FBI, DHS, HHS Warn of Imminent Ransomware Threat Against U.S. Hospitals

https://krebsonsecurity.com/2020/10/fbi-dhs-hhs-warn-of-imminent-credible-ransomware-threat-against-u-s-hospitals/

by picture • 6 years ago

475 292 6 years ago

krebsonsecurity.com

shostack• 6 years ago

How similar does this sound to the NotPetya "digital nuke" Russia unleashed on Ukraine?

https://www.wired.com/story/notpetya-cyberattack-ukraine-rus...

throw_m2393392• 6 years ago

I guess it will be another "for decades we didn't care about security because no obvious short term profits, now we will have to pay a great price" moments.

The article you linked is absolutely fascinating. Because network security improvements didn't grant higher ups "bonuses" they didn't make the slightest effort to do what engineered desperately asked.

The security revamp was green-lit and budgeted. But its success was never made a so-called key performance indicator for Maersk’s most senior IT overseers, so implementing it wouldn’t contribute to their bonuses. They never carried the security makeover forward.

10 billions of damages later...

sacks2k• 6 years ago

All you need is a Russian IP address and you too can be Russian.

vmception8• 6 years ago

You get paid the ransom

The Russian that owns the computer never gets framed because the subpoena fails

and the public doesn't look for you and just maintains their antiquated Red Scare™

All because of ignorance and pride on our leaders to not admit they don't have a handle on this

lame-robot-hoax• 6 years ago

Ah yes, I’m sure that’s all the evidence they have that points towards Russia/Eastern Europe.

haswell• 6 years ago

This is not what we need in these final chapters of 2020 with COVID cases spiking.

Charles Carmakal, senior vice president for Mandiant, told Reuters that UNC1878 is one of most brazen, heartless, and disruptive threat actors he’s observed over the course of his career.

This is what terrorism looks like in 2020. Horrifying, terrifying, disgusting.

Larrikin• 6 years ago

Why the assumption that its terrorist and not a state sanctioned attack?

sudosysgen• 6 years ago

If we're honest, it's neither. It's 1000% profit-orientated.

SimbaOnSteroids• 6 years ago

These are not mutually exclusive.

kylebenzle• 6 years ago

Does anyone else feel that any organization that isn't doing regular secure backups with a way to restore that data deserves for this to happen? It like an airplane running out of gas because the pilot forgot to fill up the tank. Its kind of step one of working with computers.

shajznnckfke• 6 years ago

“Deserve” doesn’t do anything for the people hurt by this, and it doesn’t justify the behavior of the hackers.

sellyme• 6 years ago

I'm not sure that's of much comfort to the passengers on the plane.

agar• 6 years ago

You certainly express an unpopular opinion, and at first glance you are right: secure backups should be a priority for any IT organization.

However, not all backups are continuous and pervasive. There are often backup windows, gaps, and processes that halt with no one noticing. Ryuk also actively disables and deletes backups to maximize impact, while also seeking out mount points that might be backup targets - and encrypts those as well.

Of course, we're also talking about hospitals here. Even a well-managed system with hourly differential backups leaves plenty of time for radiology data to be lost in the critical hour before life saving surgery.

More realistically though, how long would it take you to discover and remove a sophisticated penetration, then restore every device, ensure none of the restores are also infected by the malware that had probably been there for a while, and bring a hospital system with thousands of impacted systems back online? 72 hours? A week? A month?

What happens to the patients? Admissions to the emergency room? What if adjacent hospitals are also hit, or are already impacted by the COVID spike and have no open beds?

People literally die due to hospital ransomware attacks. No one deserves that.

Ransomware is akin to kidnapping, it's just the data and customers that are held hostage, not kids or loved ones. Always blame the criminal, never the victim.

Polylactic_acid2• 6 years ago

Yes there probably is some blame on the hospitals for not securing things well, but there is a huge difference between preventing something from failing, and preventing something from being actively sabotaged.

If a hospital had random power cables everywhere and someone tripped over one and unplugged an important device, that would be far far more on the side of the hospitals fault than an attack on the computer systems.

toomanybeersies3• 6 years ago

It like an airplane running out of gas because the pilot forgot to fill up the tank

That has happened in the past: https://en.wikipedia.org/wiki/Gimli_Glider

It's easy to say "well they should've filled the tank" when you're comfortably sitting on the ground, but it's little consolation for the people 30,000 feet in the air, or for the patients in hospital waiting for time critical, life saving treatment.

PeterisP2• 6 years ago

Most of current best practices for backups, redundancy and business continuity are intended for the risks of random disasters. Malicious attacks are substantially different.

