Earth's Deadliest [Computer] Viruses: WANNACRY
(lava bubbling) - [Narrator] A bomb explodes in Rome. No one is injured. Brazil declares an end to the Zika virus as cases decrease. A band called Paramore releases their fifth studio album.
And in the farthest reaches of cyberspace, a small crypto worm is searching. It needs to escape this place. But it can't.
Not until it finds an open port. Most of them are locked up securely. But one remains vulnerable. In the depths of the NSA, an exploit is discovered. Researchers find a vulnerability in something called SMB, a communication protocol for shared access between files and devices.
The worm is created and kept as a secretive defense against future cyber attacks. Then one night it escapes. A link appears on social media. The link leads to an anonymous content sharing platform. The platform leads to files, encrypted with a password. Three folders are inside.
Among these is a familiar face. - [Robotic Voice] Eternal blue. - [Narrator] These are called zero day RCEs. When executed, they'll begin infecting computers with backdoor entrances, but they won't make themselves visible right away.
Instead they'll patiently sit and quietly wait. The crypto worm begins work. Wannacry.exe releases a password protected zip file onto the computer's main hard drive, inside this folder are all the tools it needs for the job ahead. It downloads a Tor client at the following URL, and extracts that to a folder called task data.
This client opens communication channels with five different servers. The worm ones to ensure it can write files on every hard drive, as fast as possible. To accomplish this, it opens command prompt and runs. Now with full unprecedented access, it runs commands to terminate every last connection to the outside world. (chaotic music) (goat bleating) Next, it scans all drives for the following extensions.
It locks them behind an impenetrable wall of encryption. Then tags them with its mark. It then clears all recovery and backups and scans for any computers connected to the same network. If found, it repeats the process indefinitely. - Multiply.
(indistinct) - [Narrator] After successfully capturing its victim, it displays the simple message. (chaotic music) - Oh don't cry, are you? Aw. - [Robotic Voice] You are watching Disrupt.
- [Narrator] The head of cyber defense operations at Microsoft releases a statement. For most, it's too late. Telefonica, a Spain based telecommunications company halts their operations. FedEx apologizes to their customers. More than 15 national health service facilities around England and all of their patients halt. Around 300 people try sending money to the address.
A total of 51 Bitcoin is sent. Back then this was around. Today, it's around. Their files remained encrypted. (electronic music) A young cybersecurity specialist is returning from lunch and he notices the massive spread. He throws aside a takeout box and begins the defense.
Marcus Hutchins, AKA MalwareTech starts uncovering bite by bite, line by line, the foundations of wannacry. He runs a sample of the malware code inside a safeguarded analysis environment. And notices that the code is trying and failing to connect to a domain. He checks if that domain is registered.
The groundwork for something called a sinkhole is linked. If successful, the server will capture the traffic that the worm is sending, then stop it from traveling any further. Marcus registers the domain, runs the analysis environment, and crosses his fingers.
(somber music) (plucky music) The smell of garbage permeates the street corner, but Jeremy Jemena is used to it. He's worked this route for years. On a street called Passion Monte in a town called Taytay in the country of the Philippines on planet earth. The collector gets off and begins loading the bags into the back. Old grain, pizza boxes, toilet paper.
Lastly, Jemena picks up at bedspread. (mysterious plucky music) The local police tape off the area and begin their investigation. Autopsies revealed the victim as a Catherine Lee. Instantaneous death.
Days later, her husband requests that the case be elevated from the local police to the national bureau of investigations. Agent Rizaldy Rivera is on the job. He discovers that Catherine Lee was a real estate agent. (chill music) Bill Maxwell states that he and his colleague, Tony are looking for real estate on the island.
The only stipulation that it be a good investment. Bill and Tony introduced themselves as Canadians. Catherine Lee introduces them to her two other real estate brokers that would be joining the tours.
Somewhere along the route, the two brokers split up. And Catherine Lee is murdered. Agent Rivera tries tracing the plates of the silver Toyota only to find it hadn't checked with the security guard at one of the properties the convoy viewed, the guard procures a registration number from the vehicle's temporary tag, crosschecks this with the local Toyota dealership. He traces the bullets to a 22 caliber handgun.
