[VIDEO PLAYBACK] - Hello world. This is CS50 Live and I'm here on location in beautiful sun-- 

SPEAKER 1: I don't think this is going to work. 

DOUG LLOYD: Yeah, this isn't going to work. This is CS50 Live. I'm Doug Lloyd filling in this week for David. And we are coming to you live from CS50 Live's beautiful new studio. Well, actually we're coming to you live from CS50 Live's beautiful former studio, Hauser Studio at Harvard University where scenes like this from the very first episode of CS50 Live may be familiar. 

But just like any other episode, we're going to talk about some of the latest stories and news you might be interested in and take a little bit of a look underneath the hood. And this week we're going to start by talking about malware and unfortunately some malware attacks that have befallen Windows users. The biggest one of these is known as WannaCry. And WannaCry started to attack users about a week ago on May 12th. 

Now WannaCry is based on some exploits that were leaked from the National Security Agency by a group called Shadow Brokers. And the names of these two exploits are EternalBlue and DoublePulsar, I'll get back to those in just a second. But what happened to victims of these attacks were they would see screens like this suddenly pop up on their Windows computers. Basically what's happening here is the ransomware is saying all your files have been encrypted, you need to pay us $300 in Bitcoin in a couple of days, or in a couple of days we're going to say you have to pay us $600 in Bitcoin, and after that we're just going to delete your files. 

Now, that's not exactly a trivial amount of money. And getting a hold of Bitcoin is also not necessarily the easiest thing to do. Right now one Bitcoin, at the time of this filming, is worth about $1,800. So getting your hands on one in order to pay this ransom can definitely be no small feat. Now how these attacks work is taking advantage of an exploit in SMB 1.0. 

I know what you're thinking. No, SMB 1.0 is not Super Mario Brothers one, the classic game from my childhood. But actually SMB 1.0 is Microsoft's earliest version of Microsoft's file sharing protocol. And a user might experience using this protocol if, for example, they're in an organization that has a networked file server where many different users terminals are connecting to that file server or other network shared drives, they're probably using SMB. Now, there have been several versions of SMB since 1.0, I think they're up to 3.1 or something now. But it is 1.0 that is attacked by these EternalBlue and DoublePulsar exploits. 

Now this is actually not even the first time we've heard of SMB being part of a malware attack. You may recall a couple of years ago that Sony Pictures in November of 2014 was also the victim of a malware attack whereby users who exploited SMB, in a different way than what we're talking about today, were able to get a hold of Sony's employee roster and their home addresses and Social Security numbers, bank information, stuff you really don't want hackers to get a hold of, and tried to extort Sony to pay up to prevent that information from being leaked. Now, we heard about the current attack, the first large scale victim of this appeared to be Britain's National Health Service. 

And the reason that this seemed to gain a lot of traction around the NHS was they're a very large organization and apparently they were running a lot of legacy versions of Windows, which were using the SMB 1.0 protocol, which allowed this to spread very quickly through their system. Now, fortunately this week there was some good news. A security researcher found a kill switch, basically a way to just stop the virus from spreading or the ransomware from spreading. And the way they were able to find this actually cost them less than $11, which is pretty amazing. All the security researcher had to do was register these two URLs. 

They don't exactly seem like obvious URLs, they're pretty long, this random string of letters and numbers. But by registering those URLs, the security researcher was able to stop the spread of the ransomware. Now as it turns out, WannaCry is written in Visual C++, which looks pretty similar to C, which means we can actually take a look at the segment of code involved in this so-called kill switch that stopped the spread of the ransomware and see just how it worked. So the first thing we see here is a function called to memcpy, which copies information that the user is supplying into a location in memory. 

Here, URL is just a substitute for that really long string, I didn't want to type it out here again. But we're just copying that URL into memory so that it can be used later on. A couple of lines of code followed that weren't that important. But then WannaCry tried to open two internet connections. The first one, v4, is just checking to see whether the user is using a proxy server. 

So that one is not super important here. But v5 is the key to what allowed this kill switch to work. So what's trying to happen here is we are calling a function called internet open URL. And that is trying to open an internet connection to the URL that is stored in szurl, which is one of those really long alphanumeric strings. If it succeeds, so if v5, which means if I was able to establish an internet connection, as in that site exists, we just close both of the internet connections we have tried we just tried to open and we don't do anything else. 

But if that second one did not succeed, if v5 failed because that long URL didn't exist, so you can't go to that domain name, then it would close both the handles. And then it would execute this function, sub_408090. Apparently sub408090 is where the code that would then encrypt all of the user's files and then put up that big red ransom screen lived. So just by registering those domain names, which did not exist before, when the code went to check to see whether it could establish an internet connection, it succeeded. And so this subroutine would no longer execute. 

Now the bad news here is that after this news of this got out, the hackers took that kill switch out. And so now there is another version of WannaCry out there that is not going to be shut off by that kill switch any further. Now Microsoft back in March actually released a security update for currently supported versions of the Windows operating system for SMB. And the reason that they released this update was that the most severe of the vulnerabilities that they're patching here could allow remote code execution if the attackers sends specifically crafted messages to an SMB Version 1 server. 

So clearly they did not want this to happen. They released a security patch for any currently supported versions of Windows. Unfortunately, you know it is not currently supported version of Windows? Windows XP. And despite that, Windows XP is actually still used by about 7% of computers on the planet, which makes it the third most popular operating system still in use on the planet and that's despite XP having been officially deprecated by Microsoft in April of 2014. 