There are many organizations which are doing regular secure backups, but are doing so in a way that can be sabotaged once a skilled attacker gains domain admin privileges, and sabotaging backups is one of key things that the attackers are doing after they are in the network and before triggering the ransom encryption. We're not talking about a virus randomly spreading, in such high-ransom targeted attacks the preparation before triggering a ransom is done manually by skilled teams going on from one target to another.

moksly• 6 years ago

There are a lot of systems in a hospital. Maybe 3000 different systems, made by different suppliers, some long gone.

In good countries, we maintain important records and have roll back capabilities on most of the things we control ourselves. But that doesn’t necessarily include the MRI machines windows XP that is maintained by some third party supplier that operates through another 3rd party seller, and that’s just one of the 3000 things that can go wrong.

Then there is the parts where attacks will affect you, even if they don’t do any damage that can’t be reversed. Typically global internet access gets shut down during an attack, but that makes transfers harder. It also makes acute arrivals harder, because the ambulance helicopter might not be in range of your “internal internet” and thus may not be capable of feeding you important live data.

Some attacks target the network itself, and while you’ll generally have a good set of people running that, they aren’t always a match for nation state backed hacking tools.

So there is just a billion things that can go wrong, even if you have the best of the best working on it, and in many countries, there is a good chance that’s not even the case. I can count myself lucky to work in a country where we take digitisation very serious in the public sector, and I can easily see why things could go wrong.

dzhiurgis2• 6 years ago

I sometimes wonder how much of Covid could've been spread by on purpose (asides from freedom fighters refusing common sense).

Thorrez7• 6 years ago

terrorism

Isn't ransomware profit-motivated? I thought with terrorism the goal was fear rather than profit.

Polylactic_acid2• 6 years ago

Terrorism is a buzzword that means "Person I don't like" now.

mwill2• 6 years ago

There have been ransomware attacks that are covers for outright attacks, iirc some where the payment and decryption mechanism didn't even function.

On a more theoretical level, it's certainly possible to do both at the same time, two birds with one stone. But it seems a lot of the big gangs are suspected state-sponsored, which is less terrorism and more cyber warfare

jazzyjackson• 6 years ago

Terrorists need revenue

ebg13• 6 years ago

We can easily reconcile the two by recognizing that profit doesn't have to be money and that terrorists definitely profit from fear (otherwise they wouldn't do it). Everything we do is for profit, even if that profit isn't measured exclusively in dollars.

We can further reconcile them by saying that the entire mechanism for extracting money from the ransom victim is by making them afraid. In this case, afraid of losing their computer systems.

bawolff• 6 years ago

Usually the goal is political change through fear. Fear doesn't really make sense as an end in and of itself

kleiba• 6 years ago

The original meaning of the word "terrorism" has long lost its course since the early 2000s.

maaaaattttt• 6 years ago

The fear of losing money is a real one.

On the other hand, I believe that the word terrorism and the characterization of acts as terrorists should not be taken too lightly as it can lead to misuse of power rather quickly.

clusterfish• 6 years ago

Sigh, I feel like we need new words for all the modern horrors.

Siira• 6 years ago

It can be a source of revenue for terrorists though.

wongarsu• 6 years ago

The goal of terrorism is always political. Fear is the tool used by terrorism to reach the goal. Fear is a defining feature, but just means to an end.

As others have noted: while this instance is unlikely to be terrorism, this is a tool that is useful in terrorism and has been used as such in the past.

FireBeyond2• 6 years ago

Wasn't there a ransomware case in Germany recently where when they advised the hackers that they'd hit a hospital, the hackers immediately turned over the unlock keys, without a ransom?

Not that that is any way a defense, and I'm sure there was as much a self-interested motivation of "We are going to be hit hard if we ransom a hospital _now_" as much as "doing the right thing"...

newsclues• 6 years ago

At a certain point a “hack” becomes an “attack” and the response moves from “police action” to “military response” and I’m guessing that only state actor or sponsored groups are willing to cross that line.

mschuster91• 6 years ago

Not that that is any way a defense, and I'm sure there was as much a self-interested motivation of "We are going to be hit hard if we ransom a hospital _now_" as much as "doing the right thing"...

You're correct. Said ransomware case is now under the investigation of involuntary manslaughter, as a woman died during transfer to another hospital: https://www.dw.com/de/haben-russische-hacker-den-tod-einer-p...

Cthulhu_4• 6 years ago

Self-interest; a financial crime is nowhere as high on the priority list as one causing injury and death. It crosses the line from fairly petty crime to getting an international warrant on your ass.

JohnCClarke2• 6 years ago

The attackers got cold feet after they were told that they had killed a patient. It is the first documented case of ransomware causing a fatality.

dfsegoat• 6 years ago

I wonder at what threshold asymmetric responses get put into play, with these actors clearly focused on basic terrorism. At what point is a ‘kinetic response’ to a cyberattack warranted ?

Edit: got to point

mcintyre19942• 6 years ago

https://www.nytimes.com/2018/01/16/us/politics/pentagon-nucl...

