Slashdot Mirror
Hackers Demand $3.6 Million From Hollywood Hospital Following Cyber-Attack (softpedia.com)
An anonymous reader writes: The Hollywood Presbyterian Medical Center has been hit by a cyber-attack and its systems are now being held hostage by hackers that are demanding a ransom of 9,000 Bitcoin, which is about $3.6 million (€3.2 million) in today's currency. Management has forbidden staff to turn on their computers, fearing the attack might spread, and the Radiation and Oncology departments have been completely shut down because they can't use their equipment." The staff were also forced to use fax machines rather than email, and to write down patient data on paper; patients had had to come in in person for results.
Isn't this what backups are for? Wipe the infected computers and restore from backup. A few days of lost data seems less disruptive than weeks of no computers at all.
So wait until next week when that 9000 BTC is worth $1.50, but not until the week after when it will be worth three times that.
These guys are super assholes for putting patient lives in danger for a few bucks. If there was a reason for extraordinary rendition, this is it.
I'd like to know who handles their IT?
Contractor? Imports? If they cannot turn their computers on.... are they pulling the drive to access the data on clean airgapped computers?
I'd bet they have a marginal IT staff and a bunch of managers. Would be typical.
Another consultant who stuck it out.
"We are the Priests, of the Temples of Syrinx..."
"CSI: Cyber"
Because this is similar to season 2 episode 5 entitled "Hack E.R."....
Michael
http://s1.sfgame.us/index.php?rec=58163
TFA didn't say what OS the hospital was using, or if it'd been kept properly updated. I hope, however, that they'll use this as an opportunity to either update all of the computers during the reinstall, or install a more recent version of whatever OS they're using. The same thing goes, of course, for any anti-virus/anti-malware software involved.
Good, inexpensive web hosting
No telephones either, eh?
“He’s not deformed, he’s just drunk!”
They picked the wrong target. If you hit a small business it's easier to pay. If you hit a large business you pay because you don't want people to find out. You hit a hospital though and people could die and it is very very public.
Right about now there will be a whole lot of resources targeted towards finding these people. They are fucked.
FAX machines are routinely employed in the clinical environment, e.g. lab results, prescriptions, diagnostic reports, etc.. The most often cited reason (I don't make this stuff up) security.
Two of my imaginary friends reproduced once
When english fails: "patients had had to come in in person for results".
Could have just said: "patients had to come in person for results". ...and then we actually would have understood it without ten-times the brain power.
Just use Linux :)
aaaaaaa
"Management has forbidden staff to turn on their computers, fearing the attack might spread, and the Radiation and Oncology departments have been completely shut down because they can't use their equipment."
Hey timothy, what was the name of the Operating System that this 'cyber-attack' runs on? you didn't actually use the word cyber on a technical site?
Who? The execs who cut IT budgets?
IBM and Apple are partnering to create an entire new system for hospital management.
It has an extremely protected back end and a very difficult to infect front-end: The iPad.
I challenge hospitals in this country to do the switch... at least get in with a POC/Beta program.
Isn't health care practically the highest critical tier of the "Internet of Things"? We can't even motivate ourselves to properly secure medical data, literally life and death stuff, even after they get pwned like this. The folks on the IoT bandwagon actually want to hitch more of our daily technology to the Internet, things with even lower security motivation? Sorry, IoT is dumb beyond belief. We really need to be working on air-gapping and unplugging a lot of stuff from the Internet. Some things should never, ever get plugged into the Internet, convenience be damned. For other things, maybe they can be plugged in, if a rock solid security apparatus is in place and you still maintain the ability to recover from a breach, acknowledging that it can still happen.
Left MS Windows for Linux Mint and never looked back!
Vote for Bernie in 2016!
I spent about 8 years to convince my boss to never use Windows in equipment control. The only places where Windows XP (not later) is allowed to be are the workstations of different secretaries and specialists which are too old to be retrained. So if some ransomware hits the damage is limited to the computers that are easily reinstalled from scratch.
There is the place where the ransomware can still hit: It's the SAMBA server that has shares that the ransomware can encrypt, but it presumably has a proper backup.
To do so we sometimes had to design and produce our own data collection equipment since the existing one is Windows-only.
Sorry, I have no security clearance to name our preferred OS (not Linux) and a place in the Russian military-industrial complex where I work.
Typical IT drone...stuck on stage five.
Beware of the Leopard.
Here's hoping they have a rolling backup they can just nuke the entire system from orbit and perform a full restore, they'll be back up and flipping off the hackers in a matter of hours...
Oh, wait, it made Slashdot. Must mean nobody had a backup plan.
