Slashdot Mirror
Botnet Attack Shuts Down Hospital Network
aricusmaximus writes "A California student is now facing felony conspiracy charges after
unleashing a botnet attack that shut down the network of a Seattle hospital intensive care unit. This indictment comes a few weeks after another California man pled guilty to similar charges. Both attacks were attempts to make money off of adware affiliate programs. So who's really at fault here? The students? The hospital for not securing their computers and network? Or the adware companies for providing the incentive?"
Colt manufactures guns. Man opens fire in public with a Colt pistol. Who's at fault? The shooter, of course.
I don't want to hear any psychology bullshit claiming it's not their fault--that it's society's fault for making them desire more money. I don't want to hear any bullshit that they didn't know what they were doing or the hospital should have had better security. This is an aggressive act against a public service--the internet. Computer savvy students implement code that shuts down many computers for the purpose of advertising profit. They didn't realize what they were doing? Oh, come on. Even if they didn't, it's a valuable lesson and a few less spammers to ruin the world when they graduate. Tough. You like computers? How about five to ten in federal-pound-me-in-the-ass prison?
I'll bet they wished they had enrolled in Computer Ethics 101 before going on this capital venture. As an additional punishment, they should be forced to code software to stop stuff like this from happening and tailor it for medical equipment/computers.
And what kind of intensive care unit is "shut down" when they can't use computers? It's not like their work would have to grind to a stand still. I don't want to sound like a luddite but are we really that dependent on computers? They're medical professionals, I hope they did just shut down and stop working when the computers crashed.
This student is in deep trouble. He chose actions that had grave consequences and now he'll face the charges resulting from those actions.
Inignot: Your stereo is now his stereo by way of my actions.
Shake: Yes meatwad, with actions.
My work here is dung.
So who's really at fault here? The students? The hospital for not securing their computers and network? Or the adware companies for providing the incentive?"
This is slashdot. The answer to that question is either Bill Gates or George Bush.
It is a pity that the US legal system is no longer about justice; it is now about what can be proven.
Suggesting that the hospitals are at fault for failing to secure their networks adequately is assinine. The perpetrators are at fault. Adware companies might provide incentive and the hospitals evidently need to secure their networks, too, but culpability lies solely with the two defectives who committed the crime.
computer industry....software...
the analogies that others might post in this thread may not consider the possibility of doing it all different such that these problems either likley won't exist or they can't.
Want protection from internet problems? Don't connect to it.But even the International Space Station has had its computer problems.
Life support and computers......hmmmmm....
What kind of idiot would blame the other two? No matter what motivates them, or who makes their job easier, they are the ones who are ultimately responsible for their own actions.
if you make promotions that encourage antisocial behavior you should be ashamed..
if you try to steal money frm above promitions by using above holes you are ofcourse a thing called criminal.
And the extras: Companies making unsecure products..
Surely the actual ICU equipment isn't networked at all, and this just inconvenienced the admin and support staff in that dept?
Get your own free personal location tracker
All three are to blame, but to different degrees.
The students should be taken out and beaten. Anyone with any level of computer knowledge these days should know such activities are both highly immoral and illegal. This isn't stealing MP3s. And to attack a hospital? How thoughtless can you get? However, it's easy to be tempted by this type of thing, while these students got caught, many more got away with it at some point.
The Hospital should be scolded, but it's hard to know just from the story to what degree. It could range from a slap on the wrist to a lawsuit. If they had good computer security, then the students were just good at getting through. If it was bad computer security, then they need to step up and admit it. In any case, they are a hospital that appears to be running Windows to control their sensitive security systems. Bad choice, and that alone warrants one finger pointed at the hospital, if it's true. However, many hospitals are notoriously underfunded. In any case, I hope the IT staff of the hospital reviews this situation and revamps their software to minimize this risk in the future.
