Researcher Who Stopped WannaCry Ransomware Detained in US After Def Con

Re:Researcher Who Stopped WannaCry Ransomware Detained in US... by slurppurple on Thursday August 03, 2017 @02:26PM (#14922280)

I mean he had to notice that it was contacting that website, might not have been an obvious thing to look for.

[ Parent | on HN ]

Re:Researcher Who Stopped WannaCry Ransomware Detained in US... by ryanlol on Thursday August 03, 2017 @02:31PM (#14922339)

Nah, this was one of the first things you'd notice. No need to reverse the binary, you see the domain in pcaps when you run it.

Registering unregistered domains the malware connects to is a very obvious thing to do, in this case he got "lucky".

[ Parent | on HN ]