Slashdot Mirror
Hackers Demand $3.6 Million From Hollywood Hospital Following Cyber-Attack (softpedia.com)
An anonymous reader writes: The Hollywood Presbyterian Medical Center has been hit by a cyber-attack and its systems are now being held hostage by hackers that are demanding a ransom of 9,000 Bitcoin, which is about $3.6 million (€3.2 million) in today's currency. Management has forbidden staff to turn on their computers, fearing the attack might spread, and the Radiation and Oncology departments have been completely shut down because they can't use their equipment." The staff were also forced to use fax machines rather than email, and to write down patient data on paper; patients had had to come in in person for results.
because you can always blame the hackers for their inscrutable sophistication
Isn't this what backups are for? Wipe the infected computers and restore from backup. A few days of lost data seems less disruptive than weeks of no computers at all.
I have no problem with government entities using CIA/FSB level violence against these assholes no matter where they are.
#DroneStrikeTour2016
So wait until next week when that 9000 BTC is worth $1.50, but not until the week after when it will be worth three times that.
Hackers hacker hackers!
These guys are super assholes for putting patient lives in danger for a few bucks. If there was a reason for extraordinary rendition, this is it.
In in into my wonderful world of typos, misspellings and summaries that are out of this world! - Timothy
I'd like to know who handles their IT?
Contractor? Imports? If they cannot turn their computers on.... are they pulling the drive to access the data on clean airgapped computers?
I'd bet they have a marginal IT staff and a bunch of managers. Would be typical.
Another consultant who stuck it out.
"We are the Priests, of the Temples of Syrinx..."
Oh, the horror![/sarcasm]
Before this, they dumped a paraplegic patient on skid row.
"CSI: Cyber"
Because this is similar to season 2 episode 5 entitled "Hack E.R."....
Michael
http://s1.sfgame.us/index.php?rec=58163
Things like that sounds like industrial worker's strike actions. Since there isn't a factory of shoes... There's a bit to move and screw everything. Bush administration perhaps?
TFA didn't say what OS the hospital was using, or if it'd been kept properly updated. I hope, however, that they'll use this as an opportunity to either update all of the computers during the reinstall, or install a more recent version of whatever OS they're using. The same thing goes, of course, for any anti-virus/anti-malware software involved.
Good, inexpensive web hosting
No telephones either, eh?
“He’s not deformed, he’s just drunk!”
They picked the wrong target. If you hit a small business it's easier to pay. If you hit a large business you pay because you don't want people to find out. You hit a hospital though and people could die and it is very very public.
Right about now there will be a whole lot of resources targeted towards finding these people. They are fucked.
With organizations slashing budgets and H1B'ing their IT staff, this is going to become a much more frequent problem...
When english fails: "patients had had to come in in person for results".
Could have just said: "patients had to come in person for results". ...and then we actually would have understood it without ten-times the brain power.
Just use Linux :)
aaaaaaa
"Management has forbidden staff to turn on their computers, fearing the attack might spread, and the Radiation and Oncology departments have been completely shut down because they can't use their equipment."
Hey timothy, what was the name of the Operating System that this 'cyber-attack' runs on? you didn't actually use the word cyber on a technical site?
Hmm, I wonder what the common factor between this and other major attacks on power plants and financial institutions and so on could be.
Bewildering. Maybe connecting critical computing infrastructure to the open internet? Could it be that? I wonder if that could be it.
Somebody showing up to explain how air-gapping only works 99.999% of the time instead of 100.00% as seen in Iran's nuclear program in 3, 2, 1...
Even with the best Windows administrators, funds, and equipment...
Windows will still get infected.
Spread through "local LAN server", sounds like NLM authentication failures again.
17+ years and STILL Microsoft won't block a vulnerable fallback. So of course it is still vulnerable.
This is what happens when you use the most insecure OS in the world.
IBM and Apple are partnering to create an entire new system for hospital management.
It has an extremely protected back end and a very difficult to infect front-end: The iPad.
I challenge hospitals in this country to do the switch... at least get in with a POC/Beta program.
Isn't health care practically the highest critical tier of the "Internet of Things"? We can't even motivate ourselves to properly secure medical data, literally life and death stuff, even after they get pwned like this. The folks on the IoT bandwagon actually want to hitch more of our daily technology to the Internet, things with even lower security motivation? Sorry, IoT is dumb beyond belief. We really need to be working on air-gapping and unplugging a lot of stuff from the Internet. Some things should never, ever get plugged into the Internet, convenience be damned. For other things, maybe they can be plugged in, if a rock solid security apparatus is in place and you still maintain the ability to recover from a breach, acknowledging that it can still happen.
Left MS Windows for Linux Mint and never looked back!
Vote for Bernie in 2016!
This is what happens when you outsource, cut staff, and treat IT like a cost center year after year. No upgrades, no central management. If you treat your IT like crap...you're gonna have a bad time!
This is exactly what they want. An excuse for "Cyber Warfare Powers".
I can't help but wonder if they are behind it...(removes tinfoil hat).
Naah, they would never do that.
I spent about 8 years to convince my boss to never use Windows in equipment control. The only places where Windows XP (not later) is allowed to be are the workstations of different secretaries and specialists which are too old to be retrained. So if some ransomware hits the damage is limited to the computers that are easily reinstalled from scratch.
There is the place where the ransomware can still hit: It's the SAMBA server that has shares that the ransomware can encrypt, but it presumably has a proper backup.
To do so we sometimes had to design and produce our own data collection equipment since the existing one is Windows-only.
