International Cyberattack Cripples UK Hospitals

[Smellincoffee]

Has anyone been following or affected by the wave of ransomware infections in the UK? Microsoft is attempting to respond with patches for Win8 users who haven't been hit yet.

From the BBC:
A massive ransomware campaign appears to have attacked a number of organisations around the world, with reports of infections in more than 70 countries.
Telefonica, the Spanish telecoms company which owns mobile network O2, said it had detected a "cybersecurity incident" but that clients and services had not been affected.
Screenshots of a program that locks computers and demands a payment in Bitcoin have been shared online by those affected.
NHS Digital said the attack was believed to have been carried out by the malware variant Wanna Decryptor.

And The Guardian:

According to one junior doctor who works in a London hospital, the attack left hospitals struggling to care for people. “However much they pretend patient safety is unaffected, it’s not true. At my hospital we are literally unable to do any x-rays, which are an essential component of emergency medicine,” the doctor told the Guardian.

Last word is that the crisis is expected to last several days. Perhaps they can restore systems from backups? When my workplace was affected by an ransomware virus, fortunately the damage was limited to one computer, and I'm so virus-paranoid I had backups of most files in several places. What concerns me is that I know since ACA, healthcare providers in the US have been integrating their records. I wonder if this could spread.

 

[publiusr]

Going after hospitals? Not cool.

 

[DimesDan]

Last word is that the crisis is expected to last several days.

All but a handful of Trusts are back up and running after this, The HSE here in Ireland last night thwarted a similar attack with nearly 100 nations affected in one way or another and it was all down to some attack tools the NSA had cooked up and managed to mislay or something.

Here is a pretty good summation from the BBC on the whole thing.

 

[Smellincoffee]

All but a handful of Trusts are back up and running after this, The HSE here in Ireland last night thwarted a similar attack with nearly 100 nations affected in one way or another and it was all down to some attack tools the NSA had cooked up and managed to mislay or something.

Here is a pretty good summation from the BBC on the whole thing.

That's how 'Olympic Games' was exposed back during the Obama years--- some code they created to attack and undermine Iran's nuclear program somehow got loose. Only this time the loose cannon was captured by someone else and put to more mercenary uses.

Good to know they're starting to recover.

 

[Bagofmostlywatr]

Going after hospitals? Not cool.

I don't think they specifically targetted hospitals, it's just that they happened to be vunerable to what was, essentially, a worm. Does make you wonder why a hospitals systems need to be connected to the Internet rather than a closed network, particularly when you think about the sensitivity of the data held.

Apparently, there is no way to decrypt the affected data, which we can only hope is the case if another party now has access to it.

 

[Smellincoffee]

I don't think they specifically targetted hospitals, it's just that they happened to be vunerable to what was, essentially, a worm. Does make you wonder why a hospitals systems need to be connected to the Internet rather than a closed network, particularly when you think about the sensitivity of the data held.

Apparently, there is no way to decrypt the affected data, which we can only hope is the case if another party now has access to it.

What's absurd is that US power systems are on the public grid, too. Every book I've read on cyberwarfare (Cyberwar, Future Crimes, Glass Houses, Lights Out, etc) has commented on it.

 

[Santaman]

Its moronic how many systems YOU DO NOT want other people to even go near or have access to are hanging on the internet, even worse is if IT has been cut so they're understaffed underpaid and those left hanging around have the general brain capacity of a peanut so maintenance/patching etc is not gonna happen... happy hunting!

 

[publiusr]

Computers are fne for NASA and libraries.

As fr jobs--would it really kill folks to go back to pen and paper. Hack that. Hire more people.

 

[sojourner]

Computers are fne for NASA and libraries.

As fr jobs--would it really kill folks to go back to pen and paper. Hack that. Hire more people.

LOL. No.

 

[CorporalCaptain]

I don't think they specifically targetted hospitals, it's just that they happened to be vunerable to what was, essentially, a worm.

And yet those behind the worm were OK with trying to collect a ransom for the hospital data, so targeting hospitals was not something that the perpetrators considered out of bounds.

