Kentucky Hospital Calls State of Emergency In Hack Attack (cnbc.com)

An anonymous reader quotes a report from CNBC: A Kentucky hospital is operating in an internal state of emergency following an attack by cybercriminals on its computer network, Krebs on Security reported. Methodist Hospital, based in Henderson, Kentucky, is the victim of a ransomware attack in which hackers infiltrated its computer network, encrypted files and are now holding the data hostage, Krebs reported Tuesday. The criminals reportedly used new strain of malware known as Locky to encrypt important files. The malware spread from the initial infected machine to the entire internal network and several other systems, the hospital's information systems director, Jamie Reid, told Krebs. The hospital is reportedly considering paying hackers the ransom money of four bitcoins, about $1,600 at the current exchange rate, for the key to unlock the files.

Comments

Document2

[HumanWiki]

Looks like someone opened it there....

Re:Document2

[Z00L00K]

Maybe it's time for organizations to learn that networks need to be segmented within the organization and not put everything on centralized servers. That way it's at least possible to contain any intrusion and malware to a smaller area.

Re:Document2

[HumanWiki]

Good luck with that... As an infra-engr guy for over a decade now, I can't tell you how many times I've been told to go pound sand by the people in charge of the company when I suggest things like that that cost money upfront to stop things that may cost money later. Pretty much anyone asking for actual backup systems or real DR hits similar walls. Not saying it's right or that I agree with it.. But, it's not as simple as saying it's time they learn. They don't. They never do.

Re:Document2

[tnk1]

Spear phishing attacks can be scarily professional these days. There are always better ways to do things with security, and many ways to mitigate those threats, but it is often less about what tools they use, and more often about what policies that they can force their users and admins to adhere to. If hacking organizations take their time, watch the organization carefully and develop a plan before executing their extortion action, they may well be so ingrained in your systems that they are watching your security team talking to each other by the time the hackers make their demands.

Air gapping can protect certain systems from attack, but there is plenty of stuff that you can't as easily segment which is important to the operation of the hospital.

Re: Document2

[Anonymous Coward]

Segregated networks have little to do with spending more money. You can segregate many things to minimize damage with little or no cost. It would seem the IT director doesn't keep up with news (e.g. Target) and shouldn't be in charge of the network. Can't blame employees because they're clueless.

It freaks me out every time I see someone pulling up FB in the hospital. Why would IT allow this? Why would hospital administrators allow this?

Re: Document2

[rdelsambuco]

My question is, would improving security cost more than $1,600?

Re: Document2

[Hotawa Hawk-eye]

Would it cost more than a lawsuit filed against the hospital by the next of kin of a patient that died because the equipment needed to keep them alive was disabled by an attack like this?

Re:Document2

[The-Ixian]

These are the threats that keep me up at night as a sysadmin.

It just takes one user clicking something they shouldn't

To try to combat this I do the following:

1. Use L7 firewall rules to block executables
2. Use IPS on both the firewall and the local computers
3. Use content filtering at the firewall level
4. Use locked down local (PC) firewall rules
5. Use a segmented network model with locked down firewall rules in between them
6. Do not allow anything to execute from local user writable locations (appdata, usb drives, optical drives, etc)
7. Run all workstations as standard users
8. Lock down network shares with least privilege access
9. Stay on top of all updates every month (Flash, Java, Windows, etc)
10. Control by group membership who is allowed to run Java and uninstall it programmatically for anyone not in that group
11. Use OpenDNS
12. Train users how to identify malicious e-mails and set up a process by which users can submit suspicious e-mail for review
13. Run regular phishing audit tests with a sign off from management to discipline users who fail the test
14. Keep regular backups (daily differential, weekly, monthly and bi-yearly full) with offsite rotation and monthly random restore tests
15. Scan logs and reports daily

I am currently pushing to implement SSL proxying so we can benefit from the firewall DPI when users are browsing secured sites.

Even with all of that, I still feel like I am not doing enough. We have already had a few scares where Angler has been detected by IPS while browsing normal web sites.