But Microsoft realized that this patch was affecting too many people, excuse me, this exploit was affecting too many people, they had to patch it. And so they actually released an emergency patch for unsupported versions of Windows in response to this particular attack. Now, if you were using any of these versions of Windows here, and you had automatic updates turned on or at least critical security updates turned on for automatic download and install, you were likely safe from this attack all along. If you're using any of these versions of Windows though, which are officially unsupported, and you haven't been subjected to this attack yet, which is good, head to the Microsoft website, download that patch. 

And maybe consider upgrading to a different version of the Windows operating system so that you will be more protected in case of things like this happening again. For more on this attack and how Microsoft recommends customers respond to it, head to this URL here. But never forget the importance of backing up your files. 

SPEAKER 2: Backup systems. If you're in the habit, as you should be, of backing up all of your files your software might be using Shaw 1 in order to ensure that your file is indeed correctly backed up. 

DOUG LLOYD: Now in addition to WannaCry, there was a similar piece of malware called Adylkuzz. And where WannaCry was trying to basically extort users to get Bitcoin, Adylkuzz is using their systems to generate Monero, which is a different kind of cryptocurrency. It's not taking the user's files hostage. What it's actually doing is just using their computer to mine for this cryptocurrency. It is making their computer constantly work hard and be busy and it really slows the user down. 

Now we're not going to get into how cryptocurrencies work, but if you're curious about why this particular attack would generate money for somebody who created this ransomware, you could head to this URL here, which explains how cryptocurrencies work and how they can be used to generate money. Now previously on CS50 Live we talked about a frighteningly effective Gmail scam, which was affecting a lot of people. And what would happen in this scam was that a user receive an email that looks like this, pretty innocuous, looks like a basic email with an attachment, except that this was not an attachment. It was actually an image that looked identical to Google's little box when you have an attachment attached to an email and you want to download it. 

And when you clicked on this image, it would bring you to a Google sign in page, which again looks completely innocuous. But if you provided your email and other login credentials to this form, that information wasn't being sent to Google it was being sent to a hacker. Google quickly responded, took care of that attack, but unfortunately a similar attack happened in Google Docs a couple of weeks ago. So I woke up on May 3rd with a bunch of emails that looked like this in my inbox. A lot of people suddenly wanted to share documents with me on Google Docs. 

Now a couple of things tipped me off here immediately. First of all, I was BCC'd on this email and second of all, I have no idea whose email address this is. So I was a little nervous about this. I didn't click on this link, but unfortunately some people did. And when they clicked on this link they were brought here, to a screen that, again, looked really similar to what we just saw. Google Docs is asking for permission to do certain things with your computer and it seems reasonable to allow Google to do this if you want to access this document. 

Unfortunately, this thing that says it's Google Docs was really more like Google Docs in air quotes. You may have heard, for example, something called email spoofing, which basically means I send an email from me that looks like it's being sent from somebody else. And the way this works is that email is sent using the SMTP, or simple mail transfer protocol. And in addition to the message that's being sent, the SMTP protocol includes a number of metadata or headers that include information such as who it's being sent to, who it's being sent from, where it's being sent from, where replies should go, what time zone, and so on and so on. 

So if I'm spoofing, for example, I might send an email that appears to be from say your HR department. And it's an email that asks for your direct deposit information, your banking information so that I can make a direct deposit. But though the email appears to be coming from your HR department, because that's what from header says, I could change the reply to, which is a different field that's usually invisible, to actually reply to me. So that you send the email thinking it's going to your HR department, but really it's going to me because I've pretended to be your HR department. 

This is really similar to what's happening here. This app called Google Docs is really just pretending to be Google Docs. And if you hover over the permissions page, that Google Docs there, you'll see this information here. And that information does not appear to be legitimate Google Docs. And in fact, if you submitted your login credentials here, it would go to this person and that page there. 

Now Google Docs responded very swiftly, again, to this, just as they did a couple of weeks ago. They, within an hour or so of the announcement of the attack really started to hit a lot of people, they posted this on their Twitter page. And less than 3 hours later they had addressed the issue, they had taken steps, they had updated safe browsing notifications, and they also updated in-email email notifications to warn users that an attack like this, similar messages to this were being used to attack people. 

So use extra caution and make sure you know the user before clicking on that link. Now, changing gears entirely. Oh, excuse me. Actually, if you want more information about this attack head to this URL here. 

Now switching gears entirely. You may recall that at the end of every fall semester we have the CS50 Fair, an epic display of students' final projects where they come and show the staff all the work that they did over the course of the fall semester. Well in the spring semester we run CS50 as well through Harvard Extension School for students both local to Cambridge and around the world. And this year we were very fortunate to have about a dozen students, who happen to be local, come and show our projects to the course's staff, their teaching fellows and course assistants, to David, and, of course, to their fellow students to delight in their project. 

So congratulations to everybody. It was great to meet you and great to see your projects. We also had a very special visitor, Sandy Shea, who came all the way from Taiwan to visit us at the CS50 Fair this year. And she proudly earned her, I took CS50 shirt. 

And that wasn't the only special visitor we had this week in the CS50 office. So pictured here is team Pochi Ma Buoni, sorry about the Italian there, who was one of the winning teams for CS50X puzzle day in 2016. And pictured at right here is Luigi Morelli who's also very active in the CS50X forums online. And Luigi actually came all the way from Rome to visit us in the CS50 office as well. 

Luigi it was great to meet you. Thanks so much for coming. I hope you enjoyed your stay in Cambridge. 

Well that's it for live this week. Thanks so much to Dan, and Scully, and Ian, Patrick, Tara, Marina, Christian, the Hoff. David, sorry I cut you off earlier. We'll see you next time. And until then, no vertical videos. 

[MUSIC PLAYING]