 

[DimesDan]

And yet those behind the worm were OK with trying to collect a ransom for the hospital data, so targeting hospitals was not something that the perpetrators considered out of bounds.

They were demanding a ransom on accessing the data (which is how a ransom ware attack works), they (the cyber-criminals) in the case of the NHS systems affected couldn't actually access the records themselves. And given the size of the incursion across multiple systems against over 100 nations, the cyber-criminals were just taking advantage of what turned out to be a very large and widespread vulnerability.

So it would seem, they didn't launch the incursion specifically at the NHS systems, due to the chronic underfunding of NHS systems, including the different trusts IT infrastructure, those systems were affected by the sheer size of the net used to launch the incursion.

 

[Robert Maxwell]

Computers are fne for NASA and libraries.

As fr jobs--would it really kill folks to go back to pen and paper.

Literally speaking, yes, it would kill people--timely acquisition and processing of health information can mean the difference between living and dying. Seconds matter.

Hack that. Hire more people.

To do what?

 

[137th Gebirg]

The hospital system was apparently especially susceptible due to the rampant use of older operating systems like Windows XP. All the older Windows OS's are particularly vulnerable to such attacks because MS has actively ceased to support them. In fact, this one was so bad, MS actually put out a patch for XP 3 years after officially dropping support for it, just to stop the flood. Windows 8 and 2003 was also included in the patch.

If people would just take a little bit of time to keep their systems up-to-date, these things would be more difficult to spread. I'm not blaming the victim, here, I'm blaming the IT people whose job it is to know better! If their old legacy apps won't initially run on newer OS's, there's always the compatibility settings to try first and, if that doesn't work, the source code should probably be pulled out of mothballs and recompiled for the new system. Either that or port to a thin-client web solution and never have to worry about it again. There are tons of solutions if the leadership of the organization in question is willing to address the situation and...oh, I dunno...LEAD! Otherwise, there's really no point in crying over spilled milk if some 11 year old manages to hack into a system older than they are, on a lark.

 

[CorporalCaptain]

They were demanding a ransom on accessing the data (which is how a ransom ware attack works), they (the cyber-criminals) in the case of the NHS systems affected couldn't actually access the records themselves. And given the size of the incursion across multiple systems against over 100 nations, the cyber-criminals were just taking advantage of what turned out to be a very large and widespread vulnerability.

So it would seem, they didn't launch the incursion specifically at the NHS systems, due to the chronic underfunding of NHS systems, including the different trusts IT infrastructure, those systems were affected by the sheer size of the net used to launch the incursion.

My point was that even if the hospitals were only "collateral damage," it doesn't get the attackers off the hook for having endangered people. It really makes no difference whether the hospitals were specifically targeted or not. People were endangered nonetheless.

 

[Bagofmostlywatr]

The hospital system was apparently especially susceptible due to the rampant use of older operating systems like Windows XP. All the older Windows OS's are particularly vulnerable to such attacks because MS has actively ceased to support them. In fact, this one was so bad, MS actually put out a patch for XP 3 years after officially dropping support for it, just to stop the flood. Windows 8 and 2003 was also included in the patch.

If people would just take a little bit of time to keep their systems up-to-date, these things would be more difficult to spread. I'm not blaming the victim, here, I'm blaming the IT people whose job it is to know better! If their old legacy apps won't initially run on newer OS's, there's always the compatibility settings to try first and, if that doesn't work, the source code should probably be pulled out of mothballs and recompiled for the new system. Either that or port to a thin-client web solution and never have to worry about it again. There are tons of solutions if the leadership of the organization in question is willing to address the situation and...oh, I dunno...LEAD! Otherwise, there's really no point in crying over spilled milk if some 11 year old manages to hack into a system older than they are, on a lark.

I'm assuming a fair few of the XP machines might have been driving equipment, rather than serving as a desk and chair PC, so it's quite possible there is no option to upgrade past XP and still have the hardware support.

 

[137th Gebirg]

^^^ Yes that is a likely culprit. I'm sure there will be lawsuits over this, which may force some of these medical hardware vendors to be a little more proactive when it comes to keeping their software releases up-to-date, including the licensing of newer MS OS's.