So this past weekend I did something I'd been putting off for probably three years: I drove over to my parents' place and finally dealt with the ancient Windows XP box that's been sitting in their den since roughly the Bush administration. The reason, obviously, is the WannaCry mess. If you somehow missed it, a ransomware worm tore through a pile of organizations starting Friday the 12th: Britain's NHS got hit hard enough that some hospitals had to turn away non-emergency patients, Telefónica in Spain, FedEx here in the US, even the German rail system had ticket machines showing ransom screens instead of departure times. It spread using an exploit called EternalBlue, which leaked out of an NSA toolkit back in April, and which targets a hole in the old SMBv1 file-sharing protocol that Microsoft had actually already patched back in March, if you'd installed that patch.
Which is the whole problem, isn't it. A ton of the machines that got hit hadn't installed updates, sometimes because IT departments move slow and cautious (understandable, occasionally patches break stuff), and sometimes because the machine in question is running an operating system Microsoft stopped supporting three years ago and just never gets updates at all. XP falls into that second bucket. Microsoft did something I can't remember them doing before, actually: they pushed out an emergency patch for XP anyway, plus Windows 8 and Server 2003, all officially dead operating systems, on Saturday the 13th. That's not normal. That's "we are mildly panicking" behavior from a company that spent years actively trying to get people off XP.
Anyway. My dad's machine. It's not connected to anything critical, he mostly uses it to look at a spreadsheet of his fantasy baseball league and print coupons, but it is on the same home network as everything else in that house, and it had been sitting there unpatched since I have no idea when. So Saturday afternoon I went over with a USB stick and did the boring, unglamorous work of actually fixing this properly instead of just crossing my fingers.
What I actually did, if you've got a similar zombie machine somewhere
First thing: don't just run Windows Update and call it done, because on an XP box that's been offline from updates this long, Windows Update itself is often broken or absurdly slow. I downloaded the specific patch from Microsoft's advisory page directly (it's listed under MS17-010, they put up a standalone download for exactly this reason) and installed that by hand.
Second, and this is the part people skip: disable SMBv1 entirely if you don't need it, which you almost certainly don't. On XP that means digging into the network adapter properties and unbinding the client/server for Microsoft Networks piece, which is clunky and not obvious, and honestly took me longer to find than the actual patch install did. On any Windows 7 or 10 machine it's a lot easier — Control Panel, Programs, Turn Windows features on or off, uncheck SMB 1.0/CIFS File Sharing Support, restart.
Third, I backed the whole thing up to an external drive before I touched anything, because that's the actual lesson of WannaCry that nobody's headline captured: the ransom was only $300 in Bitcoin at first (rising to $600 after a few days, with a threat to delete everything after a week), and that's cheap specifically because backups are the real defense here, not the ransom math. If your files are backed up somewhere the malware can't reach, the whole extortion premise falls apart. I use a rotating pair of external drives for my own stuff, unplugged when not actively backing up, which is low-tech but it means nothing on my network can encrypt a drive that's sitting in a drawer.
Fourth, I finally just told my dad the XP box needs to get replaced this year, not "eventually." He agreed faster than I expected, which either means he's mellowing with age or he read one too many WannaCry headlines himself. Either way, small win.
One more thing worth mentioning: the whole attack got slowed down almost by accident when a security researcher going by MalwareTech noticed the malware was checking in with a specific gibberish domain before it did its damage, and registered that domain out of curiosity more than anything, which accidentally tripped a kill switch buried in the code. That's a wild way for a global incident to get throttled — not a coordinated government response, just one person's ten-dollar domain registration. I don't fully trust that kind of luck to save us next time, and neither should you.