Re: Document2

[Anonymous Coward]

Your assumption is faulty because it relies on humans to be rational actors and able to accurately gauge risk. Humans are notoriously not either of those things. Most people have no ability to gauge risk at all, and many are incapable of rationality. Look how many people do stupid shit that ends up killing them even though they know that might happen. They just believe it can't happen to them, or that they're better than those other idiots that got killed doing whatever. It's this same thinking that prevents many in management from properly securing their IT infrastructure and investing in disaster recovery.

Re: Document2

[pla]

My question is, would improving security cost more than $1,600?

You want to trust recovering a substantial portion of your network to not only the honesty of the guy who wrote this, but also in the ability of a loser who can't make a living as a "real" programmer to implement a reversible cryptosystem as intended? And when the next attack doesn't want money, but instead comes from a 14YO who just wants to fuck things up, what then?

$1,600 doesn't even show up as an OpEx, it vanishes into petty cash; losing a billion dollar a year company's entire network because you didn't take even basic precautions? CIOs go to jail over incidents like that.

Re: Document2

[dgatwood]

That problem is easily solved. Bankrupt a dozen such companies and publish articles that make it really clear that the reason they went bankrupt is that they refused to implement the security that their techs recommended. Then, when the idiot MBAs tell you to pound sand, you can show them case files of companies that made the same decisions and lost everything. Then, their irrational fear of what is probably a relatively low risk (but high cost if they're wrong) will cause them to throw money at the problem, just like our government does with the TSA.

Re: Document2

[HumanWiki]

Kind of like how some laws hold the consequence of your life being taken from you? And how it's published that X person was put to death for Y crimes? That hasn't really reduced the crime rate.

Re:Document2

[The-Ixian]

One type of attack that I witnessed over the winter holidays last year involved a malicious user harvesting e-mail signatures via auto-replies.

Then using publicly available org information to target the accounting dept.

The spear phishing e-mail looked pretty damn legit. The e-mail contained, what appeared to be, a back-and-forth exchange between the owner and the CFO with a request to transfer money.

It actually came way too close to succeeding and was only foiled by the fact that it was such a highly irregular request. I would like to think that our regular phishing audits had something to do with it, but sadly, I think that if wire transfers were something we regularly do, it would have been a successful attack. Scary stuff.

Re: Document2

[dgatwood]

That's in part because most criminals foolishly believe that they won't ever get caught, and in part because a large percentage of those crimes are committed by people in situations where they don't have enough time to act rationally, e.g. crimes of passion, having a gun on them when they rob a store and getting surprised by an off-duty cop, etc. If somebody said to them, "Look, if you bring that gun with you, there's a chance you'll have to use it, and you could get the death penalty," some percentage of them would probably not bring the gun.

Re:Document2

[lgw]

1. Use L7 firewall rules to block executables

I saw people extracting password-protected zip files to execute malware in the 90s. They've been doing it ever since. Sure, it might help a little, but still.

6. Do not allow anything to execute from local user writable locations (appdata, usb drives, optical drives, etc)
7. Run all workstations as standard users

For kiosks, or shared machines, sure, but otherwise that's a significant imposition on users for very little gain, as a rootkit just bypasses all of that, and there's always a new privilege escalation exploit making the rounds.

9. Stay on top of all updates every month (Flash, Java, Windows, etc)

See, now that solves real problems without getting in everyone's way.

Train users

Hahaha, good one!

sign off from management to discipline users who fail the test

Hahaha, man, you should do stand-up.

15. Scan logs and reports daily

What, manually? On how many servers? Log scanning is a job for software (which does it continuously, and can page you).

Re:Document2

[afidel]

Yup, wire transfer fraud is scarily effective and lucrative. A local company lost $14.8M, they were able to recover all but ~$4.8M of it but only by hours and that's still a LOT of money to get from a few hours research and a few emails.

Re: Document2

[jofas]

Of course it would. But $1600 is not *nearly* the exposure risk they had and will likely carry for several months.

Re:Document2

[torkus]

Oh please, hospitals are still the low hanging fruit. Doctors who can quote body parts I can't pronounce and didn't know exist can't manage to remember a moderately complex password for more than 15 seconds...much less change it on occasion. I'm trolling a bit, but the number of hospital devices still in use that are set to default logins, passwords, pins or the like is astounding.

