Slashdot Mirror
L.A. Hospital Pays Off Ransomware Thieves To Reclaim Its Network (google.com)
Los Angeles' Presbyterian Medical Center, the target of a successful ransomware attack (successful from the thieves' point of view, that is) has buckled under: to regain control of its network, the hospital has paid a 40-bitcoin ransom (about $17,000) to the gang responsible. That, at least, is a far cry from the much higher ransom widely reported to have been initially demanded: 9,000 bitcoin. (That would have meant a payment of $3.6-3.9 million.)
They fed the trolls.
Table-ized A.I.
Cheaper to pay than to fix it themselves. Yes?
Don't step on the baby.
>> the hospital has paid a 40-bitcoin ransom (about $17,000)
That's about 340 tablets of hospital aspirin or 680 hospital bandaids for those counting at home.
And, can the FBI monitor the blockchain to get IP addresses where these coins were accessed from when the hospital handed them over?
I'm sure that they are going to take the $3.6 million that they didn't have to pay during this episode and devote that to upgrading and securing their systems to prevent the possibility of future attacks like this. That would be the smart thing to do.
Right?
Left MS Windows for Linux Mint and never looked back!
Vote for Bernie in 2016!
Good god, doesn't anyone keep backups anymore?
That's like four generic Tylenol and half an Ace bandage.
It's about 10 minutes worth of surgery. They should have racked the hospital along with 1000s of others and every insurance and pharmaceutical company who colludes with the hospitals (read that as every single one of them) to over charge for their services. Medical care is extremely over priced. But then they come back with the shitty argument of what is life worth and continue to rape people.
Would have put up a firewall, and made *them* pay for it.
Just for shit and giggles I'd like to see someone ask a ransom of 1 million Dogecoins instead.
This is stupid. Why would a hospital of all companies not have a disaster recovery plane? This type of attack is so trivially preventable it's almost funny.
... is for someone to figure out an efficient way of tracing the full transaction history of any given "coin." Yes, I know that "in theory" it's do-able but it's just plain not feasible right now.
Yes, I know BC "coins" as such don't have a history, but transactions do. If a coin is the "output" of a transaction then its "parent coins" are all the coins that went into the transaction, in proportion to each other. Yes, you can "launder money" but all that does is "spread the dirt around" resulting in "slightly dirty" BC that are considered only as fractionally valuable as their "clean" fraction.
For example, if a ransomware victim, in cooperation with the police, pays 40BC to crooks, the crooks will of course launder the money immediately, probably several times over. As soon as the keys are recovered and there is no more danger of the crooks "getting revenge," the police issue a notice that all BC whose "transaction history" included this transaction are "tainted by the dirty transaction."
At this point, reputable companies who trust that particular police authority will only accept "tainted money" based on the "clean" portion of its value. Those who happen to be stuck with the "dirty money" are pretty much out of luck, in much the same way that I am out of luck if a store clerk accepts a very good counterfeit $5 bill from a crook then later innocently hands it to me in change later that day.
Yes, this setup has many flaws, but it's better than the status quo. Some obvious flaws include:
* it's currently not feasible
* there are many police authorities, and people trust them to different degrees, so the BC in your wallet may have a different value depending on who you want to do business with.
* Whoever has coins "descended" from tainted coins at the time they are announced as tainted will be stuck with the loss
* There is no built-in appeal for a police authority declaring a particular transaction "illegal" and declaring the coins received in that transaction "tainted". The only deterrent is that if a given police authority gets too sloppy or too abusive, fewer and fewer people will honor its declarations.
* There are no doubt other flaws, this is just the ones that came to mind immediately.
Of course, the real solution to ransomware is backups, backups, backups, but we all know that's not going to happen any time soon. Sigh.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The true business model of the Internet of Things.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Is it just me or has Slashdot been recovering news in a timely fashion lately?
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
What a bunch of selfish, moronic, incompetent, irresponsible assholes. It should be a federal law that is it completely illegal to pay any sort of ransom of this sort.
Look I know this will sound fucked up, but $17k costs less than keeping good backups of a hospital's data...
This sounds like one huge HIPAA violation to me. Presumably the hospital is on the hook for disclosing sensitive patient data without permission?
One wonders how many other facilities are "silently" infiltrated.