The Pentagon have at least suggested that there’s a potential for a nuclear response to a significant enough cyber attack.

onetimemanytime• 6 years ago

>This is not what we need in these final chapters of 2020 with COVID cases spiking.

That's a play "why do you rob the banks". Some choice those hospitals have

wrkronmiller2• 6 years ago

This is what terrorism looks like in 2020.

Given the (extra-)legal powers that are activated by that word, I'd be circumspect in using it.

Many crimes are "horrifying, terrifying, [and] disgusting" without rising to the level of terrorism.

titzer2• 6 years ago

Attacking a hospital is a war crime, so how is it not terrorism?

uhs-employee• 6 years ago

The hospital chain I work for was hit with ransomware last month. Door locks, time clocks, and photocopy machines still worked, but all computers were down. We use paper records, but it was frustrating and inconvenient. We're not allowed to pay due to laws. Corporate started slowly building us a brand new, but terrible, network 5 weeks after the old one went down. Definitely caused a little staff burnout, but not more than corporate's relentless attempts to extract additional profit from us at the expense of our patients and our wellbeing.

Medicalidiot• 6 years ago

We had our computers go down for ~12 hours one day. Paper charts came out, which was a massive undertaking. I could not imagine my system being down for 5 weeks.

TheBobinator2• 6 years ago

If they treat you like an ATM machine, you treat them as such. 40 hr weeks, go home, and DGAF.

Patients dieing because people don't work 80hr weeks? Why are you working for such a shit management team? That's management's problem. Don't like it? Quit. Really don't like it? Name and shame.

It's unfortunate we live in a day and age that kind of thinking is necissary but it is. Burnout in the middle of a pandemic can get you killed.

jariel• 6 years ago

Terrorism is almost, but probably not exactly the right word, but it's 'of that level of concern'.

If Hospitals nation-wide are under attack, it's a massive national security issue.

We need to figure out some kind of new way to secure general purpose devices - and also - there needs to be much more investment in thwarting and retaliating against these people.

If some random hackers and do this - imagine how badly and quickly a foreign state actor with deep pockets could shut things down.

vmception8• 6 years ago

That's messed up if true, but why would a ransomware operator target them? I mean like, they don't really target, they just wait for people to install something right?

dmix• 6 years ago

Probably for initial infection it’s random but the negotiation for keys happens between real people.

Thieves must be heartless to go after such desperate targets. But criminals always have ways of justifying things.

closeparen5• 6 years ago

but the negotiation for keys happens between real people

I would be surprised if no one has written a smart contract for this yet - release the keys when X BTC are deposited to address Y.

throw_m2393392• 6 years ago

Thieves must be heartless to go after such desperate targets.

I mean it's the mafia, same people that traffic women and children, drugs,... profit is the motive, they don't care how. Just because they are now sitting behind a computer doesn't change their nature.

I've been in a hospital recently and they were still running windows XP, my doctor using IE8 (cause activeX on the intranet) and Excel... But hey, they run anti-viruses!... Public institutions absolutely need to get rid of all that ASAP.

__s• 6 years ago

Hospitals may be coming up as a target with highest ROI. Automation is often less than you expect

_jal• 6 years ago

Ransomware shops don't sit passively by, waiting for someone to install a trojan. Some of them are actually outsourcing the actual penetration, according to Krebs:

https://krebsonsecurity.com/2020/10/amid-an-embarrassment-of...

And once you're doing that, you're going to minimax for hi-value, low-risk targets.

backtoyoujim• 6 years ago

Or the leaders of these "shops" have a variety of national politicians as clients.

throwawaypolicy3• 6 years ago

Why hospitals? They have lots of money (same as any big organization) and a very good reason to pay up. It would be far from the first time a hospital was attacked. It wouldn't even by the first time it directly resulted in a death [0]. Unfortunately ransomware operators aren't very ethical.

Considering the timing it could also be geopolitical unfortunately, people dying from a ransomware attack could substantially raise the general tension level in the US.

Lots of high value malware is actually targeted. Things like running phishing campaigns to try and steal credentials from someone inside the institution.

It's substantially less likely, especially if you don't buy the geopolitics angle, but potentially these criminals even have some unpatched vulnerability in a common deployed piece of software, which would allow them to skip the phishing part entirely.

[0] https://www.zdnet.com/article/first-death-reported-following...

Disclaimer: The company I work for is involved in detecting ransomware as a side business.

vmception8• 6 years ago

I'm not experiencing any surprise that the hospitals are attacked, I know that happens, I am experiencing surprise at three government agencies hanging out in a chatroom where hackers are credibly discussing attacking a bunch of hospitals with ransomware.

