What version of SMB did the WannaCry ransomware attack?

The WannaCry ransomware attack, which spread globally in May 2017, specifically targeted vulnerabilities in Microsoft's implementation of the Server Message Block version 1 (SMBv1) network protocol. The ransomware utilized the EternalBlue exploit (developed by the NSA and leaked by the Shadow Brokers group), which leveraged a critical remote code execution vulnerability (tracked as CVE-2017-0144 and patched in Microsoft Bulletin MS17-010). EternalBlue allowed attacker-controlled packets sent to an open SMBv1 port (TCP 445) to execute arbitrary code with elevated system privileges. Because SMBv1 lacked modern security protections present in newer versions, WannaCry rapidly self-propagated across unpatched enterprise and industrial control network environments.

Option A: WannaCry specifically targeted SMBv1 protocol flaws to self-propagate; it did not exploit all versions of the Server Message Block protocol.
Option B: SMB version 2 includes enhanced security features and was not the protocol version containing the specific buffer overflow vulnerability exploited by EternalBlue.
Option D: SMB version 3 was introduced in Windows 8/Server 2012 with advanced encryption and integrity controls, and was unaffected by the MS17-010 vulnerability.

CISA Alert (TA17-132A), WannaCry Ransomware, Cybersecurity and Infrastructure Security Agency, US-CERT.

Microsoft Security Bulletin MS17-010, Security Update for Microsoft Windows SMB Server (4013389), March 2017.

IEEE Access Publication: "Analysis of the WannaCry Ransomware Attack", DOI: https://doi.org/10.1109/ACCESS.2018.2878235