I'll say that hardened targets are still hugely susceptible to an individual with moderate inside knowledge. Spear-phishing is a joke compared to what someone COULD be writing if they knew how to use spellcheck.

It's more than just budgets though. It's the mindset of the end users (security is annoying) and the middle to senior managers (personal agenda >>>> usefulness) that's leaving huge holes. It amazes me that more Bad Things don't happen both where I work and elsewhere.

Re:Document2

[The-Ixian]

1. Use L7 firewall rules to block executables

I saw people extracting password-protected zip files to execute malware in the 90s. They've been doing it ever since. Sure, it might help a little, but still.

We actually block password-protected zip files as well.

6. Do not allow anything to execute from local user writable locations (appdata, usb drives, optical drives, etc)
7. Run all workstations as standard users

For kiosks, or shared machines, sure, but otherwise that's a significant imposition on users for very little gain, as a rootkit just bypasses all of that, and there's always a new privilege escalation exploit making the rounds.

We whitelist exes based on meta data in the file's certificate, usually publisher name. If an executable is not signed, it has no chance of running. Turns out that this is mostly a problem for me and not users.

We use Avecto DefendPoint (formerly Privilege Guard) to set executables which are automatically elevated. We use this to allow users to install software from an approved list. This also has the benefit of allowing privilege escalation without user switching.

9. Stay on top of all updates every month (Flash, Java, Windows, etc)

See, now that solves real problems without getting in everyone's way.

Yeah, you'd be surprised (or maybe not). "Updates again?! I just updated!"

Train users

Hahaha, good one!

Yeah, it can seem hopeless but I do see improvement

sign off from management to discipline users who fail the test

Hahaha, man, you should do stand-up.

I'm here all night!

15. Scan logs and reports daily

What, manually? On how many servers? Log scanning is a job for software (which does it continuously, and can page you).

No, not 100% manually. I have scripts set up to do some of the work for me. But ours is a small network of around 20 servers and about 150 users. So this is not as tedious as it sounds.

Re: Document2

[jofas]

Couldn't have put it better myself.

Re:Document2

[J053]

Or, maybe, they should learn to have good backup policies so a ransomware infection would result in, at most, loss of 1 day's data while the last pre-infection backup is restored. Data integrity 101, people.

Re: Document2

[pj2541]

What CIO's have gone to jail? I must have missed that. I don't recall any jail time for a corporate officer in the US since Al Capone.

Re: Document2

[geoskd]

CIOs go to jail over incidents like that.

If only that were true. Executives almost never go to jail, even for knowingly engaging in practices that are killing people. Just ask Volkswagon, or Enron, or BP, etc...

Re: Document2

[sconeu]

And most bean-counters foolishly believe "it won't happen to us".

Re:Document2

[FirstOne]

Looks like none of your precautions would have stopped this particular M$ macro scripting ransom-ware. You may have recovered the lost data using your backups.. but...

What you really need is a good email front end filter.. Like Spamexperts, which just might have quarantine the incoming email fishing attempt before it got to a gullible user.

Oh, and stop using M$ OS's & Office products.. Nothing like having a software monoculture, Pimped by greedy exec's, programmed by inexperienced H-1B's, is just another drive-by waiting to happen.

My advice to Hospital pay the $1600 ransom, recover your files, learn from your mistake, and go forward. (take precautions in the future)..

.

Re: Document2

[jofas]

"But ours is a small network of around 20 servers and about 150 users. So this is not as tedious as it sounds." Ah. I was wondering how you remained so optimistic. Good for you, but the average user/server to sysadmin ratio is *much* higher. The things you mentioned are on all admin minds, but the cash and time are not.

Re: Document2

[Anonymous Coward]

Executives almost never go to jail, even for knowingly engaging in practices that are killing people.

And that's the problem. There is a simple solution that few people have the balls to implement - assassination of the executive leadership of guilty companies.

Re:Document2

[The-Ixian]

Looks like none of your precautions would have stopped this particular M$ macro scripting ransom-ware

Well, except that macros in office docs are disabled by default and would need to be expressly enabled.

Oh, and stop using M$ OS's & Office products

Not really an option. We are an Autodesk shop and so we are pretty much locked in to a monoculture.