My understanding is that the ransomware operators just take a look at computers that are infected, and then negotiate based on who they appear to be.

anthony_romeo• 6 years ago

It would be far from the first time a hospital was attacked. It wouldn't even by the first time it directly resulted in a death [0]

Just pointing out that this is a little misleading. The link you're referencing refers to the first ever reported hospital death related to a hospital's ransomware attack, and this article was from just a month ago (I remember, I read it on Hacker News too). But the juxtaposition of these sentences might suggest that death-by-ransomware-in-hospitals has been a common occurrence for quite some time.

PeterisP2• 6 years ago

While the initial infection of a single workstation is often done by pray-and-spray phishing attacks, the common practice for modern ransomware attacks is that this is followed by a manually controlled attack by skilled teams, spreading throughout the network and servers is not done by an automated virus, it's done by controlled malware; and the encryption is manually triggered when they think that the preparations are complete to do maximum damage, backups have been disabled/corrupted, etc.

So they do target the extortion; already the decision to move on from that initial foothold will be based on the understanding of what institution it is and how much they would be willing to pay. In this case, they have intentionally targeted hospitals.

blendo2• 6 years ago

Bad health IT is a public health issue.

Perhaps it’s time for hospitals to regularly report their OS versions and patch levels to our local health departments.

samename• 6 years ago

My hospital offline for a whole week because they got hit by a ransomware attack, and they use Epic. I asked someone I knew at Epic what she knew about it, and confirmed that my hospital was up-to-date on the latest version of their software and following most of their security protocols. My initial thought was they had weak IT security and now I’m not so sure.

Scoundreller• 6 years ago

The EMR probably wasn't the vulnerability, but rather the OS, etc. that was running it.

_23sd2• 6 years ago

Doesn’t matter if their Epic servers are up to date if the attacker got a domain admin account somewhere else and can just log in normally to run the ransomware.

fny• 6 years ago

Epic is an on-premise dumpster fire, so I'm not surprised. Plus there are many attack vectors besides the EHR. I assume they probably had access to services cut off rather than having patient data held up for ransom.

wslack• 6 years ago

Epic is likely not the vector for this sort of thing (it runs using a thin client); far easier to take advantage of unpatched machines.

closeparen5• 6 years ago

In general, regulated entities are required to regularly prove that their change-management processes are sufficiently heavy as to make regular patching a non-starter.

Mary-Jane5• 6 years ago

This. A million times. Regulation isn't the solution to this industry's woes -- it's the cause.

bamboozled2• 6 years ago

Is this the hospitals fault, or as software engineers and tech entrepreneurs, our fault?

ryandrake2• 6 years ago

If there is one thing I’ve learned from HN commenters, it’s that software engineers are never, ever individually responsible for the ethical or moral consequences of the software they write. It’s one of the most consistently and quickly downvoted topics here. It’s always the company’s fault.

stjohnswarts3• 6 years ago

The technology is there to get rid of 99% of this therefore the ball is in the hospital's court

Mary-Jane5• 6 years ago

Really it's the regulatory environment. It treats any change as potentially life threatening. Imagine if you had to prove that none of your changes could possibly risk patient safety to people who think automated tests can't be trusted because they can be written to simply print "PASS" all the time.

baskire• 6 years ago

You could just have hospitals be required to meet FedRAMP compliance.

It is kind of crazy that hipaa compliance isn’t encompassing enough

1MachineElf• 6 years ago

Likewise, I love FISMA, but I don't think hospitals would cease operations just because their systems couldn't get an ATO. What kind of accountability would motivate them to complete POAMs with any urgency? I don't think there is an effective way to incentivize a proactive approach - financial penalties would simply be indirectly paid for by customers.

djsumdog2• 6 years ago

If there's a zero day, there's not a lot you can do. NHS got hit so bad because they were running very old Windows versions. A lot of embedded systems have no upgrade paths (MRIs running embedded XP should probably not be on the network at all).

Hospitals need full backup machines and with health care costs already through the roof, that will just add more. Even if you have all your order entry machines setup to not make external Internet connections except to update servers, one bad e-mail getting through and you could be in trouble.

sat_nam• 6 years ago

Zero days may get the headlines, but attackers are finding a lot of value in leveraging old vulnerabilities. CISA, FBI and NSA have issued several advisories over the last month highlighting an overarching theme of advanced persistent threat groups targeting unpatched vulnerabilities lately.

tonyhb• 6 years ago

You're gonna need your MRIs on the network cuz they transmit the actual PHI via PACS.

No way the operator is copying a 5GB+ dicom file to your record in your EMR manually.

You NEED to have the patient name added via modality worklists to reduce errors (ie. add the pt to the MRI software before the scan, and send the scan to the EMR once it's taken).

