美国国家公共电台 NPR From Kill Switch To Bitcoin, 'WannaCry' Showing Signs Of Amateur Flaws

 

DAVID GREENE, HOST:

Two cybersecurity firms say they have found some technical similarities between the WannaCry ransomware and earlier attacks from hackers¹ in North Korea, though they are not calling these clues proof that North Korea is behind the worldwide attacks that began last week. Other experts are saying that they are puzzled by WannaCry. As NPR's Martin Kaste reports, they say the ransomware actually contains some pretty amateurish² flaws.

MARTIN KASTE, BYLINE³: Nick Selby's a police detective in Texas who specializes in cybercrime. He says the cops have a decent shot at catching⁴ certain kinds of online scammers - say, that guy selling the too-good-to-be-true car on Craigslist. But when it comes to ransomware, that's tougher.

NICK SELBY: It tends to be a crime that is born on the Internet, is born through tips that are sold on a dark web that already prebuild in anonymity⁵ of the perpetrators.

KASTE: And that's what the experts think they're seeing here with WannaCry. Somebody is using software tools that were created by somebody else. Paul Burbage is a malware researcher for Flashpoint-Intel.

PAUL BURBAGE: The ransomware itself - we have seen that in the wild before, and it's not that sophisticated.

KASTE: He says the most obvious tip-off is the fact that the malware contained an easy-to-find kill switch, basically a URL address included in the code, which was used to stop the malware's spread.

BURBAGE: The kill switch allowed people to prevent the infection chain fairly quickly. It was kind of a new mistake, if you ask me.

KASTE: And WannaCry has some other deficiencies, too. Sophisticated ransomware usually has an automated⁶ way to accept payments from its victims who want to unlock their computers. But Burbage says WannaCry's system seems to be manual. The scammers have to send each victim a decryption code, which isn't very practical for an infection that involves thousands and thousands of computers.

BURBAGE: It leads me to believe that they did not think that it was going to spread as far as it is. You know, I really think that these guys are running scared, and they're probably laying low at this point.

KASTE: And then there's this - so far, at least, the scammers have collected payments from fewer than 200 victims. We know this because they're demanding Bitcoin, and Bitcoin transactions are public. We don't know the scammers' names, but we know the Bitcoin addresses they're using to receive payment - just three addresses. Again, a more sophisticated ransomware would have had the ability to generate a unique Bitcoin address for each victim.

Jonathan Levin is a co-founder of Chainalysis. It's a company that analyzes⁷ Bitcoin usage to identify money laundering⁹. He's been watching the Bitcoins accumulating at WannaCry's three addresses. So far, they've collected about $60,000 worth. But those Bitcoins are just sitting there, he says, untouched.

JONATHAN LEVIN: It might be that they don't have another good idea yet about how they want to launder⁸ the Bitcoin. Perhaps they're not really set up to take advantage of the success of their campaign so far.

KASTE: Levin says one way to turn dirty Bitcoin into real-world money is to do that conversion¹⁰ in a jurisdiction¹¹ where the financial authorities turn a blind eye, so the scammers will sometimes have safe zones. Usually it's their home country, where the malware is not allowed to do any damage. He gives the example of a very successful ransomware called locky, which favors Russia.

LEVIN: So if it detects that there is a Russian language on the machine, it actually does not execute and deletes itself.

KASTE: WannaCry, in contrast, does not seem to be playing geographic¹² favorites this way. And Levin says if the perpetrators live in one of the countries that have been hit hard by this - say, in Russia - that would be, as he puts it, an incredibly bad life choice. Martin Kaste, NPR News.

(SOUNDBITE OF FLVKE'S "ZERO STATION")

1 hackers   

n.计算机迷( hacker的名词复数 )；私自存取或篡改电脑资料者，电脑“黑客”

参考例句：

• They think of viruses that infect an organization from the outside.They envision hackers breaking into their information vaults. 他们考虑来自外部的感染公司的病毒，他们设想黑客侵入到信息宝库中。 来自《简明英汉词典》
• Arranging a meeting with the hackers took weeks againoff-again email exchanges. 通过几星期电子邮件往来安排见面，他们最终同意了。 来自互联网

2 amateurish   

n.业余爱好的，不熟练的

参考例句：

• The concert was rather an amateurish affair.这场音乐会颇有些外行客串的味道。
• The paintings looked amateurish.这些画作看起来只具备业余水准。

3 byline   

n.署名；v.署名

参考例句：

• His byline was absent as well.他的署名也不见了。
• We wish to thank the author of this article which carries no byline.我们要感谢这篇文章的那位没有署名的作者。

4 catching   

adj.易传染的，有魅力的，迷人的，接住

参考例句：

• There are those who think eczema is catching.有人就是认为湿疹会传染。
• Enthusiasm is very catching.热情非常富有感染力。

5 anonymity   

n.the condition of being anonymous

参考例句：

• Names of people in the book were changed to preserve anonymity. 为了姓名保密，书中的人用的都是化名。
• Our company promises to preserve the anonymity of all its clients. 我们公司承诺不公开客户的姓名。

6 automated   

a.自动化的

参考例句：

• The entire manufacturing process has been automated. 整个生产过程已自动化。
• Automated Highway System (AHS) is recently regarded as one subsystem of Intelligent Transport System (ITS). 近年来自动公路系统(Automated Highway System,AHS)，作为智能运输系统的子系统之一越来越受到重视。

7 analyzes   

v.分析( analyze的第三人称单数 )；分解；解释；对…进行心理分析

参考例句：

• This approach analyzes management by studying experience usually through cases. 这个学派通常从实例获得经验，用以分析管理。 来自辞典例句
• The econometrician analyzes statistical data. 经济计量学者要分析统计材料。 来自辞典例句

8 launder   

v.洗涤；洗黑钱（把来路可疑的钱弄得似乎合法）

参考例句：

• She wore a freshly laundered and starched white shirt.她穿一件刚刚浆洗熨烫过的白色衬衣。
• The gang launders the steal money through their chain of restaurants.这帮匪徒通过他们的连锁饭店洗赃款。

9 laundering   

n.洗涤（衣等），洗烫（衣等）；洗（钱）v.洗（衣服等），洗烫（衣服等）( launder的现在分词 )；洗（黑钱）（把非法收入改头换面，变为貌似合法的收入）

参考例句：

• Separate the white clothes from the dark clothes before laundering. 洗衣前应当把浅色衣服和深色衣服分开。 来自《简明英汉词典》
• He was charged with laundering money. 他被指控洗钱。 来自《简明英汉词典》

10 conversion   

n.转化，转换，转变

参考例句：

• He underwent quite a conversion.他彻底变了。
• Waste conversion is a part of the production process.废物处理是生产过程的一个组成部分。

11 jurisdiction   

n.司法权，审判权，管辖权，控制权

参考例句：

• It doesn't lie within my jurisdiction to set you free.我无权将你释放。
• Changzhou is under the jurisdiction of Jiangsu Province.常州隶属江苏省。

12 geographic   

adj.地理学的，地理的

参考例句：

• The city's success owes much to its geographic position. 这座城市的成功很大程度上归功于它的地理位置。 来自《简明英汉词典》
• Environmental problems pay no heed to these geographic lines. 环境问题并不理会这些地理界限。 来自英汉非文学 - 环境法 - 环境法