He tries running the names of the two Canadians in the Bureau's immigration database. Bill Maxwell, Tony, no last name. For the next three years, the case goes cold. (phone ringing) - [Robotic Female Voice] Call from: US Drug Enforcement Agency. press one to- (button tone dials) Across cyberspace two Canadians were emailing back and forth with someone in the United States. This was by a screen name Rambo who subsequently forwards the information to another individual, screen named Benny.
Benny wires more money to Rambo who uses it to buy a 22 caliber handgun, and sends it to the Canadians. A few days later, Rambo receives another message. Investigators decode that the two Canadians aren't Canadian at all, they reside in North Carolina, identified now as Adam Semia and Carl Stillwell. Pictures of the bike, which he named. The two are arrested, given life sentences. But to agent Rivera, something doesn't add up.
(cyber music) What the agents from the US embassy told him would be the start of uncovering the largest cyber criminal enterprise in history, a dark empire in the shadows for nearly a decade. (somber music) Around the world every infected machine connects to the sinkhole. Defenses are reinforced and over the next three days, the team play a metabolic game of tug of war between offense and defense. A security researcher in France finds an antidote. When a regular system generates an RSA encryption key, it must choose between two primary numbers.
Once the key is registered, those primary numbers are typically stored for safekeeping, as they can be used to regenerate the original encryption key. Whatever created the virus didn't wipe those prime numbers from the system. They remain in the cache. Adrien Guinet releases the WannaWiki encrypter which recovers those prime numbers from the PC memory, then attempts its final revival.
Clues surface about the birth place of origin. The first clue, the ransom notes appear to be machine translated from English. Next, the inner files contained fonts in the Hango language. Lastly, the metadata points to a computer that was used to write the viruses being set to the UTC time zone.
However, this is as far as they get. Over the following years, variants spawn in the wild. Over 12,000 different worms begin wreaking small-scale havoc on their prey. But none of them have as large of a footprint as the original, the same protocol is prevalent, crawling into the open network port, seizing control, demanding payment. - [Narrator 2] So here is the actual WannaDecrypt that pops up. We can see our files just disappeared here.
They have all been encrypted and now no longer function. - [Narrator 3] Good evening citizens of the metaverse and welcome to the electronic simulation showcase show. Today we're looking at the sports car of at-home virtual reality hardware, the Roto Chair.
This gaming chair is specially designed to increase immersion in your favorite VR simulations. Plug in your HMD cables into the grade A cable management system. Now, when you turn your head in game, the motorized chair will turn your entire body a full 360 degrees.
The Roto is equipped with double rumble motors on the bottom and backsides, meaning every explosion, every windstorm will feel like you're actually there. Intense. Comfort is the name of the game when you're kicking back and watching a film, flying through the vast cosmos or shooting your way to victory, With full padding, it's like you're sitting on an immersive cloud, ready to reach the depths of the metaphysical simulational, (audio stutters) virtual transfiguration on realities. The Roto Chair, the world's first interactive VR chair. (upbeat music) (hiphop music) (dog barks) (busy music) - [Narrator] Small town, middle America A box arrives from FedEx.
Inside our Soma pills, a muscle relaxer. Obtained through a network laid in place thousands of miles away. First, the customer receives an email from a generic prescription drug website. The customer selects what she wants, fills out her symptoms, pays by credit card. The order is collected by a company called RX Limited, and relayed to one of the mini American doctors who they've partnered with.
The doctor reads the symptoms, then fills out a prescription form. The form is then sent to an independent pharmaceutical retailer who reads the prescription, fills the order and sends it right back to the customer. - [Female Narrator] Sadness, loss of interest, anxiety. - [Narrator] The pipeline is for the most part, automated, with customer service being handled at call centers in Israel. One of these call centers is interviewing a new employee, Morin Oz. He heard about the job from a friend's brother-in-law.
The boss is named Boaz Taggart. Boaz says he started the company with his brother Tomar and a silent partner. The company services a larger network of websites, including RX Limited and another one called Alphanet. Morin Oz takes the managerial job. He's told to adopt an American sounding name.
Told to say they're from Utah, not Israel. Their biggest sellers are Soma, Fioricet and Ultram. Occasionally one of their prescription funnels goes offline.
Regulatory issues. Then, it returns. Over the subsequent months, the company grows rapidly, steady upward growth. Oz is making good money, decides to take a vacation.
