WannaCry — The Patch Existed for Two Months. Why Wasn't It Installed?

As we write this, a ransomware worm called WannaCry is four days into its rampage. Since Friday afternoon it has hit hundreds of thousands of machines by some estimates, across more than a hundred countries — encrypting files, demanding around $300 in bitcoin, and spreading to the next machine without anyone clicking anything. In the UK, NHS hospitals canceled appointments and diverted ambulances. Factories paused production lines. New variants are reportedly already circulating.

And here is the fact that should outlast every headline: the vulnerability WannaCry exploits was patched by Microsoft in March — two months before the outbreak. Every encrypted machine was one Windows Update cycle away from immunity. This isn't a story about a superweapon; it's a story about maintenance.

How the worm spreads

WannaCry is a worm in the classic sense — it doesn't need phishing emails or user mistakes to move. It scans for machines exposing SMBv1 (Windows file sharing, port 445) and exploits a flaw using EternalBlue, an exploit from the trove of purported NSA tools published by the Shadow Brokers group in April. Once inside a machine, it encrypts files, posts its ransom note, and immediately starts scanning for new victims — both across the local network and out on the public internet.

That combination is what makes it historic. Ransomware usually spreads at the speed of human gullibility; WannaCry spreads at the speed of a network scan. One exposed, unpatched machine on a flat network can translate into an entire organization encrypted before lunch.

The kill switch that bought us time

Friday's outbreak slowed for a strange reason: a security researcher noticed the malware queried a long, gibberish domain name before doing its work — and the domain was unregistered. He registered it for a few dollars, and it turned out to function as a kill switch: when the domain resolves, the malware halts. That single registration is credited with blunting the initial wave.

Enjoy the anecdote, but don't draw comfort from it. Variants without the kill switch are already being reported, and the underlying exploit works exactly as well today as it did Friday. The kill switch bought time to patch — it is not the patch.

The patch shipped in March

Microsoft fixed the SMBv1 flaw on March 14th, in security bulletin MS17-010, rated critical. Over the weekend they went further and took the genuinely unusual step of publishing emergency patches for Windows XP and Server 2003 — operating systems that officially stopped receiving security updates years ago. When a vendor patches the unsupported, it's telling you how bad things are.

So the interesting question isn't "how did the attackers do it" — it's "why were so many machines still vulnerable two months after the fix shipped?" The answers are boringly familiar: patching is disruptive, reboots need scheduling, some machine runs software that "can't" be touched, nobody owns the process, and there's always a more urgent ticket. Which points at the real lessons.

The lessons — all of them about process

• Patch cadence is a process, not an event. "We patched after WannaCry" means the process is headlines. A working process looks like: a fixed monthly cycle for routine updates; a defined fast lane — days, not weeks — for critical, actively-exploited vulnerabilities; a test group that gets patches first; and a named human who owns the schedule. MS17-010 was rated critical and the exploit was public by mid-April. Both signals fired well before Friday; a process would have caught them.

• End-of-life systems don't get a pass — they get a plan. Every network has them: the XP box that drives a lab instrument, the ticket kiosk, the machine running the one unported application. "We can't upgrade it" may be true; "so we'll do nothing" doesn't follow. Isolate them on segmented networks, block SMB at their boundary, take them off the internet entirely, and write down where they all are. Unsupported and unknown is the combination that fills hospital hallways.

• Backups you've actually restored. Ransomware's only real antidote is a backup the ransomware can't reach — which means offline or otherwise disconnected copies, not just a synced folder (sync faithfully replicates your encrypted files over the good ones). And an untested backup is a hypothesis: schedule real restore drills, verify the restored data, and time them. During an incident, "our restore takes six hours" is information; discovering it takes six days is a catastrophe.

• Know your exposure before someone else maps it for you. WannaCry found its victims by scanning. You can run the same scan first, on networks you're authorized to test:

# Which of our machines answer SMB? (your own ranges only)
nmap -p 445 --open 203.0.113.0/24

Anything answering on 445 to the public internet needs an immediate conversation. While you're at it, disable SMBv1 outright — it's a protocol from another era, and this week is the argument.

Maintenance is the security program

The uncomfortable truth of this week: no zero-day was involved, no defense had to be invented, and nothing WannaCry did was unpreventable with tools everyone already had. The organizations in the headlines aren't there because attackers were brilliant — they're there because patching, inventory and backups are unglamorous, and unglamorous work loses scheduling battles until the Friday it doesn't.

The same discipline of knowing your systems' state before events force the issue is what CompleteStatus is built around — continuous external checks on your sites, endpoints and SSL certificates, with alerts the moment something changes, so surprises reach you first and small problems stay small. See everything that's included on our features page, then create a free account. And tonight, before anything else: check that MS17-010 is actually installed everywhere you think it is.