WannaCry (2017): How EternalBlue and MS17-010 Enabled a Global Ransomware Worm

Summary

WannaCry was a ransomware worm that spread rapidly starting May 12, 2017, infecting an estimated 200,000+ computers across 150 countries within days, including systems at the UK's NHS, Spain's Telefonica, and FedEx.

Technical Root Cause

WannaCry propagated using EternalBlue, an exploit for CVE-2017-0144, a vulnerability in Microsoft's SMBv1 protocol implementation (CWE-119, improper buffer restriction). EternalBlue was developed by the NSA and leaked by the Shadow Brokers group in April 2017, roughly a month after Microsoft had already shipped a patch (MS17-010) in March 2017. The worm combined EternalBlue for propagation with the DoublePulsar backdoor for persistence, and encrypted victim files, demanding Bitcoin ransom payments.

Why It Spread So Fast

Because it was a self-propagating worm exploiting an unauthenticated remote vulnerability in a commonly-enabled protocol (SMBv1), WannaCry could spread laterally across networks without any user interaction, unlike typical phishing-delivered ransomware. Organizations that had not applied the MS17-010 patch, despite it being available for roughly two months, were vulnerable.

OWASP / CWE Mapping

• CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
• OWASP A06:2021: Vulnerable and Outdated Components (unpatched systems)

Lasting Impact

WannaCry is frequently cited in patch-management discussions as a case where a known, patched vulnerability caused massive damage purely due to slow patch adoption. It significantly increased enterprise investment in vulnerability management and network segmentation to limit lateral movement from a single compromised host.

How Safeguard Helps

Safeguard's vulnerability management and risk scoring can flag unpatched systems against known-exploited vulnerability lists (like CISA's KEV catalog), helping prioritize patches for vulnerabilities with active exploitation in the wild.

References

• CVE-2017-0144: https://nvd.nist.gov/vuln/detail/CVE-2017-0144
• Microsoft MS17-010: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010