The adware makes should all be taken out and shot. They are the immoral facilitators and the ones who should take the most blame. They are the modern day equivalent of drug dealers. They didn't kill the person taking their drugs, but they knew it eventually would come to that, and they never stopped selling. They put all the risk for the crime on the students, knowing full well they could get caught, and that someone elses computer system would be seriously damaged. Something very gruesome and painful should befall them, before execution.
"All great wisdom is contained in .signature files"
Is there no end to the chaotic suggestion that the victims are at fault? People SHOULD lock their doors, they SHOULD keep their children from strangers, they SHOULD avoid walking down dark alleys late at night. That doesn't mean they are the ones at fault with the burgler, rapist, or thug attack. When you even suggest the fault lies with anybody but the attacker, you only validate them as being victims of lose security. This breeds contemptable statements such as "it wasn't my fault I killed the man, he should of had a gun to stop me". Absurd? I agree, Zonk's suggestion certainly was.
Note that what follows below is only based on RTFA wich as usuall when dealing with mainstream press reporting on tech may be wrong or inaccurate or indeed made up on the spot. Nonetheless based on this I conclude the following.
That the student used zombie computers to install adware software that would then generate 'hits' for the students account so that he would be paid. He was using computers he did not own to defraud adware companies by generating false ad hits. This is a wellknown fraud dealing mostly with pay-per-click style ad schemes.
So who takes blaim here and for what? Funny enough that the 'question' left out the first and most obvious cullprit.
I am amazed that MS was not mentioned as one of the cullprits. How often does their software got to lead to crap like this before people will finally ban it for any serious use. Would we accept a hospital that used say oxygen bottles filled by the local scuba diver club? Use alcohol produced in someone's bathtub?
I would very much like to hear that the person responsible for that hospitals computer systems is fired and never allowed to work again. Yes the student is the criminal here who deserves jail time but a sysadmin who installs windows deserves the chair. And yes I would be happy to throw the switch. Hell I would be happy to peddle on a bike to generate the electricity.
If I sound a bit biased against MS it is because I have once again been drafted in working on some piece of crap MS setup because some MSCE idiot made a nice sales pitch. Why don't you just put a sign on your server "Own me!" and be done with it.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Yet another slashdot thread where everyone immediately starts screaming "Linux!" "BSD!" the second they hear the term "security breach". Of course, it'd be nice if there were actually a lot of applications for healthcare that run on those OSs - which there aren't. OSS is pretty thin on the ground when it comes to this field.
Why don't you look and see what's involved in hospital IT? I've been there, and it's a major headache for admins. You have administrators who don't really know much about computers and doctors who are frequently the biggest prima donnas in the world when it comes to getting what they want, in a corporate culture which caters to them.
Add in software developers who frequently have no clue as to what's actually needed, how to make a useable UI, and how information flows in a healthcare setting. But they have a hell of a sales pitch to the doctors and administrators, and you're the one who has to make it work.
Now try to secure it. Really! Wait until the first time Doctor X decides they're going to install their personal software on the workstation. Never mind that supposedly they're not allowed to do that - they'll do it anyways and then scream at you when you take it off. Take a wild guess as to who the hospital's going to back!
It's easy to blame the IT people, and the use of Windows, here. Wrong, but easy. They picked it up pretty quickly, and dealt with it. I'm sure they'd have loved to have more control, but unfortunately it's a question of what you're allowed to do, not what you want to do.
Let's say I have a car with a nice stereo in it. I leave the car unlocked all night, and in the morning discover that the stereo is missing, having been ripped out of the dash with what I can presume was a crowbar.
The crowbar company is not at fault. I am not at fault, even if I am stupid for having left the car unlocked. The thief is at fault, the end. My leaving my car unlocked does not give anyone the right to enter my car for any reason.
Just because computers are involved doesn't mean the rules change. If someone sent you a piece of postal mail touting P3N1S ENLARRGMNT, you would throw it away immediately, but for some reason, when it's sent via email, it carries more validity.
Web 2.0 == Giant Blogspam Circle Jerk
Then it's very obvious that the doctors are at fault. A doctor who doesn't scrub thoroughly enough before performing a surgery cannot blame the infection on the germs. A hospital that relies on a computer system that isn't secure enough cannot blame the crackers.
