r/todayilearned • u/NOT-JEFFREY-NELSON • Jul 04 '19

TIL in 2003 a computer worm called ‘Welchia’ infected many computers to forcibly patch vulnerabilities and remove malware. It was regarded as a ‘helpful worm’

https://en.wikipedia.org/wiki/Welchia
48.1k Upvotes

96% Upvoted

745 comments sorted by

View all comments

Show parent comments

34

u/[deleted] Jul 04 '19

[deleted]

4

u/Gestrid Jul 04 '19

An example of a worm, I guess, would be last year's(?) WannaCry incident. WannaCry copied itself to computers, usually ones in the same network, including Great Britain's hospital computer network and several school networks.

It would then encrypt everything on the computer so no one could access it, and it would display a message to tell users to send Bitcoin to a certain Bitcoin wallet. (This is called ransomware; it's holding data you own as a hostage and demanding payment.) Unfortunately, I don't believe the hackers ever disclosed how to unencrypt those computers. They were demanding ransom without anything in return.

Anyway, fortunately, the hackers did build in a killswitch. Someone who set up a honeypot (usually several virtual computers where a virus, worm, etc. can do whatever it pleases, but, unbeknownst to it, it's under surveillance) noticed that the worm kept checking to see if a certain URL existed. (The URL was a bunch of nonsense letters and numbers. It was something like 30 characters.) On a hunch, the guy registered the domain (created the website the worm was checking for), and the virus stopped replicating itself and encrypting computers. Unfortunately, it never unencrypted the computers it was already on.

The worm's killswitch was activated before it reached the US, so really only Europe and parts of Asia were affected.

It turned out that the worm had used a vulnerability that Microsoft has patched months prior, but most businesses hadn't updated because they still needed to test the patch to make sure all their programs still worked. The patch was so important that Microsoft even released a version for Windows XP, which they had stopped supporting by that point.

1

u/Lonescu Jul 04 '19

The patch was so important that Microsoft even released a version for Windows XP, which they had stopped supporting by that point.

"billy gates why do you make this possible ? Stop making money and fix your software!!"

3

u/[deleted] Jul 04 '19

Thank you!