If you need your PHB to approve the funds for a project like this, point him to this article, and to: Harvard Business Review, Oct 2009, page 38.
Then tell him that almost 7 years later, the CIO/CISO from the hollywood hospital did not learn the lesson, and got eggfaced, would you, my dear PHB would like the same? no? Then approve project and funds!!!!
*** Suerte a todos y Feliz dia!
I thought it was generally accepted to be a bad idea.
see https://en.wikipedia.org/wiki/Danegeld
NO WAY! You mean that if I compromise a system with access to ANOTHER system, that I can compromise the second system?!?!?
That's fucking magic! ...Or so i am led to believe...
I never understand why sensitive businesses never airgap their networks. The IT department's should be sacked for not standing up to the higher management by insisting there should be airgap systems.
Now every tom and dick will come to infect the hospital as it now shows that they pay up..
What Shadow99_1 says is on the mark. Plus note that the medical field almost always uses Windows and I don't have to tell people here the security "fun" that decision leads to. The medical field in general doesn't understand much about IT and I get the impression that the very few IT providers there do a pretty crappy job in general with their Windows-centric solutions. The idea that this hospital would now do serious work to tighten up their security is just laughable. I'm 99% sure that going forward they won't have anything more powerful than hope that they get left alone now that they paid off the bad guys. I work in IT and I occasionally have to talk to a customer's IT staff about technical issues they have with us and one of the things I see a lot is that a lot of smaller sized companies definitely don't value IT work at all and are trying to get by with as few (overworked) IT employees as they possibly can, so I totally believe that a hospital might only have 2 people as their entire IT staff.
I'm willing to bet that these were windows machines - and probably woefully out of date.
I wonder just how many hospitals are still running windows XP or some other relic thinking it will save them money.
Maybe the California Department of Health needs to start auditing hospital networks?
Short sighted from an industry view, probably not from the hospitals view. You would hope they have air gapped their network from the internet at this stage while they reappraise their security and plug holes.
As Stuxnet (and others have shown), air gapping does jack.
We got hit in a segregated network with some ransomware as well recently. The vector? A vendor came in to work on a DNA/gene sequencer and had to update the firmware. The malicious code was on his USB key. We have scanning software everywhere... except on machines connected to lab machines, because scanning messes up the interface software.
Of course our file server has daily snapshots, so we were able to roll back. That's why I'm a bit surprised about this: not that they got hit, but that they couldn't restore/roll back.
You're going to get hit in a way you don't expect at some point, so in addition to defence, you need to look at contingencies. It's the latter part that the hospital was weak in.
This has to be the most ridicules thing ever. This is why corporations have standard images of everything.
1. all data must be backed up to shared locations
2. all computers must have a core image
3. design architecture in a module, segregate way
4. have a DR plan, and in it, ransom-ware, spy-ware, hacking, trojan, backdoors should be a clause
if you follow those 4, you can never be taken over for to long and not entirely, sure your data could be stolen, but that is a different topic, but taken over, never as long as you have physical access to the hardware, period.
I hope they find these scum, take everything they own (it was involved in a felony), and gets each of them 20 years with no parole.
They're almost on par with the scum who cracked Goodwill, and stole customers' card info....
mark
take it off the web.
if this is supposed to be a new economy, how come they still want my old fashioned money?
"(successful from the thieves' point of view, that is)"
Why does this need to be clarified, for whom else could it have been called "successful"?
It's the moral equivalent of declaring all money that is used in a crime the equivalent of an impurity that taints anything it touches, forever and ever, but with ever-decreasing effects.
Think of it this way: If we were in the age of only gold coins and no paper money (and for the sake of simplicity, no silver or copper coins), it would be like if a particular coin was used in a crime, it would magically turn into base metal but nobody would know it for several hours after the crime occurred. If you put this coin in your purse, all coins in that purse would suddenly take on the average metal content of the entire purse. So, if you had 9 "clean" coins of equal value in your purse and dropped in one "base metal" coin of the same value into the purse, all of the coins would suddenly be 90% of the the value of a "clean" coin. Anyone who was holding any coin that had been "co-mingled" with the bad coin since the time of the crime would have partially-de-valued money, in a viral way.
Now, as I said above, since it's not feasible to know the complete history of a coin, such a system isn't practical, at least not right now.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
My gut tells me this is likely a white hat thing.