Microsoft software shouldn't be allowed in hospitals for the same reason pets aren't allowed in surgery rooms. A doctor who insists in having his MS-Windows computer connected to a critical hospital network is like a surgeon who insists in bringing his pet labrador into the surgery room. They may love their software and they may love their dog, nothing wrong with that, but when other peoples' health and life are at stake they are responsible for taking the best precautions, even if it causes them some inconvenience and even it they must follow instructions from people they consider intellectually inferior in some way.
all the monitoring info was radio relayed to a monitoring statin at the central desk, where a single nurse monitored it full time. The unit had a staffing ratin of one nurses per three patients; the monitoring nurse was one of them If they had lost that connection, they would not have had sufficient staff to keep every patient adequately monitored. They didnt have sufficient staff to personally monitor the patients anyway, even with the electronic monitoring helping them out. The nurses were acutely aware of this, and were not happy about it.
In order, I would rank:
the student
the adware companies
the hospital IT staff
THE STUDENT (80% blame)
has no excuse for his actions. He deserves the prison sentence he will no doubt get.
THE ADWARE COMPANIES (15% blame)
Just when I thought they could not be any more despicable, they prove me wrong. (One of the tasks I deal with is cleaning up, or even re-imaging, spyware infested Windows PCs.)
THE HOSPITAL IT STAFF (5% blame)
Come on! What were they thinking of when they exposed such critical, sensitive systems to the internet! I have previously worked in a company where some people had two PCs on their desks - one with internet access, and the one with the sensitive info was NOT exposed to the internet, even via a firewall!
Hopefully the hosital will have a "lessons learned" roundup in a non-confrontational manner, looking at the mistakes made, and revise their IT security policy accordingly. Hopefully, there will also be no firings - it is more important to learn the lessons than to fire a scapegoat.
We are the ones who are responsable. Because, we, the technological elite, have done nothing to prevent this type of situation from occuring. And we have the power to do so. But we don't have the spine to accept our responsibilities for the technology that we create.
Who should go to jail or at least get tossed out of school? The students of course. For unleashing deliberately an uncontrolled technology for profit without making any preparations for the consequences.
If you are a chemical company and you dump poison into a stream or pump it into the air to get rid of industrial surplus, and this directly causes death and destruction, then you are responsible (at least in the civilized world). You make sure of the effects of what you do before you do it.
Same with software. The days are just about over where people will accept unwanted consequences of bad software as unforseen 'acts of God'. The time is coming to an end where you can publish any junk with a tiny print disclaimer stating that you as the software creator are not responsible for anything that the software does.
Same with malware. The software company that put out this adware program should be sued out of business, and the programmers should be blacklisted for creating an application that was outside of acceptable guidelines. And we as the technical elite should set and enforce the guidelines. This is an idea whose time has come and no one else can do it but us. This is the only way that this type of thing will stop. And if the adware program sellers don't like it, too bad. We created the net; we control the net; we take responsibility for what assholes do on the net; we punish the assholes who don't follow our guidelines. That is the way it should be. It would improve the position and respect that geeks get in society.
Blaming the hospital is like blaming 911 equipment makers for the situations that caused people to call 911 (an emergency telephone code that contacts help in the USA). No one would blame electrical equipment manufacturers for the acts of a criminal deliberately cutting the power in a hospital.
Let's set the argument regarding who is at fault aside for a moment. Let's even set aside the "this wouldn't have happened on a non-Microsoft OS" hyperbole. My main question is this:
WHY WERE THE HOSPITAL'S COMPUTERS CONNECTED TO THE INTERNET IN THE FIRST PLACE?