The worst thing is, this protocol is old and insecure. They just don't have the IT chops at hospitals to handle this.

dheera• 6 years ago

Also, stop using Windows in the healthcare system. Windows is a risk.

deadmutex• 6 years ago

Big claims need big proof. I would want to see how windows managed by a good IT team is significantly more of a threat than other OSes.

com2kid• 6 years ago

Ancient versions of Windows are used because they are a stable target for drivers.

Linux would end up the same way, some ancient kernel/distro because the closed source driver only works on that one ancient installation.

Mary-Jane5• 6 years ago

The regulatory environment in the Heath Care industry is based on the premise that any change risks patient safety. Changing a single line of CSS literally takes 6 months to test, validate, document and get approval for, so everyone's afraid to change a thing. You can't automate anything because the current process survived 7 audits and regulatory is afraid changing it might raise an alarm. You'd be stunned at the number of hospitals still running Windows XP. Most systems use a plain text messaging protocol designed in the 80's -- no encryption or authentication anywhere to be seen, and half of them write messages to disk because "it's safer". If ever there was an example of well intentioned regulation gone horribly wrong this is it. The whole industry is a cyber security nightmare waiting to happen.

zaroth• 6 years ago

I don’t think hospital regulations are uniquely good or bad. It’s like a typical can’t live with them / can’t live without them dynamic.

Or to put it another way, the worst thing possible short of no regulation at all.

thomastjeffery• 6 years ago

I think the obvious solution would be to invest in a new open-source end-to-end infrastructure that could be thoroughly audited then implemented by hospitals everywhere.

Of course, that would need a sizeable investment of both money and time, but it would almost definitely be more efficient than updating one component at a time.

swiley• 6 years ago

A lot of medical stuff seems to suffer from this problem of caution paralyzing the behavior of professionals, not just in IT.

That being said, most commercial software seems to be way worse. There was the article the other month of a windows 10 machine automatically updating while a patient was being operated on forcing them to be kept under for an extra few hours.

blendo2• 6 years ago

The regulatory environment in the Heath Care industry is based on the premise that any change risks patient safety.

I understand your point, but surely, simply REPORTING the current OS patch level is not, in and of itself, a change risk?

“Sunlight is the best disinfectant”, and all that.

latchkey• 6 years ago

https://www.nytimes.com/2020/10/28/us/hospitals-cyberattacks...

coolspot• 6 years ago

https://archive.is/Cs6RR

Dahoon4• 6 years ago

Someone should ransomware Krebs and force him to get a mobile friendly site.

wills_forward• 6 years ago

LOL’d

Stierlitz3• 6 years ago

Seriously HR admins, if you care anything about your reputation, you should cease re-posting this kind of neocon disinformation.

MattGaiser• 6 years ago

You are on a site where there are thousands of people who have personally encountered ransomware.

Are we all neocons to you?

Stierlitz3• 6 years ago

If you run your infrastructure on a “computer” directly connected to the Internet such that it puts hospitals and power grids in danger, then maybe you're in the wrong profession.

FpUser3• 6 years ago

"You are on a site where there are thousands of people who have personally encountered ransomware."

Got any proof about those number in regards to HN users or it is just another "everybody knows"

milquetoastaf• 6 years ago

Wonder if this is related to the recent breach of psychological patient data

enahs-sf• 6 years ago

I'm not sure how, but somehow, I suspect that my health insurance premiums are about to increase.

lotsofpulp7• 6 years ago

Health insurance premiums are just total healthcare costs for the insured lives plus x% for operations of the health insurance company. If all hospitals have to raise prices to meet IT costs, then presumably the total cost of healthcare for the insured lives goes up, and hence the health insurance premium has to go up.

So yes, typically if your vendor's suppliers increase price, then your vendor will increase their price too. If your vendor has big margins and you have the ability to switch to a different vendor, then maybe the vendor will eat the cost, but health insurance is already a low margin business, so that's not likely.

proggy• 6 years ago

health insurance is already a low margin business

I’d like to know much, much more about this statement.

flattone• 6 years ago

Is the US ransom-ware-ing Russia?

Or anything similar?

CyanBird• 6 years ago

Several years ago the Obama admin took down the entire financial and banking sector of Russia after the iirc early signs of election tampering were shown in 2016

But Ryuk is not the Russian government anyways

emmelaich• 6 years ago

Fascinating .. do you have more info?

yuskii• 6 years ago

I don't see any specific details on this.

djsumdog2• 6 years ago

Yea, there's very little .. evidence listed.

TameAntelope• 6 years ago

https://gist.github.com/aaronst/6aa7f61246f53a8dd4befea86e83...

That's got a list of some info, my understanding is that you can take information like that and look at other attack to start to see if there are elements in common to give you more overall information about the group possibly responsible, and how to detect the group again more quickly next time, to possibly jump in and deal with the problem before it leads to exfiltration or destruction or whatever bad thing you're trying to avoid. https://www.youtube.com/watch?v=BhjQ6zsCVSc talks a bit about how to detect UNC1878.