Re:Document2

[Pontiac]

Network segmentation, internal firewalls, client firewalls and admin isolation are the keys to preventing this.

Local Server and client firewalls prevent access to system shares from unauthorized sources.

Firewalls segmenting the network help isolate an outbreak.

Admin isolation: No logging onto your desktop as admin ever! management tasks are done by remote access to workstations isolated in their own hardened network segment and built for admin tasks.

Overkill? depends on your point of view. I know of places doing it this way.

Admins will fight not having their tool set local on their machines but after you get used to it it's better.

Re:Document2

[Anonymous Coward]

Good luck with that... As an infra-engr guy for over a decade now, I can't tell you how many times I've been told to go pound sand by the people in charge of the company when I suggest things like that that cost money upfront to stop things that may cost money later

Very true.
And in this case, chances are whatever solution IT comes up with would cost a whole lot more than the $1,600 ransom.
So unless there ends up being some kind of fine or Regulatory penalty/sanction, the Board is going to side with the beancounters, make a bunch of noise for the press and public relations, and then go back to business as usual.

Re:Document2

[Anonymous Coward]

Or, maybe, they should learn to have good backup policies so a ransomware infection would result in, at most, loss of 1 day's data while the last pre-infection backup is restored. Data integrity 101, people.

Accounting 101:
If the overall cost of the IT solution required to make that many backups, and host them properly, and isolate the network properly, exceeds the cost of the ransom plus damages.... pay the ransom and damages.

Guess which one the Beancounters who run the place are going to follow.

Re: Document2

[Anonymous Coward]

Seriously, the only reason people pay these ransoms is that, so far at least, everyone has actually gotten their data back.

I propose a new ransomeware business plan

1. Build some ransomeware that doesn't actually encrypt files, just overwrites them with pseudorandom garbage
2. Collect bitcoin from people who think you are actually going to decrypt their files.
3. Repeat until the reputation of ransomeware authors is completely destroyed and nobody pays anymore because they figure they aren't getting their data back anyway.
4. ???
5. Profit.

Re: Document2

[Thor Ablestar]

Let's calculate. Once upon a time I was a sysadmin in some Russian hospital. About 100 quite old computers with about 100 GB each. The critical data are about half of them. So you need about 10 TB to hold a reserve copy of everything - about US$500 of HDD. Maybe less. Then, you take any computer that has enough HDD ports - about US$150 since you don't need a new shiny computer, it would just work. Install there some software that would copy the modified files - it's free.

But it's not the solution. The correct solution is the order of Chief Doctor that everybody who does not cooperate with Sysadmin would pay the ransom from their own pocket.

Re:Document2

[Thor Ablestar]

Problem is NOT the prevention of the outbreak since everything unpleasant SHALL happen (Murphy's law). Problem is the recovery from this situation as well as recovery from the situation where the recovery is impossible.

So imagine yourself in position of sysadmin when all the Windows and Mac computers already display the ransomware message. What exactly would you want in this situation? (Hint: Backup)

Re:Document2

[Thor Ablestar]

Do the damages include the "death by negligence"?

Re: Document2

[Anonymous Coward]

Skilling and Fastow both went to federal prison with multi-year sentences. Yes lots of execs get away with it but the Enron fiasco wasn't one of them (ok some Enron execs skates, but getting the CEO and CFO is better than usual).

Re:Document2

[dmr001]

When I worked as a software engineer, typed my password in for various ssh sessions maybe 10 times a day. Now that I'm working as a physician, every time I walk in and out of a patient room (which can be multiple times for visit, fetching the liquid nitrogen and scalpes and where are we keeping the extra large speculum this week anyway). I get to type in my (Active Directory) password with its enforced mixed capitals and numbers that I'm not allowed to change (too many disparate systems, apparently), maybe 50 times a day.

Which doesn't help with the spear-phishing, right? That just requires that I click on the link in the email addressed from my information security department, complete with their logo, saying they need to verify my information. I don't think my clinician colleagues are falling for that much, but the folks who answer the phone, hired out of high school, it's easy enough for them to fall for it.