I can't think of a single reason that the computers containing confidential information, personal medical records, and systems necessary for the day-to-day running of the hospital weren't on a stand-alone network in the first place. There are probably some tools that require internet connection, but why weren't these tools run on separate computers? It's fairly easy to transfer data from an internet-connected computer to a non-internet-connected computer (and vice-versa) with floppy discs, removable drives, CDs, DVDs, etc. It may create a small extra step every once and a while, but it's not like the dangers of computers being hacked over the internet is unknown. Even if it did not create an ethical dilemma to have patient records possibly available to a competent internet hacker, the threat of massive lawsuits should such information be stolen should be enough to create some justifiable paranoia about internet attacks. Also, if someone had died because of a slowing of communications within the hospital due to the current hacking, the hospital probably would have been faced with a wrongful death suit. Whether the hospital lost such a lawsuit or not, it would still cost a lot of money and effect the bottom line.
Come on, people, this should be a case of enlightened self-interest. It may be the robber's fault if the robber comes into your house through an unlocked door, but the insurance company won't cover your losses if you left the door unlocked. Locking your doors can be a bit inconveninent if you have to get the door open again while carrying an armload of groceries, but it's worth the security in the long run.
"So who's really at fault here? The students?"
Yup. Motive, means, opprotunity. S/he went ahead and performed a crime. This is the easiest to prosecute under the very slow-to-adapt laws that exist at the moment.
"The hospital for not securing their computers and network?"
Yup. Not taking due care with patients' lives is a felony, IIRC. This is as bad as not requiring your doctors to have a degree or wash their hands. The hospital is lawfully required to set safe standards.
"Or the adware companies for providing the incentive?"
Yup. These folks are guilty of a different crime, but still guilty. I don't know why there aren't more police aresting people and charging them with theft of service. Ad-ware is almost exactly like spam in terms of its side effects and damage.
Everyone is guilty! Only the student will be prosecuted, unless some smart lawyers get on it.
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
The students are at fault, above all else. But I can't believe that the IT department of the hospital was so incredibly foolish as to put everything on the same network. Access control for the doors, computers in the ICU, the system that handles paging doctors...all on the same net instead of broken out by system? What the hell? Did the system at the nurses' station in the ICU NEED to have direct connectivity to the card reader on the door?
I don't think for an instant that the students who exploited systems at the hospital are in any way excused by the fact that the hospital set themselves up for a good hard screwing once they got exploited. But anyone...ANYONE...in a role of designing networks and systems needs to face the facts that such people do exist, are out there, and are very busy. You have to plan for certain "what if" situations, and this is a textbook example of one such scenario. That the IT department of the hospital put all of their eggs into one networking basket as they did is utterly inexcusable, and they too share some blame for planning a system on the proverbial assumption that there are no bad people in the world.
For your security, this post has been encrypted with ROT-13, twice.
but then realized that "security vulnerabilities" would not exist if there were no dirtbags exploiting them
Yes they would - security vulnerabilities are defects/holes in the software and they would exist regardless of whether or not they were exploited. (If a lock manufacturer makes locks that are easy to pick, those locks are easy to pick regardless of whether anyone actually uses that fact to break into something. Your 'tree falls in a forest' logic is wrong, unless you believe in 100% relativism, which anyone who has ever bumped their toe against something in the dark will be able to tell you is nonsense.)
Perhaps you were thinking of "exploits". But if you can't even get the most incredibly basic security terminology right, I'm not sure you are qualified to be saying anything about computer security at all.
Of course the students and adware companies were wrong but the scariest part of it was that the hospital - is getting off so easily - even in the land of geeks. What would be the reaction if the hospital had left its records, medications, instrumentation out in the open and physically rather than just electronically accessible to the public? If someone had died - who do you think would be sued - the idiot who tried to pawn the heart monitor or the hospital for leaving it on the street?
For those not familiar with the health system here - it is a private one. The motive for hospitals is to maximize profit while minimizing costs. Since there is relatively little public accountability through the government, and individual patients are largely unaware of the relative quality of hospitals, health care insurers are the ones that keep costs from getting too high and malpractice suits keep quality of care from getting too low. Mistakes can cost money - but admitting mistakes can cost a lot more and thus the level of cover-your-butt here is amazingly high.