Upon returning, he finds that Boaz has left the business. His brother Tomar is now in charge. Over the next year, things continue normally, steady upward growth. Then, Tomar is out.
Signed. Oz inquires with his coworkers. It's the silent partner. The new boss doesn't show up to the office.
Only takes some calls or communicates via email. Says he's too busy to travel. He insists Oz encrypts his hard drive with a program called E4M. Over the subsequent months, things continue as normal. Steady, upward growth. Then he informs Oz he wants to meet.
Oz and his coworker Bergman finally meet their boss. He informs them he's opening a new call center in Tel Aviv. He wants them to staff and oversee it.
The endeavor would be called CSWW. The business opens. Each month, they receive a wire transfer from Hong Kong to cover operation costs.
Steady, upward. A new hire Levi Kugel, an American joins the operation. RX Limited is growing so quickly that it's finding difficulty finding enough pharmacies to fill orders. Oz and Levi begin discussing the possibility of starting their own wholesale pharmacy in the US to help fill in those orders at a lower cost to save their boss money.
He's picked up at his hotel by an American named Dave. They ride to one Paul's yachts. The plan is to travel for the day to a small island that house the center, do the inspection, spend the night, then head back. As the shore shrinks on the horizon, Oz takes a drink from a champagne glass one moment, then finds himself hurling towards the ocean surface the next.
He's greeted with the barrel of a nine millimeter. He hears Dave yelling at him. He tries to plead with a man. Wondering why.
David says something into a satellite phone he's holding. He's pulled back on board, driven back to the hotel and dropped off. Paul denies any knowledge of the event. Christmas Eve.
A baby boy is born. First name. He's adopted by a loving family. His family moves to South Africa where his father starts a company. He does well in primary school.
Good grades, friendly demeanor, clean as a whistle. He's not a huge fan of sports. Instead he takes to wing commander. One day, his father proposes a deal, clean the car, get a computer. Deal accepted.
Atari SD. From here, the boy dives deep into code, creating worlds. At 15 police storm the family home. Paul was arrested for selling porn.
At 16, he drops out of high school. At 17, he moves out. By the late 90s he's married and residing in Australia, and he's just released an encryption program. The manifesto posted on the website reads. It's a solid piece of software and it grows popular, but he releases it for free and he's struggling for cash.
His marriage falls apart and he moves to Hong Kong, then Rotterdam and the Netherlands, marries again, has a kid, launches a software development company. One of his clients is Wilfred Hafner, an Italian engineer. Wilfred hires Paul and to build a package piece of software similar to his early E4M encryption program. They call it Drive Crypt.
Hafner discovers that Paul has been funneling some of the work he's been creating for Drive Crypt into an unnamed personal project. He's fired. Paul goes underground.
Another company is registered. IBS Systems, which would later become a division of Rx Limited. Rx Limited now has tens of thousands of various domains fronted as separate pharmaceutical companies. Paul creates his own domain register.
When one gets squashed, another appears. Capitalizing on the opioid crisis of America. It's estimated the company is pulling in 400 million per year. He operates his empire over the vast reaches of inverted cyberspace.
And by 2010, he's ventured from pharmaceutical drugs to weapon shipments. Pushes buttons in the virtual worlds, and his minions in the physical world execute. Bruce Jones is a captain, he's approached by a fellow Englishman about a job sailing a shipment from Turkey to Indonesia, to the Philippines.
The job would be paid for by a La Plata Trading. Shipping guns, all above table. He's told.
Him and his new Georgian crew sail from Turkey to Ghana to the Congo, then to Indonesia. Jones receives a call informing him to go to Subic bay and wait. Days pass. More days. With the unplanned delay, Jones has to return home. His wife is expecting their child any day now.
Jones jumps in a buoy and is replaced by a different pilot who continues the job. Eventually the ship is called out of the delay. As they're pulling out, local fishermen call the police. The boat is surrounded. They demand the cargo manifest. The new captain doesn't have it.
(heavy bass music) (gun firing) Joseph Hunter is the strong arm of Paul's empire. He enlisted in the army in 1983, joined the Rangers in 1985. And after the death of a friend in his unit, he was discharged from the Rangers due to psychological trauma. He then continues his service in the army as a sniper instructor, stationed in Puerto Rico. Over the next two decades, he achieves Sergeant first class.