It sounds, specifically, like Hold Security is monitoring criminal communication and picked up a reference to this campaign ahead of the execution. Combined with the subsequent follow-through, it would be pretty straightforward to attribute the folks who said, "We're going to do this thing soon" as the folks who then ended up doing exactly that thing.

For what it's worth, I know nothing more about this than what was presented in the article.

mullingitover• 6 years ago

Interesting that DHS's public twitter has no word of this, and instead is a full-time campaign ad for the border fence.

It's also ironic that for all the pervasive government surveillance of the internet, this stuff just flies right under the radar. I thought the whole point of this surveillance was for our protection?

vmchale• 6 years ago

DHS is a shitshow, Chad Wolf isn't even legally supposed to be running the thing.

the_resistence• 6 years ago

The world's security services have to put a full court press on this clear and present danger.

EQYV6• 6 years ago

If this attack results in actual loss of life, I firmly believe the US should ensure that there are real-world physical consequences for these criminals. They cannot be described as anything less than the worst humanity has to offer. A failure to respond with meaningful and severe consequences for those responsible (assuming this is attack can be confidently attributed to a particular threat actor) opens the floodgates. Time to find out how seriously the US takes its own cyber doctrine.

https://www.reuters.com/article/us-usa-defense-cybersecurity...

xvector• 6 years ago

If US citizens die due to this, I am 100% down with bringing the full might of our military down on the state/group that did this. No mercy.

fnord77• 6 years ago

what if the state actor who did this has nuclear weapons?

door99• 6 years ago

Horrifying mindset that led to the disastrous war on terror in the aftermath of 9/11. Our foreign policy should not be based on an animalistic thirst for blood.

supertrope3• 6 years ago

Attribution for cyberattacks is hard.

nobrains• 6 years ago

The problem with this is that other bad players within US can "hack" this attempt to blame a state/group that had nothing to do with this. Has happened in the past.

tpolm2• 6 years ago

And how are you going to identify the state/group that did this? Believing "experts"? Oh, that worked just fine previously

https://en.wikipedia.org/wiki/United_Nations_Security_Counci...

FpUser3• 6 years ago

I would advise taking a deep breath first. How the f..k will you bring "full might of military" on some group located everywhere? Invade few countries? I sincerely hope that by now people in congress have little bit more of that gray matter. And what exactly does that "no mercy" mean?

crispyporkbites• 6 years ago

You’ll kill thousands, maybe millions of innocent lives by going down this path. Are their lives worth less than US citizens? Why?

wheresmycraisin• 6 years ago

And how many innocent civilians will die in the process, assuming they can even identify the group responsible?

conanbatt• 6 years ago

What if the responsible is the government?

marvin• 6 years ago

I was about to say that this is practically an act of war. You could make a good case that military intervention is justified.

1_player• 6 years ago

Ah the usual American response: for every US citizen that dies, kill 5 foreign soldiers and 15 civilians.

Then you wonder why everyone is burning US flags.

Dahoon4• 6 years ago

So war against the US government who is to blame for the 1990's IT infrastructure of the whole health system?

rudedogg3• 6 years ago

What about management? What about the sysadmins/developers that left a security hole somewhere? Are they held responsible in some way?

It's unacceptable that this keeps happening. If you own a safe and it gets broken into every week, do you blame the safe cracker or who built the safe?

eggsmediumrare2• 6 years ago

Do you blame the dev? Do you blame the HR system that hired them? How about the manager that pushed them too much? What about his manager? Is it the VP of IT's fault, even if he didn't know the technical specifics? Nothing is any one person's fault. Blame is a stupid waste of time.

RandallBrown• 6 years ago

My house would be trivially easy to break into but if someone did, I wouldn't be responsible.

Even if I leave the door unlocked, it's still a crime to break in and take my stuff.

asdfasgasdgasdg2• 6 years ago

Sometimes analogies can be misleading. It's a lot harder to design a secure hospital IT apparatus than a safe. Also, in the event of a safe getting cracked, you'd likely have no recourse against the safe vendor. Safes are designed to present a firewall against tampering, but with sufficient physical access, no safe will stand for long. So your analogy fails two ways: one is that it trivializes the difficulty of the problem you're analogizing, and the other is that even if it were a good analogy, it would cut against your argument.

ryanmarsh2• 6 years ago

Floodgates...

TGD

haram_masala2• 6 years ago

You're talking about the mass murder of easily 20 million people.

Mary-Jane5• 6 years ago

Good God no! I get where you're coming from but you've clearly not worked in this field. Heath Care IT is a disaster that was CREATED by regulation written in a different era of computing. The whole industry is terrified of making changes because of the multi-year hoops they're forced to jump through to release them; you don't flog a horse for stopping when you pull on the reins.