In such a CYA environment, I question two things - the assertion that noone was hurt - and that the bot attacks were the ones that brought the network down. Both of these things may be true but are also things that administrators would say to prevent lawsuits. The fact that the staff was able to adapt so well to the computers being down suggests to me that this is not the first time that it has happened. In any case, there is no question that the computer network is poorly setup and that is almost certainly the fault of the administration. The docs can get away with small things like putting screensavers on their machines but it would take a high level admin who wanted to save money by using the same OS across the board and/or wanted remote connectivity so that his crackberry could work more easily to really screw things up. If there are lawsuits - things will probably change - not necessarily to do things in a sane matter - but so that they can't be sued. The same calculation (effect on lawsuits) will also be used to decide whether and who will be fired/scapegoated over this - and it won't be the admin with the crackberry. At worst he/she might be made to go on a junket to Japan to learn how to run a hospital more like a automotive assembly line...
How about "all of them"? Our society likes to attribute guilt to a single party (or even a single person, aka scapegoat) whenever possible and convenient. Makes the task of appearing to make progress and fixing things much easier, I guess.
Shit happens when idiots collide.
who is guilty?
The students are guilty
Adware companys are just scum
and well the hospital has a small case of stupidity
Hear hear. There's plenty of fault to go around.
Here's another analogy that should make it even clearer:
A bank puts its customers' deposits in a bushel basked behind a non-armor plate-glass window and closes for the night. A thief comes by, breaks the glass with a hammer, grabs the money, and runs.
Who's to blame?
- The bank?
- The thief?
- The manufacturer of the hammer?
- The manufacturer of the plate glass window?
- The car dealership selling the luxury car the thief wanted?
It's pretty obvious to me:
- The thief, for breaking in and stealing the money, and
- The bank, for not exercising due dilligence in protecting its depositors' money.
The same with the hospital, which has an obligation to exercise due dilligence in protecting its patients' health and the infrastructure which directly affects the provision of its medical treatments.
Yes the student was at fault, too. But it's a big wide world out there. With something like five billion people in it and a significant fraction of them having network access, there are plenty of bad and/or irresponsible people with a network presence.
This constitutes a threat as pervasive as weather, or disease. It's up to people who run institutions like banks and hospitals to take this into account. They must take reasonable precautions to protect the health - physical or financial - of the people who have entrusted it to their care.
Microsoft software is NOT rated for life-critical applications and its security flaws are well known. What the HELL was a hospital doing putting life-critical information on it, or letting it share a network with life-critical systems AND the rest of the internet?
I don't know about the rest of you. But just as I wouldn't deposit my money at a bank that leaves it sitting behind a plate-glass window overnight, I'm not going to schedule any medical procedures at a hospital that let this happen, then gave no visible sign of accepting any responsibility for the failure, blaming it entirely on the intruder.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
The sad part about it is that even that isn't an excuse. What I'm about to suggest is far from perfect, but eliminates most of the attacks from dime-store techno-weenies.
You have one cable. That cable is going to run between the keycard entry system, the monitor bank, the EMR system, and Windows machines which are chilling out, vulnerable as all hell, and generally being bad citizens. So you assign 10.1.1.0/24 to the keycard system. You assign 10.1.2.0/24 to the EMR system. You assign 10.1.3.0/24 to the monitor bank. You assign 10.1.4.0/24 to the Winblows boxes. You buy a $300 machine from Best Buy, say and AMD 3200+, and install Linux on it. Run the damned thing into a switch. Have the Linux machine only route data appropriately. In other words, it is going to sectoin the subnets.
Now, you're still vulnerable to various attacks. I wouldn't suggest otherwise. Some ARP attacks come to mind. But this eliminates 99% of the attacks out there. Even if the Windows machines are infected all to hell, the Linux machine won't route 10.1.4.0/24 to 10.1.1.0/24, 10.1.2.0/24, or 10.1.3.0/24.