Re:Document2

[dbIII]

Yes I was doing all that but then some Visual Basic newbie wrote some sort of inventory application that not only needed MS Windows but MS Windows as admin to run, and apparently everyone needed it. So we started getting viruses. Lots of them. Apparently all my fault. Eventually after a lot of shitty office politics the Visual Basic newbie was ordered to stop putting his temporary file on the root of C: drive which was the only reason it had to run as admin. After that the frequent virus problem dropped down to an infrequent one per year or two.
If you don't have a consistent policy and someone to back you up on it to the highest level then lazy decisions by others are going to fuck you up.

Re:Document2

[dbIII]

3. Use content filtering at the firewall level

I've got ethical and legal issues with this on the encrypted traffic side despite that practice becoming worryingly popular.
I like that I can currently stand up in court and say that I have no access to the banking passwords of the employees of my workplace. Those "web accelerator" things that do content filtering on even SSL traffic via getting people to accept certificates so that it can do a man in the middle attack then give whoever has root/admin/physical access to the device has the ability to rip off those bank accounts and get up to less blatantly obvious mischief. I don't want to be the former employee of a company that has been sued into oblivion by a bank due to an internal data breach with internet banking passwords.

Re:Document2

[pete6677]

It would help if Microsoft would quit making Windows effectively useless for real work without a local admin login. Try doing asp.net development without admin rights.

Yes I know, a workerbee who only uses Excel and Outlook does not need admin rights for anything.

Re:Document2

[dbIII]

Not really an option. We are an Autodesk shop and so we are pretty much locked in to a monoculture.

It's funny how the cheap and nasty CAD program that could run on a PC ended up being the only game in town.

Re:Document2

[ArmoredDragon]

Maybe it's time for organizations to learn that networks need to be segmented within the organization

If they're HIPPA compliant, they already do this.

not put everything on centralized servers.

That's neither necessary nor practical. What should be done instead is file versioning with timed snapshots, which basically every major storage vendor provides. Or if you want free software, ZFS does it as well. Not only is it a good way to prevent malware, but it provides a good audit trail as well.

Re:Document2

[Anonymous Coward]

Then the login-system in that place is just bad... Go with a secure smartcard and a 5 digit pin.. Sure it requires a smartcard reader for each computer, but the cost of that will probably be worth it in increased security and for the bean-counters it would be less time in typing in the password..
Say it takes 5 seconds on average to type in the password. 50 times per day would be 250 seconds. 5 days 1250 seconds. 4 weeks 5000 seconds or 83 minutes..
With a smartcard and a 5-6 digit pin lets say say 2 seconds it would be 33 minutes.. Ie gaining 50 minutes every 4 weeks could pay for the readers quite fast (for the bean-counters) and make the users a bit more happy..

5 seconds is probably quite low estimate if you take into account the time it takes to memorize new passwords every X weeks/months and include the password reset-handling etc.

It would also be a enabler for sending encrypted/signed mails to colleges.

Re:Document2

[Anonymous Coward]

It's going to be more than $1600..
- Wages for people investigating the problem and figuring out a solution.
- Wages for people actually restoring things
- Wages for managing the incident
- Wages for actually inspecting the data making sure it's all there.
- Cost for the downtime.

Re:Document2

[Anonymous Coward]

Start by blocking Java and Flash... They are probably the biggest security-holes in your environment..

Infection introduced via these can happen on basically any web-page where someone injected some bad code into ad's served by one of the big ad-networks..

Re: Document2

[Anonymous Coward]

CIOs go to jail over incidents like that.

CITATION PLEASE!

Re: Document2

[drinkypoo]

If somebody said to them, "Look, if you bring that gun with you, there's a chance you'll have to use it, and you could get the death penalty," some percentage of them would probably not bring the gun.

My late father told me "I'd rather get caught with it than caught without it" and I'd think that should apply many times over when robbing someone.

Re:Document2

[drinkypoo]

It actually came way too close to succeeding and was only foiled by the fact that it was such a highly irregular request.

It should have been foiled by procedure. A procedure should be in place to require a physical signature for any wire transfers over a small amount, defined as "what you can afford to lose". You lack well-defined procedure, necessary for your own protection.

