At the core of the problem sits NSA hoarding the zero-day vulnerability that made WannaCry possible in the first place

May 15, 2017 13:00 GMT  ·  By

Russian President Vladimir Putin believes the source of WannaCry is the US intelligence community. The WannaCry ransomware/worm that's been infecting device after device in more than 150 countries across the world has affected an extremely large number of Russian computers.

"The source of these threats is, in my opinion, the same as Microsoft said in its statement. They said that the primary source of blame for this virus is the intelligence services of the United States. Russia has absolutely nothing to do with it. Under these circumstances, it's strange to hear otherwise," Putin said, as quoted by Interfax.

Putin added that Russian institutions were not seriously affected by the global cyber attack. "For us, there was no significant damage to our institutions - neither for the banking, nor for the healthcare system, nor the others. On the hole, however, it is unsettling, there is nothing good here, and it causes concern," Putin said.

Multiple actors to blame

Putin uses Microsoft's statement made over the weekend to point the finger at the American intelligence agencies. While it's true that they carry part of the blame, at this point in time, the situation is far more complex.

Sure, the NSA was holding onto a zero-day vulnerability that it should have shared with Microsoft instead of keeping it under wraps. But then, hacker group Shadow Brokers stole the files and dumped them online without any thought to consequences. The hackers behind WannaCry, whatever their nationality, took advantage of the exposed information and built an extremely powerful ransomware.

Had all systems been updated as they should have been, since Microsoft has released a patch a while back, this global attack would have led to zero infections. That, of course, is not the case and it's obvious that the blame is shared between many actors. Admittedly, however, the NSA's unwillingness to share zero-day vulnerabilities, despite promise to do so, is at the base of it all.