Fools.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
If they had PROPER backups, simply restoring would restore them to the same vulnerable state they were in just before the attack, and the attackers would immediately re-infect. Before restoring, they have to protect the system from being exploited again. They should try to determine how the original attack was carried out and fix that hole. Also, a too-strict intrusion prevention system at the firewall would be a good idea. They can whitelist as required.
That assumes PROPER backups, but most people don't use a proper backup strategy. Most fail one of the following points:
Tested regularly. VERY often, I see that customers backup stopped working months ago and they didn't know it.
Rolling/ incremental. A backup from last night does you no good if ransomware encrypted everything yesterday afternoon. You need to be able to retrieve backups from multiple points in time.
Off site. Fire, burglary, lightning, 3rd party data center problems - all of these cause loss of racks of equipment. If your backup is sitting next to your live server, you've lost both.
Restorable quickly, and fully (bootable from bare metal). Some tape backups take DAYS to restore a single large server, as do some cloud backups.
These are all lessons learned and confirmed from actual experience assisting real customers. I designed the Clonebox system based on these lessons.
They're also routinely employed in the legal field. Documents sent to the ICJ or the ICJ at The Hague or the ECHR are REQUIRED to be sent by Fax.
It's only recently (the last six years) that the RCJ in London has been accepting documents by email attachment (pretty much since my first visit as an Advocate, where I produced a netbook with the entire casefile on it and after much discussion with the Judge, got him round to the idea that a scanned bitmap compiled into a PDF was pretty much identical to a scanned bitmap used to make a photocopy of a signature).
Source: been there, worn the t-shirt. Several times.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
Even if it is in FileSystemChecKing Harvard Business Review, October 2009, page 38.
http://www.ganino.com/files/Harvard%20Business%20Review%20%282004%20to%202013%29/Harvard%20Business%20Review%202009/10.%20HBR%202009%20Oct.pdf
*** Suerte a todos y Feliz dia!
Don't forget to pat your ass on the back, there!
- X/Y -
Incompetent people should get fired.
Malicious people should get a entire firing squad.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
http://www.dban.org/ shows it outdated and have a commercial product now? :(
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
This is particularly thrilling to hear right after a binge watch of Battlestar Galactica (TRS)'s season 1-2. NO NETWORKING ALLOWED!
Incompetent people should get fired.
I suspect you didn't really mean it that way. Competent people weren't always. People don't come out of the box competent. Now, if they've had sufficient time and training, and failed to become so, then fire their asses.
As for "Malicious people should get a entire firing squad.", I'd be happy to pull the trigger on these asshats.
Just another day in Paradise
Why not? Having worked in healthcare for over 10 years I can tell you the systems are astonishingly insecure and outdated. A couple years before I left the industry (2014) we "upgraded" to a "new" system from the late '80's to handle all of our patient billing.
The way I look at this, the more the better.
The more that important infrastructure gets compromised, the more the public will become aware of how fragile these systems are. We need more publicity like this. It will only be through things like this that will draw attention to how bad the security is for computer systems at places like hospitals, etc;
We play the game with the bravery of being out of range
The number 9000 suspiciously reminds me of Anonymous.
If it were me: Move all the patients out to another hospital, then nuke every system and peripheral that can possibly be infected, reload everything from backups or from scratch. Either get manufacturers to re-flash firmware, or smash them with a hammer (literally) and replace them. And yes, as others have suggested, if a single patient dies, then the hackers responsible get murder charges tacked on to the rest. If a single patient gets injured, even, they're responsible for all of it. Hell, I'd have to say this probably qualifies as a terrorist attack. Catch 'em and string 'em up, or put 'em in front of a firing squad.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
Cutting IT budget gives them an almost certain way to look good. The risk of getting the main systems hacked is roughly 1 in 50. It generally goes against human nature to give up a certain chance of looking good in exchange for preventing a 1 in 50 really "bad" event that doesn't outright kill you.
Don't complain about human nature; rather find a way to work with human nature as is. Mandatory security audits may be the only practical way, but it will jack up medical costs for patience.
Table-ized A.I.
FDA 510K - change to an existing device.
Two of my imaginary friends reproduced once
Damn printers!
Hopefully these hackers will be found. In addition, the hospital needs to hire some serious security experts; this never should have happened in the first place.
Would have never happened of they had stayed with their trusty HP3000.
Tracy Johnson
Old fashioned text games hosted below:
http://empire.openmpe.com/
BT
Update on the recent Cyber attack on HPMC
This is a good example of why some computer networks should NOT be connected to the internet, in any way, shape or form. This is people's lives we're talking about. If there is any internet access what so ever, it's an unacceptable risk. If there MUST be internet access, it should be tightly controlled by firewalls, ie: whitelisted sites only that staff in the facility need to get to.
This kind of thing should not happen. 100% preventable.
The terrorists do not stop at nothing, even blackmailed health care institutions, sad....