Re: Document2

[anegg]

Of course it would cost more than $1,600. The attack also has cost the hospital a lot more than $1,600. Part of the problem with convincing management to spend more $$ on IT security risk mitigation is that the cost of IT risk mitigation has a lot of variables in it (including the insightfulness and capabilities of the IT staff) AND the expected cost of IT security problems is hard to get a handle on, again due to many variables. Hence you see many organizations doing the basics that have become commonly accepted costs of doing business (firewall, individual ident and authentication/authorization, backups, and anti-virus being chief among them), but a lot less doing more than that. Doing the basics doesn't require detailed analysis and justifications, so it's a much lower bar to get over. Doing more often requires a relatively weak function in the business to put up a prolonged campaign against more powerful interests; the reward for success in spending more for mitigations may well be "nothing happens", but whether it's because the mitigations were successful or the risks were overblown may never be clear to top managers. And having the organizations that by chance DON'T have a problem year over year when they forego spending on "esoteric" IT security measures avoid calamity reinforces the belief that such spending is unjustified. One fix might be the rise of an "IT security" insurance industry that would refuse coverage until organizations had a more comprehensive risk mitigation strategy in place, another would be public regulations with large(r) fines and or criminal liability for executives. I think there are parallels to be found in the world of physical loss risks such as on the job injury prevention and public safety in the event of fires and earthquakes where businesses needed outside forces to come to bear on them before they would put in place a lot of the now-standard protections (things like occupancy limits, sprinklers, fire exits, stairway capacity planning, emergency lighting, as well as other physical plant protections like machine lockouts, safety guards, etc.).

Re:Document2

[DontTrustWhatIType]

Absolutely not! Please delete this post before any more healthcare CIOs see it.

I like the consulting fees I can command when cleaning up the mess (and sometimes cleaning up the house, because let's face it, if you're a CIO who does not understand security risks, you should not be CIO). I can make more in 3 days after the stuff hits the fan than in 6 months of trying to get an organization to turn the fan off, or at least point it out the window.

P.S., CISO are often just as "expert" as CIOs but with more badges, because they're "certified" in security.... he he he. When your CEO or Board of Directors hires me, you should have already resigned.

Re: Document2

[speederaser]

Executives almost never go to jail, even for knowingly engaging in practices that are killing people. Just ask Volkswagon, or Enron, or BP, etc...

For Enron most of the leadership were prosecuted and sent to jail, including Kenneth Lay (CEO) and Jeffrey Skilling (COO). Not to mention the prosecution of Aurthur Anderson which put them out of business.

Re:Document2

[Anonymous Coward]

Run all of your clients in guest jails, share a ZFS volume through the jail, take snapshots, lots of them. Have the host clone those snapshots to its own set of snapshots so the guest in the jail can't delete the data.

Re:Document2

[MoarSauce123]

Maybe it is time for organizations to at least install and maintain freeware AV solutions. The ones that I use on a few system detect and squash Locky as soon as it comes in. Same for the Microsoft Defender which usually does not detect anything. The real problem is that way too many places still use Microsoft Office, it is grossly overpriced and severely bug ridden. How can it be that an app macro can get the keys to the system and lock the entire box down? Microsoft should finally own up and fix this. Same issues with TTF and other components that should have never ever even remotely have a means to access core OS functions. The hospital should take Microsoft to court for selling them an obviously defective product.

Re:Document2

[MoarSauce123]

Most company managements are financially on the right track. DR costs more than dealing with the outcome of a breach or other system failure. That only changes when other entities levy hefty fines on corporations that don't care. Maybe then they can be convinced to invest in real DR. Apparently, doing right by their employees and customers is not enough of an argument. Rather sad.

Re:Document2

[Pontiac]

Virtual desktops.. everything backed up every night..

Re:Document2

[Pontiac]

That would never fly in our environment. We had a project to eliminate all local admin needs across all desktops.
If you somehow sneak a local admin into your machine it will be gone with the next reboot.

That program would have to get through cyber and pier review before it could be distributed.

Re:Document2

[Anonymous Coward]

Backup policies are no longer the answer...Now they just find where your backups are, delete them, then initiate the ransomware. End user training is a must.

Good

[Anonymous Coward]

As well they should pay it.

