of effective countermeasures.
Fichier principal
Vignette du fichier
How Fast Does Malware Leveraging EternalBlue%0DPropagate? The case of WannaCry and NotPetya.pdf (717.53 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Licence
Copyright (Tous droits réservés)

Dates et versions

hal-04645862 , version 1 (12-07-2024)

Licence

Copyright (Tous droits réservés)

Identifiants

  • HAL Id : hal-04645862 , version 1

Citer

Do Duc Anh Nguyen, Pierre Alain, Fabien Autrel, Ahmed Bouabdallah, Jérôme François, et al.. How Fast Does Malware Leveraging EternalBlue Propagate? The case of WannaCry and NotPetya. SecSoft 2024 - 6th International Workshop on Cyber-Security in Software-defined and Virtualized Infrastructures, Jun 2024, Saint Louis (Missouri), United States. ⟨hal-04645862⟩
42 Consultations
26 Téléchargements

Partager

More