WannaCry勒索病毒事件分析與應對措施－以核能研究所為例

黃亮勳 ； 王培智 ； 賴昱達

《TANET2017 臺灣網際網路研討會》 2017年 (2017/10) Pp. 1254-1259

https://doi.org/10.6728/TANET.201710.0218

摘要

WannaCry是勒索病毒史上最經典的代表，有別於以往勒索病毒透過社交工程方式進行擴散，這次勒索病毒則是透過微軟作業系統上的漏洞進行擴散，導致全球電腦在短時間內大規模淪陷，台灣爲本次嚴重的受災區之一。本文分析WannaCry病毒及攻擊手法，並例舉核能研究所之防禦作爲，並提出大型組織針對勒索病毒的防禦對策。

關鍵字

WannaCry ； 勒索病毒 ； 永恆之藍 ； 影子掮客 ； 美國國家安全局 ； 伺服器訊息區塊

並列摘要

WannaCry, which has become the celebrated ransomware ever, infected worldwide computers in May, 2017. Many victims claimed that they knew nothing about what happened, but were encrypted by ransomware. WannaCry is differ from the past ransomware, which patches with exploits leaked by the Shadow Brokers, spreading through the Server Message Block protocol version 1. Taiwan has suffered from WannaCry, and caused the damage. Although Taiwan occupies an important role in IT industry, organizations and client users still lack of acknowledge dealing with ransomware. In this article, we will explain the background of the WannaCry, and how it spreads worldwide. We will give an example of Institute of Nuclear Energy Research how defensing WannaCry. At last, we will give some suggestions of how defensing ransomware for organizations.

並列關鍵字

WannaCry ； Ransomeware ； EternalBlue ； the Shadow Broker ； National Security Agency ； Server Message Block