The correct solution is to change the flawed thinking in our regulations that treats all changes as equally hazardous to patent safety. The government should be encouraging (the right) changes to be released more quickly -- punishing companies for following the rules won't fix anything.

nodelessness2• 6 years ago

That doesn't justify someone abusing flawed systems to threaten people's lives.

"Oh we brought it upon ourselves by making it easy to break in so we should fix that instead of going after the thieves?"

tremon• 6 years ago

I don't think the OP was advocating for punishing the hospitals, but rather the ransomware authors.

nomercy4002• 6 years ago

Maybe the US should also invest some of their military money to solve the situation of insecure hospital IT. You need defense, you won't win it with offense. There'll always be another bad actor out there.

EQYV6• 6 years ago

Absolutely true as well.

Dahoon4• 6 years ago

So should Russia do the same? After all the US did officially declare a cyberwar against Russia. If this ends up being attributed to Russia they have a very real defence in pointing the finger at the US and saying "You started it!"

EQYV6• 6 years ago

If the United States pre-emptively attacks a foreign country with a cyber attack resulting in the loss of human life, then yes, Russia or any state would be justified in retaliating. This is equally true for any such use of any weapon of mass destruction.

benlumen• 6 years ago

And if it’s from China?

This is going to be a controversial suggestion, but I have a feeling that we might already be in an asymmetric world war and our leaders might quietly know it. This year has felt like checkmate.

slimed• 6 years ago

That is exactly how it feels.

EQYV6• 6 years ago

Then we should not be so meek as to do nothing. During the Cold War, nations did not sit idly by as their adversaries developed nuclear capabilities which, make no mistake about it, targeted civilians and civilian infrastructure. Of course, we developed our own defensive capabilities but then, as now, we faced a type of threat which hugely favored the attacker. So we kept pace with the offensive capabilities of our adversaries. If China or Russia (the states themselves) is identified beyond doubt as the source of this attack, then our policy must be to retaliate in kind.

Mutually assured destruction for the cyber-age.

If it's organized criminal hackers we're dealing with, then we should treat them how we would treat any legitimate terroristic threat. I would want our intelligence agencies to reach out and touch them.

This may not be a popular point of view on Hacker News. I unfortunately cannot fathom an alternative solution.

therockspush• 6 years ago

As diabolical as this is, you wouldn't really need state level actions to take down hospitals.

Anyone who has been to one in the last year, pre-covid even, understands the ferris wheel of nurses and doctors that churn through the butter of what goes on there.

These weren't exactly hardened targets to begin with.

ardit332• 6 years ago

It is happening:

https://www.bloomberg.com/amp/news/articles/2020-10-28/u-s-h...

Patients are being turned away: Wyckoff Hospital hit by computer virus

https://www.reddit.com/r/nyc/comments/jju0rp/wyckoff_hospita...

doublerabbit• 6 years ago

non-amp

https://www.bloomberg.com/news/articles/2020-10-28/u-s-hospi...

rlt2• 6 years ago

I assume/hope hospitals have contingency plans for if their network goes down?

It would certainly make them less efficient and result in more errors, but hopefully they wouldn’t grind to a complete halt.

RcouF1uZ4gsC• 6 years ago

The simplest solution is to ban Bitcoin and the other cryptocurrency. Crypto currency is what enables this.

nomercy4002• 6 years ago

Consider a hospital like a person's body.

If you don't nurture a wound, you'll get an infection. If you don't clean your hands before eating or you eat something foul, you get diarrhea. The outside world is a dangerous place, and if you wish to interact with it, you should have your defences in order and take necessary precautions. And then still bad actors will get through, such as the yearly flu, so you must deal with that as well.

You won't defeat the outside world with offense, there's just too much out there, adapting too fast.

ificanhelp• 6 years ago

This is truly appalling per se, even more so during a global pandemic.

If I can be of any help to stop this, disrupt these guys or whatever I'm ready to give a few of my days and nights to it. Contact email in my about.

I'm a professional developper with a dormant interest in ethical hacking. Been following EH courses, done some CTFs ranging from basic web pen testing to crypto and assembly debugging and been reading/watching keenly everything I saw on cyber-security in the past 5-6 years.

hrgiger• 6 years ago

There is still an opportunity from the lessons learned. You can regulate your hospital systems as you regulate financial institutions and certificate them. I was also thinking a network setup on a sub-pub system separating trusted and untrusted networks using computer vision via optical sensors or camera&monitor in an old fashion using ocr,classification or even barkod /optimized qr code that client picks task id and id from queue and shows on a device and server reads via sensor or camera. Maybe problem is not the we are lack of solution but the systems just old.

aitchnyu• 6 years ago

Is there an analysis of the stack (OS, apps) used by victim orgs and the holes in their systems? I'm guessing its always EOLed Windows versions.