Hunter returns to his hometown of Owensboro, Kentucky with his wife, boys, and dogs. He becomes an inmate counselor. Hunter quits the correctional facility and joins DynCorp. Job description, security at the US embassy in Baghdad. A former soldier introduces the military man to the businessman.
Within months, Hunter is hired by Paul under fake pseudo names. Among the jobs Paul hires hunter to do, one is to organize a hit on the captain of the seized shipments. Over the years, the many tentacles spanning drug businesses, weapons shipments, golden diamond smuggling are secured or hunted by Rambo. Paul needs a way to secure his loop.
He converts easily traceable cash with the cold hard assets. The more he attains, the more paranoid he becomes. (woman speaking indistinctly) Paul closes his operation in the Philippines, moves to Rio de Janeiro, and sits on his pile with a new wife and child. But it's not enough. He receives a message from a former employee.
Paul books a flight to the capital of Liberia to meet with the newly connected contact. Then Paul goes quiet. Hunter goes back to work. He needs to assemble three guys for a quote unquote special job. He spends the next few months sifting through resumes from mercenaries.
A few standout. Suborski, an ex Polish police who said he provided protection for president Bush and Pope John II while in Poland. The second is Gogal. He served in the German army, then moved into private security, specializing in tracking down Somali pirates.
Gogal connects hunter with the last one, Filter. A family man, with two young daughters. Hunter arrives in Thailand, The first time they've all met in person. The Colombians have a series of small time jobs for the crew, mainly countersurveillance.
They're stationed in various positions at pickup spots, tasked with ensuring police aren't monitoring things. Then Paul, under the name John sends an email to Hunter under the name of Jim about a snitch inside their operation. They would intercept a meth shipment Liberia in which the DEA agent or snitch was supposedly involved. The team stands by, waiting for the last coordinates from Hunter. Unarmed and off guard, Joseph Hunter is detained. Followed by Suborski, Filter and Gogal.
A pharmacy on the south side of Chicago is raided. In the back, they find boxes upon boxes of FedEx shipments full of medications. Kim Brill, a DEA investigator at Minneapolis St. Paul begins digging.
She gets a warrant and searches within FedEx's records leading her to a company called RX Limited. Alongside she finds that hundreds of pharmacies sprinkled throughout the US are shipping under the same FedEx account. First, the shipments, then the pharmacies, then the websites that those pharmacies receive their orders from, then the servers behind those websites, and finally, the company behind the registered domains. The paper trail leads them to Hong Kong, in which they discover millions of dollars flowing in and out of various shell companies.
Vishnu, East Asia Escrow, Ajax Technologies, all connected to central accounts held by one. Robert McGowan is a former employee of Paul. He was tasked with a secretive project in the democratic Republic of Congo. Eventually, he stomped the job. Paul subsequently used Robert's legal name to register various company documents. One of these is called Southern Ace.
Southern Ace is then used to funnel money into one of Paul's Somalian Militias. After a while, Paul abandons the project, stops the money transfers. Local authorities uncover more information about the militia, then relay it to the FBI who are led to Robert McGowan. Robert receives a call from the DEA with an offer. Paul takes the bait.
He boards the plane to meet up with his Colombian associates. Steps onto the runway and is seized upon by the agents. The DEA doesn't want to publicly announce their king pen has been captured. They still have a use for him. Using Paul's formerly encrypted email, agents act on his behalf, pushing buttons within his corrupt network.
Over the next year, the DEA begins slowly dismantling the empire, setting up stings. Among those is Rambo. Joseph Hunter admits to the organized killing of the real estate agent from the Manila.
Months before her death, Paul gave her nearly 3 million to purchase property in the country. She then hired someone to do diligence on the deal. The report says the individual she hired ran off with the money.
Upon receiving the news, Paul hired Hunter to eliminate both of them, who subsequently hired the two gunman to complete the job. Hunter's three other gunman plead guilty to conspiracy to murder the DEA agent. (somber music) - [Woman] There are a thousand different possibilities for anything, like a stuffed animal you have on your bed. It looks like how it looks, but it could be at a slightly different angle. It could have different threading.
It could be infinitely different, and we don't know how it would look if it was different, because all we know is this. There is no certainty that you will live until tomorrow. There is no certainty that the universe will last as long as we think it will last.
And that's amazing. (mysterious music) (men speaking indistinctly)