- Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
- Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
- Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
- Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
- Kill switch: If the website
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comis up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).
update: A minor variant of the viru
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| @-moz-document domain("baidu.com") { | |
| body { | |
| display: none; | |
| } | |
| html { | |
| margin: 30px; | |
| } | |
| html::after { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| # kill the media key program on exit | |
| trap 'kill $(jobs -p)' EXIT | |
| # prevent iTunes from capturing media keys | |
| launchctl unload -w /System/Library/LaunchAgents/com.apple.rcd.plist 2>/dev/null | |
| # launch the media key program in the background | |
| (cmus-media-keys) & |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| On why stateful code is bad | |
| =========================== | |
| STUDENT: Sir, can I ask a question? | |
| TEACHER: Yes! | |
| STUDENT: How do you put an elephant inside a fridge? | |
| TEACHER: I don't know. | |
| STUDENT: It's easy, you just open the fridge and put it in. I have another question! | |
| TEACHER: Ok, ask. | |
| STUDENT: How to put a donkey inside the fridge? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copy and self modified from ys.zsh-theme, the one of default themes in master repository | |
| # Clean, simple, compatible and meaningful. | |
| # Tested on Linux, Unix and Windows under ANSI colors. | |
| # It is recommended to use with a dark background and the font Inconsolata. | |
| # Colors: black, red, green, yellow, *blue, magenta, cyan, and white. | |
| # http://xiaofan.at | |
| # 2 Jul 2015 - Xiaofan | |
| # Machine name. | |
| function box_name { |
This document is research for the selection of a communication platform for robot-net.
The purpose of this component is to enable rapid, reliable, and elegant communication between the various nodes of the network, including controllers, sensors, and actuators (robot drivers). It will act as the core of robot-net to create a standardized infrastructure for robot control.
Requirements:
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| upstream myapp { | |
| server 127.0.0.1:8081; | |
| } | |
| limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s; | |
| server { | |
| listen 443 ssl spdy; | |
| server_name _; | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/env python | |
| from Foundation import NSUserNotification | |
| from Foundation import NSUserNotificationCenter | |
| from Foundation import NSUserNotificationDefaultSoundName | |
| from optparse import OptionParser | |
| def main(): | |
| parser = OptionParser(usage='%prog -t TITLE -m MESSAGE') |