Beached• 6 years ago

it is definitely not always eol windows, most ransomware I have seen rune on modern os, fully patched with you to date av. it is not hard to creat or distribute or to mutate and keep active. it is not just windows either, I have seen it for osx and ubuntu, even cloud services like office365, Dropbox, etc.

99% of the time the hole in the system is the phishing email that the employee clicks on. you will be amazed how many link clicks, redirects warning messages and notices people will just click through because "hr" needs to verify you payroll information or other nonsense that doesn't even make sense.

naveen99• 6 years ago

Maybe hospitals should escrow their data with NSA. Append only backups. Get ransomware, restore from NSA backup. Make all that storage capacity useful.

jcadam• 6 years ago

Time to de-digitize, BSG-style. Back to paper records for anything remotely sensitive.

And no networked computers for processing anything important.

marketingPro• 6 years ago

US hospitals are ripe to attack. They make huge profits and use extremely outdated tech or use new (untested) software.

I take this opportunity to complain about regulatory capture and the medical cartels. Their constant irresponsibility (opioid epidemic, coronavirus response) affects everyone. Yet they still are paid more than any other industry.

LinuxBender4• 6 years ago

Do all these hospitals have backups that ransomware and automation can not tamper with? Is anti-tampering a requirement in their audits, or just detection? Have any hospitals started implementing secured workstations in kiosk mode? i.e. Windows 10 LTSC with all the hardening options enabled and AD permissions locked down and treating workstations as ephemeral devices.

CompuHacker• 6 years ago

It is my experience that hospital(s) do not have the budget for Windows 10 across their entire network.

LinuxBender4• 6 years ago

In that case, my proposal would be that hospital customers should be able to opt into a program that allows them to buy a thumb drive from the hospital that has their records in an encrypted file, with images exported into an open lossless standard such as PNG. What size thumb drive would most patients individual records fit onto?

easton_s• 6 years ago

My local hospital was hit with ransonware. They had backups but it took almost 5 months to get back to normal.

shp0ngle• 6 years ago

Finally a usecase for Bitcoin

ch4s3• 6 years ago

It's interesting that this topic was much talked about when I was working with hospitals 3-5 years ago. They've seen it coming, but have largely squandered the opportunity.

Most hospitals store their data and run systems on-prem and are hyper-allergic to anything cloud based. They often have sloppy if extant back-up policies, and I've never heard of a hospital practicing a restore from backups. They also all seem to have terrible policies around passwords that cause most of their staff to iterate passwords every few months by simply incrementing a number at the end. You're also quite likely to find passwords on post it notes under half the keyboards in a given facility.

Security certifications are kind of a joke and mostly conducted by lawyers and compliance officers who have no technical background, let-alone info sec training.

TL;DR this has been a ticking time bomb for a decade and everyone involved knew it.

IndySun• 6 years ago

Could this be related to repealing ACA in some way? Would information stolen help one side or the other? Or is there no connection? & How would one know anyway?

Non-American (but not ignorant of USA) wondering why this is happening now.

JohnCClarke2• 6 years ago

InsurTechnix's founders experienced the effects of cyber attacks on multiple hospitals at our previous start up. That's one of the reasons we founded InsurTechnix.

Here's an introduction to our ransomware report: https://youtu.be/2yDqp34JN9k

If any hospital CISO and/or IT admin would like a three month free trial - even just to get through the current attacks - please reach out.

buzzert• 6 years ago

Mikko Hypponen and F-Secure will get revenge.

Public message to ransomware gangs: Stay the f away from medical organizations. If you target hospital computer systems during the pandemic, we will use all of our resources to hunt you down.

https://nitter.net/mikko/status/1240225603565105152?lang=en

garfieldnate• 6 years ago

Why are hospital systems connected to the public internet, anyway? Wouldn't it make more sense to have all of the life-or-death stuff on its own secure network?

deepsun• 6 years ago

Very expensive to put and maintain separate cables, kinda separate internet.

TheBobinator2• 6 years ago

The actors responsable are doing an all out attack to maximize profits as US Large corps and military are currently targeting their networks to prevent election tampering. These botnet networks have prooven difficult to disrupt even fort hem. This is a profit maximization effort for them and probably one they'll do right before folding and disappearing as the last time hosptials and police were directly targeted national governments began disappearing the perpitrators.

What'd be heartless is if the malware, such as the ryuk ransomware in December of 2019, had a bug in it that prevented the decryption key from working and all it did was garble and trash data.

Be forwarned, a few groups deploying ransomware are on sanctions lists which carries direct liability if you pay them. If you're the IT staff, make the CFO\CEO pay them and wash your hands of it.

FBI, DHS, HHS Warn of Imminent Ransomware Threat Against U.S. Hospitals

Related Stories