A South Carolina facility owned by aerospace and defense contracting giant Boeing was hit by a WannaCry attack on Wednesday, the Seattle Times reported, but the company is now trying to tamp down fears that the dreaded ransomware is back on the rise after it was only barely snuffed out last year.
A South Carolina facility owned by aerospace and defense contracting giant Boeing was hit by a WannaCry attack on Wednesday, the Seattle Times reported, but the company is now trying to tamp down fears that the dreaded ransomware is back on the rise after it was only barely snuffed out last year.
Per the Times, Boeing Commercial Airplane production engineering chief Mike VanderWel sent out a memo earlier in the day calling for “all hands on deck,” adding “It is metastasizing rapidly out of North Charleston and I just heard 777 (automated spar assembly tools) may have gone down.” VanderWel added that the WannaCry infection could have “spread to airplane software” after spreading to equipment used in the testing of newly produced aircraft.
But now Boeing is trying to reassure everyone that they don’t believe this is a worst-case scenario, the Times wrote:
The statement did not clarify whether the “limited intrusion” was indeed WannaCry, which uses an exploit named EternalBlue allegedly developed by the National Security Agency to encrypt file systems and demand ransom payments to unlock them in the form of cryptocurrency. WannaCry spread across much of Europe and Asia in May 2017 until British security researcher Marcus Hutchins, who goes by the pseudonym MalwareTech, accidentally deactivated it by registering a web domain that served as a kill switch.
Multiple variants of WannaCry are now in the wild, though there’s no evidence any of them have spread to planes.
Dallas, Texas-based cybersecurity researcher Mitchell Edwards told the Times that the version of WannaCry that allegedly hit Boeing was probably updated to remove the kill switch. But he also clarified that it is unlikely to have been modified to affect systems not running Windows, like planes or production equipment. While Microsoft has released patches intended to protect against WannaCry, either they have been ineffective at completely stopping revised versions of the software or Boeing did not install them.
Though the US has publicly asserted that the creators of the ransomware were hackers employed by North Korea’s infamous government, hard evidence on the matter has been elusive and it’s possible that someone went to great lengths to frame them. In any case, with new variants of the software emerging and the proliferation of similar malware based on leaked NSA techology, any finger-pointing at suspected culprits in this attack is premature.
[ Seattle Times]