I have ZERO sympathy for insecure IT systems. I also have ZERO sympathy for "victims" of scams. If you're stupid enough to leave your shit wide open, or Western Union money to Albania, that's on you. It should be perfectly legal to take advantage of stupid people. Consider it a learning experience.

Re:Good

[PraiseBob]

Let's use a car analogy.

Say you are "stupid enough" drive to a bad neighborhood. You leave your car parked, but accidentally left one of the doors unlocked. Should it now be perfectly legal to steal that car, or smash the windows, or commit whatever property crime you want on it?

Re:Good

[iCEBaLM]

No, but you're a fucking idiot if you don't expect it to happen.

Re:Good

[SecurityGuy]

Problem is, if you're a hospital you have thousands of people who can screw up. Any time you have thousands of people who can screw up, it's just a matter of time before someone does.

I also read in another article that they just said "No." and restored from backups.

Re:Good

[sims 2]

What about the elderly?!

Re:Good

[Aighearach]

Shit, your honor, that moron was stupid enough to walk down my street, he knows we hate his kind. He must have deserved it.

That said, I would support charging anybody who pays a ransom as a accomplice in whatever crime is involved, be it kidnapping, (ocean) piracy, or extortionate encrypting.

I would even support an enhanced sentence for the ransom-payer, maybe double the sentence of the base crime.

Re:Good

[Anonymous Coward]

No, it should not be legal.

But I am glad to see this sort of thing happening for such reasonable ransoms. It will definitely motivate people to start paying attention to security, while being cheap enough to pay that nobody actually dies.

 

Re:Good

[Anonymous Coward]

Shit, your honor, that moron was stupid enough to walk down my street, he knows we hate his kind. He must have deserved it.

Took care of that Trayvon Martin fucker, didn't it?

Re:Good

[Anonymous Coward]

Engines want to be free!

Re:Good

[SumDog]

I've seen more and more malware make it through my spam filters (amavis + spam assassin + clamav). I can tell by looking at it. Occasionally I pull the zips into a VM and look at the fake excel files filled with Javascript.

You can't protect against this kind of stuff as an IT admin, without making e-mail even more unreliable than it actually is (I wrote a post about this last year: http://penguindreams.org/blog/how-google-and-microsoft-made-email-unreliable/).

Sure, you shouldn't let workstations have write access to critical data infrastructure, but how knows how this happened? What if it was opened in user mode, someone called help desk, they remoted in and ran some tools as an admin user and boom, it goes and encrypts their rdesktop shaed volumes and spreads that way.

It's more complicated than you think.

Re:Good

[SumDog]

Good victim blaming there.

Re:Good

[Anonymous Coward]

That's because you're a moron. I only open official, trusted documents like PamelaAndersonXXX.jpg.vbs

Re:Good

[Anonymous Coward]

Not sure. But I do know if you have a bevy of Microsoft desktops in your org, the windows are already broken. Does that qualify as "stupid enough"?

Re: Good

[Anonymous Coward]

Yes! Because you answered your own question. You parked in a bad neighborhood. If you leave your car unlocked, you should expect things to go missing.

Re:Good

[Anonymous Coward]

Yes, administering hospital networks very similarly nuanced and complicated as being responsible for a single motor vehicle. Great analogy, 10/10.

Re:Good

[tnk1]

I see where you are coming from, but I fail to see the point of punishing someone for taking an action that might free their relative or friend from a kidnapper who the government is clearly unable to prevent from operating.

It feels very wrong that the only person who managed to save the kidnapped person from being killed might be the only one who would be going to jail.

Yes, let the cops do their job. However, if the cops fuck up, or they can't protect you, then you do what you need to do.

Re:Good

[Anonymous Coward]

I would support charging anybody who pays a ransom as a accomplice in whatever crime is involved, be it kidnapping

Yep, my child was kidnapped, and I do have the money they asked for, so I supposed I could just pay the ransom and let the authorities try to figure it out after the fact. But no, out of principle, I'll just say "sorry son, sucks to be you. Lets hope the feds can find you while you are still alive, but if not, your sister has called dibs on your old room".

Re:Good

[Anonymous Coward]

So criminals aren't at fault, people who get tricked are.

God the world will be a better place when you're dead.

