News for hackers. Stuff that matters.

A comment on Researcher Who Stopped WannaCry Ransomware Detained in US After Def Con. Parent comment

Re:Researcher Who Stopped WannaCry Ransomware Detained in US... by celticninja on Thursday August 03, 2017 @02:15PM (#14922174)
He found the address in the source code of the ransomware, any researcher could have found it. He even said himself that when he found it in the source code and saw it was unregistered he registered it to see what would happen. As it turned out it stopped infections from occurring.

Not to say that he isnt the malware writer but your use of quote marks makes me think you have no idea about what happened and havent looked into it, just made some "wild assumptions".

[ Parent | on HN ]
Re:Researcher Who Stopped WannaCry Ransomware Detained in US... by Avery3R on Thursday August 03, 2017 @02:21PM (#14922233)
Pretty sure it was in disassembled machine code, not source code.
[ Parent | on HN ]
Re:Researcher Who Stopped WannaCry Ransomware Detained in US... by jtl999 on Thursday August 03, 2017 @10:59PM (#14925997)
I have taken the liberty to download a sample of WannaCry and I can see the "killswitch" domain just running strings on the binary.

    $ strings Downloads/24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c.bin |grep .com
   __p__commode
   http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
[ Parent | on HN ]