Ransomware, Data Breaches at Hospitals Tied to Uptick in Fatal Heart Attacks

https://krebsonsecurity.com/2019/11/study-ransomware-data-breaches-at-hospitals-tied-to-uptick-in-fatal-heart-attacks/

by sandwall • 7 years ago

109 47 7 years ago

krebsonsecurity.com

arcticbull7• 7 years ago

Another win for cryptocurrency! Truly, it has changed the world. We couldn't have this kind of progress without it.

an_ko• 7 years ago

Why do you think this is the fault of cryptocurrency?

arcticbull7• 7 years ago

Ransomware doesn't really work without it. In fact, they specifically call out WannaCry which demands ransom in BTC.

ceejayoz• 7 years ago

Ransomware relies on there being safe ways to collect the ransom.

There were a few predecessors (https://en.wikipedia.org/wiki/PGPCoder) using stuff like Liberty Reserve (long since shut down by the Feds), but Bitcoin made it pretty easy.

One tried "mail money to a PO box" back in the 80s. https://en.wikipedia.org/wiki/AIDS_(Trojan_horse) The downsides of that approach for a criminal should be fairly obvious.

cartoonworld• 7 years ago

One of the useful features of cryptocurrency is regulatory arbitrage. Without this ability, ransom payments in cash, or electronic bank transfers would drastically reduce the feasibility of receiving the ransom payment without also revealing the identity of the payee.

A side effect of the anonymity is that crypto provides the opsec cover for these undesirable operations.

bequanna• 7 years ago

I reluctantly agree with you.

The main use case right now (and in the foreseeable future) for crypto is difficult-to-trace payments for illegal activities.

magashna2• 7 years ago

Yes, it's pushed companies to have real backups and security. Great! Before, data would just be covertly stolen and sold.

arcticbull7• 7 years ago

This, along with its absurd energy consumption "pushing people into renewable energy" is fascinating. Why don't we set fire to buildings downtown to motivate investment in fire departments? Why don't we steal things and smash things to motivate investment in police departments? How about dumping toxic chemicals into lakes to invest in the EPA and bolster environmentalism?

Why don't we in general actively engage in the behavior we want to stop in an attempt to motivate different people to stop us?

I think this is the main idea behind "The Purge," and if "The Purge: Survival" is any indication, it's unlikely to work ;)

Acrobatic_Road3• 7 years ago

You clearly don't remember when they used to ask for moneypack transfers.

vkou3• 7 years ago

It's easier to tie them to the real-world identity of the criminal distributing the ransomware.

It's not impossible to do it with BTC, but at the moment, law enforcement isn't doing much about BTC, unless it involves drugs or CP.

pjc50• 7 years ago

On the other hand, it's a world-readable leger. It would be easy enough for the government to permanently blacklist any downstream transactions from such coins as "proceeds of terrorism", and impose strict liability prison sentences on any regulated person (or exchange) found in posession of them...

chelmzy• 7 years ago

The FBI and private companies have tools to track Bitcoin transactions. The FBI brags about the capability often. I'm sure that in most cases it is hard to follow up on because the malicious actors are in other countries.

https://www.chainalysis.com/ https://www.elliptic.co/

blotter_paper• 7 years ago

They can certainly legislate about that, and I suspect they will, but there are issues. The ledger doesn't have a concept of a specific unit of currency that changes hands. It has transactions, which have one or more inputs and outputs. Lets say Alice has 3 blacklisted bitcoins and Bob has 2 whitelisted coins. They both sign a transaction which takes all 5 of their coins as inputs, and gives 2 coins as an output to Carol and 2 coins as an output to Dan. The remaining coin is left as an implicit miner's fee. Who got Alice's 3 blacklisted coins? You can make up an arbitrary rule dictating who got which coin in a legal sense (based on order of inputs and outputs or something meaningless like that), or say that any coins output from a transaction with any blacklisted coins are themselves blacklisted, but you can't actually track individual coins. Applying such rules to Monero would make even less sense, as the coins essentially go through a mixer during each transaction. Back to Bitcoin, it's also not clear what it means to possess a coin. We can make fairly arbitrary (though Turing incomplete) scripts for the validation of ownership, a signature is just the most common. Next-most common is probably the m-of-n signature; if I possess 1 of 2 signatures that can spend a coins from an output, do I own those coins? What if I have 1 of 3 signatures, and at least 2 are needed to spend the coins? What if the coin is only spendable by solving a non-cryptographic math problem? If I know the answer to the math problem, do I own the coin? If I make a transaction with blacklisted funds that has outputs spendable by anybody who solves the script by putting in the answer to the problem 2+2, does everybody aware of that transaction now jointly own the coin? I'm not saying you can't legislate about this, I'm just saying it gets silly. Also, I doubt there is a single legislator in your entire government who understands the properties of a Bitcoin transaction that I just described. I bet that their first attempt at regulation will be totally ignorant of what it is that they're actually regulating, and it will be hilarious.

kempbellt• 7 years ago

Cryptocurrency isn't going anywhere. It exists now, people value it. It will remain so.

We need to focus on building systems that mitigate this as a potential attack vector

arcticbull7• 7 years ago

It’s a core feature.

ganzuul• 7 years ago

Interesting. So you can 'invest' in cryptocurrency and then release ransomware for your chosen scrip to boost your share. Wonder what sort of pen-and-paper white collar crime this would correspond to.

arcticbull7• 7 years ago

Securities fraud and something under the Computer Fraud and Abuse Act I'm sure ^_^ fun thought exercise.

chapium3• 7 years ago

Cryptocurrency is a tool used by bad actors long after they have compromised the system.

dang• 7 years ago

Would you please not post flamebait to HN? That's against the site guidelines:

https://news.ycombinator.com/newsguidelines.html

Long flamewars or long tit-for-tat arguments about a generic thing like cryptocurrency, which you unfortunately did a couple times in the last few days, are also against the site guidelines (see "generic tangents").

