Previous Year Question

WannaCry, Petya and EternalBlue are terms associated with cyber attacks and cyber vulnerabilities.

WannaCry was a ransomware cryptoworm that affected computers across the world in May 2017. It spread rapidly across networks, primarily by exploiting a vulnerability related to Server Message Block version 1 (SMBv1) in older or unpatched Microsoft Windows systems. It encrypted files and demanded a ransom in cryptocurrency for restoring access to them.

WannaCry was not merely ransomware but also a worm. This means that it did not require continuous user interaction to be installed separately on every computer; after finding a vulnerable network, it could automatically spread from one system to another.

Petya is a family of ransomware whose initial form appeared in 2016. Instead of encrypting only individual files, it could affect a computer’s Master File Table and boot process. NotPetya, which spread in June 2017, appeared to be ransomware, but its principal effect was the permanent destruction of data; it is therefore commonly treated as a destructive wiper.

EternalBlue was not itself ransomware. It was an exploit that took advantage of a vulnerability in the SMB protocol of Microsoft Windows. Microsoft released the MS17-010 security update for this vulnerability in March 2017. Attacks such as WannaCry and NotPetya used such SMB vulnerabilities to spread through unpatched systems.