Sorry, I have no security clearance to name our preferred OS (not Linux) and a place in the Russian military-industrial complex where I work.
Show me a chapter from the HIPAA guidelines that discourages, or gives even a hint of disincentive, for patching. The reason for the IT departments being poor in the Medical industry is because "GREED", Government regulation which ensures "GREED", and a complete lack of punishment for "GREED" leading to damages.
Don't try and stroke your own ego pretending you are better than those IT people working in the Medical field. If executives staffed IT properly things would not be nearly as bad as they are today. Prakash from India works for half US Minimum wage and faces no penalty if your data gets stolen.
That is to say--in a simplified nutshell-- you are a dolt who puts the blame everywhere it should not be.
Here's hoping they have a rolling backup they can just nuke the entire system from orbit and perform a full restore, they'll be back up and flipping off the hackers in a matter of hours...
Oh, wait, it made Slashdot. Must mean nobody had a backup plan.
Fools.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
If they had PROPER backups, simply restoring would restore them to the same vulnerable state they were in just before the attack, and the attackers would immediately re-infect. Before restoring, they have to protect the system from being exploited again. They should try to determine how the original attack was carried out and fix that hole. Also, a too-strict intrusion prevention system at the firewall would be a good idea. They can whitelist as required.
That assumes PROPER backups, but most people don't use a proper backup strategy. Most fail one of the following points:
Tested regularly. VERY often, I see that customers backup stopped working months ago and they didn't know it.
Rolling/ incremental. A backup from last night does you no good if ransomware encrypted everything yesterday afternoon. You need to be able to retrieve backups from multiple points in time.
Off site. Fire, burglary, lightning, 3rd party data center problems - all of these cause loss of racks of equipment. If your backup is sitting next to your live server, you've lost both.
Restorable quickly, and fully (bootable from bare metal). Some tape backups take DAYS to restore a single large server, as do some cloud backups.
These are all lessons learned and confirmed from actual experience assisting real customers. I designed the Clonebox system based on these lessons.
This is a case where it would be interesting to see them pay some group 3.5M to hunt them down and make an example out of them.
Even if it is in FileSystemChecKing Harvard Business Review, October 2009, page 38.
http://www.ganino.com/files/Harvard%20Business%20Review%20%282004%20to%202013%29/Harvard%20Business%20Review%202009/10.%20HBR%202009%20Oct.pdf
*** Suerte a todos y Feliz dia!
I can't speak to Hollywood Pres but in Hawaii, every hospital I have been in is using XP for their patient information systems. Scary at best!
RIch White Men! Rich White Men!
I have a feeling the creator of Bitcoin never foresaw this kind of use for his invention.
Deserves to suffer the consequence of their actions you do not fuck with peoples health period... one can only wish Karma will pay those bastards back fully with interest...
In retrospect, allowing access when the password "OVERRIDE SECURITY AND ACCESS SECRET FILES" is entered shouldn't have been allowed. Any way they can cause the hackers computers to remotely detonate when they insert a USB stick containing the data?
http://www.dban.org/ shows it outdated and have a commercial product now? :(
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
This is particularly thrilling to hear right after a binge watch of Battlestar Galactica (TRS)'s season 1-2. NO NETWORKING ALLOWED!
Wow, only February and this finally happened. It is the apocalpyse.
Oh wait, Trump will build a firewall. He'll have the hackers pay for it.
The way I look at this, the more the better.
The more that important infrastructure gets compromised, the more the public will become aware of how fragile these systems are. We need more publicity like this. It will only be through things like this that will draw attention to how bad the security is for computer systems at places like hospitals, etc;
We play the game with the bravery of being out of range
The number 9000 suspiciously reminds me of Anonymous.
If it were me: Move all the patients out to another hospital, then nuke every system and peripheral that can possibly be infected, reload everything from backups or from scratch. Either get manufacturers to re-flash firmware, or smash them with a hammer (literally) and replace them. And yes, as others have suggested, if a single patient dies, then the hackers responsible get murder charges tacked on to the rest. If a single patient gets injured, even, they're responsible for all of it. Hell, I'd have to say this probably qualifies as a terrorist attack. Catch 'em and string 'em up, or put 'em in front of a firing squad.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
Cutting IT budget gives them an almost certain way to look good. The risk of getting the main systems hacked is roughly 1 in 50. It generally goes against human nature to give up a certain chance of looking good in exchange for preventing a 1 in 50 really "bad" event that doesn't outright kill you.
Don't complain about human nature; rather find a way to work with human nature as is. Mandatory security audits may be the only practical way, but it will jack up medical costs for patience.
Table-ized A.I.
Damn printers!
Every time I go into a hospital or other medical facility, and see that all their systems are running outdated, insecure versions of Windows, I cringe! Pay, and change your systems to something that is secure, and doesn't start with Microsoft...
Hopefully these hackers will be found. In addition, the hospital needs to hire some serious security experts; this never should have happened in the first place.
Would have never happened of they had stayed with their trusty HP3000.
Tracy Johnson
Old fashioned text games hosted below:
http://empire.openmpe.com/
BT
Update on the recent Cyber attack on HPMC
This is a good example of why some computer networks should NOT be connected to the internet, in any way, shape or form. This is people's lives we're talking about. If there is any internet access what so ever, it's an unacceptable risk. If there MUST be internet access, it should be tightly controlled by firewalls, ie: whitelisted sites only that staff in the facility need to get to.
This kind of thing should not happen. 100% preventable.
The terrorists do not stop at nothing, even blackmailed health care institutions, sad....