Forge36• 7 years ago

Without any arguments it's just data. Is a lack of spending on key infrastructure, tied to poorer outcomes something we can discuss? I'm not sure this is the best article to discuss the causes/mitigations.

There was one interesting data point, but no source of cause listed. >for care centers that experienced a breach, it took an additional 2.7 minutes for suspected heart attack patients to receive an electrocardiogram.

Is this while they were prevented from performing care? Thankfully PBS's article goes into more details

https://www.pbs.org/newshour/science/ransomware-and-other-da...

hospitals that experienced a data breach, the death rate among heart attack patients increased in the months and years afterward. This increased mortality doesn’t appear to be due to the perpetrators themselves — the hackers are not controlling the allocation of medications or doctors. Rather the issue may lie with how health care systems adjust their cybersecurity after an attack

Which makes a much different argument: the hospital response to a Cybersecurity incident increases mortality (thus: can we expect a similar uptick in negative outcomes amongst healthcare organizations who implement similar security polices?)

Research paper: https://onlinelibrary.wiley.com/doi/full/10.1111/1475-6773.1...

The PBS article points out that security practices applied to clinicians led to this problem.

Do we have evidence that the hacking took advantage of the EMR's security issues?

Time from door to ECG significantly increased after a breach and the elevated time to ECG persisted at 4 years after the breach. Security typically adds inconvenience by design—making it more inconvenient for the adversary. For example, stricter authentication methods, such as passwords with two‐factor authentication, are additional steps that slow down workflow in exchange for added security. Lost passwords and account lockouts are nuisances that may disrupt workflow. The persistence in the longer time to ECG suggests a permanent increase in time requirement due to stronger security measures.

So what compromise is possible to ensure fast login? Can two factor login be limited to new login devices? (Thus limiting impact to those working in new locations?)

Should EMR login be separated from local PC login within a hospital/emergency department? (Cold booting a PC and logging into windows would be the slowest response time).

Can we tie logins to employee badges to skip all password entry? (Lost badges would thus warrant reporting loss.)

mjcl• 7 years ago

Can we tie logins to employee badges to skip all password entry? (Lost badges would thus warrant reporting loss.)

You can, but typically you'd use a badge with a PIN. If you use something like this[1] with virtual desktops (VDI) that don't terminate your session when you disconnect, you can get the "time to login" down to a few seconds, since it's the same RDP session following the user around.

[1] https://www.identityautomation.com/iam-platform/healthcare-c...

sandwall• 7 years ago

Most hospital PC's allow this as an alternative, also thumbprints.

We use: https://www.imprivata.com/

JshWright• 7 years ago

I'm not sure I buy the causal link between a small increase in door to ECG time and an increase in 30 day mortality (AFAIK, there's no other research explicitly linking those two stats). Door to reperfusion (or "door to balloon") time matters a lot, but the article doesn't mention those stats.

Scoundreller3• 7 years ago

Possibly to get more data. Not everyone is coming in with a STEMI.

chapium3• 7 years ago

The solutions you propose are pretty much the norm already. PC logins are typically LDAP or AD however. ymmv whether your eme login is on the same domain as your pc login. For example, on Cerner emr they are typically separate but this has more to do with the hosting infra more than anything else.

All the emr security in the world wont help you if a random piece of critical equipment that is compromised locks you out.

Scoundreller3• 7 years ago

This study may be biased toward smaller/rural/poorer locales.

In big-city Canada, patients with heart attack symptoms will usually have an ECG done by paramedics before arriving.

In the US, this has quite survival advantage.

https://heart.bmj.com/content/100/12/944

I don’t know if it’s standard practice to do another upon arrival, but it is redundant and should probably take a back seat to activating other processes that need to happen.

It also helps send them to the most appropriate facility.

analog31• 7 years ago

So, don't ask me how I know this...

If you are having chest pain, call 911. If you mention "chest pain" to them, you hear a beep in the background, and everything else is a machine.

In my locale, the paramedics carry a portable EKG. If they decide to take you for a ride, they have an EKG machine in the ambulance that's networked to the hospital, and a cardiologist is now on your team. When you arrive, you get wheeled into a special room where an entire heart attack team is standing there, waiting for you.

At that point they do another EKG, and as I understand it, their machine has a larger number of electrodes, so they can get more detailed information from it. The patient is never off an EKG at this point, and it's not a discrete step, but is a continuous monitor.

A blood test will confirm the presence of an enzyme that's produced if the heart muscle is stressed. This is a rapid test, the lab is ready and waiting for the sample.

So, the second EKG isn't really consuming time, since other stuff is happening concurrently, and they need the EKG running continuously to make minute by minute decisions. Regardless of what happens, you're on the EKG until you go home.

I don't know if rural or poorer locations have less sophisticated processes.

If you are having chest pain, call 911.

netfl0• 7 years ago

Wow I had no idea they were linked in remotely. Thanks for sharing.

ghostpepper• 7 years ago

Is it possible that increased security after breaches is actually what's slowing down medical staff?

chapium3• 7 years ago

I doubt it. Desktop pc's in hospitals are usually just thin clients. Ransomware targets the client pc and implementing security at this level is not cumbersome.

itronitron• 7 years ago

from the article...

“Breach remediation efforts were associated with deterioration in timeliness of care and patient outcomes,” the authors found. “Remediation activity may introduce changes that delay, complicate or disrupt health IT and patient care processes.”

Ransomware, Data Breaches at Hospitals Tied to Uptick in Fatal Heart Attacks

Related Stories