Re:Good

[Rei]

That's an excuse for one computer getting infected. That's not an excuse for the whole hospital getting infested.

Re:Good

[fnj]

That said, I would support charging anybody who pays a ransom as a [sic] accomplice

Jesus H. Christ. That is a perfectly asinine view. I cannot believe anyone is that morally bankrupt. So some scum kidnaps your elderly mother, threatens you that you will neer see her again, and you pay the ransom. Do you really think you should be charged with being accomplice to kidnapping? THINK. I know it's hard, but try.

Look, I know the situation with this ransomware shit is exasperating. It's pretty much a no-brainer that you pay the ransom if it makes financial sense and you can't rescue it otherwise, but after that is done and the data is restored, and maybe after you take serious and effective steps to make sure that it can never happen again, you (and the system) go after the scum-sucking low-lifes who are responsible for the ACTUAL law-breaking, and all others like them, with a fury and resolve that knows no bounds. These ransomware attacks should be crimes of a very high order, and a first offense should be a minimum multi-decade sentence.

Making the victim a double victim (victim of the law as well as victim of micreants) is absolutely the worst idea I ever heard of.

Re:Good

[niftymitch]

As well they should pay it.

I have ZERO sympathy for insecure IT systems. I also have ZERO sympathy for "victims" of scams. If you're stupid enough to leave your shit wide open, or Western Union money to Albania, that's on you. It should be perfectly legal to take advantage of stupid people. Consider it a learning experience.

No bring in the FBI and have the FBI compel a solution.

While I have little sympathy for bad management there is a lesson here
that cyber crimes are a reality and each device that touches a network
will be attacked.

A hack on a hospital could cause numerous fatalities from the NICU, to
the ICU to surgery centers to failure of autoclaves, refrigeration, AC, loss or
corruption of data needed to track blood and other medications and people.

Some worry about the IoT where folk worry about the NEST thermostat
invasion of privacy. Hospitals are more integrated and automated than
the average person knows. Robots deliver drugs upstairs and down.
Drug metering systems are networked and administer pain medications
within narrow limits.

In one context this is a crime and law enforcement thinks they have
a say in this. The reality is law enforcement has little reach to deal
with the international criminals and international borders for things
like this.

The FBI in San Bernardino is feathering their own nest and ignoring the
international risk of their writ at the same time that they wish to react
to the international terror risks.

Back to stupid hospital folk.
We need to train management at all levels so they make good decisions.
Cost is a factor but a lot spent badly is less secure than a little spent well.
Ignorance is not an option.

Re: Good

[Anonymous Coward]

Sorry chap. Nature cannot prune itself fast enough for stupid people. The stupid ones are reproducing at a very quick rate!

Re:Good

[cheater512]

Because victims never contribute to their state of being a victim?

Saying victim blaming is wrong is saying that if you become a victim you instantly become infallible, could not have contributed to the problem in anyway and are a completely innocent party.

Re:Good

[Anonymous Coward]

I modded you troll. Its your own fault because you posted here and knew perfectly well how easy it is to get modded as a troll.

Re:Good

[Rei]

I really don't see why it isn't illegal. Get both the US and EU to pass laws banning the paying of ransomware and you've destroyed the lion's share of their income. You can't totally prevent people from paying, but you'll stop most of it.

Being infected by ransomware should basically become "bad news - your data was destroyed in a file".

Re:Good

[hercludes]

Victim blaming? I hate this attitude when it comes to these sorts of things, it always sends the message that people don't have to worry about their own security and safety. In the end, it is partially the victim's fault because if the victim had decided to employ more security and caution, they would not have had their car stolen. Same as how it's the criminal's fault because if they had not decided to be a shitty person on that day, no car would have been stolen. There's a legitimate difference between employing all the security measures you could but still finding yourself in a situation where you are forcefully unlocking your car door by gun point, and in a different scenario having said "fuck security, it's never the victim's fault" and just leaving your car door unlocked of your own volition.

Re:Good

[Aighearach]

Right, so as long as you think it is going to help your poor elderly mom, then you could rob a bank, or assist in any other crime, too?

Since you started talking about Jesus without even establishing that you understood the moral issues, and started calling names at that stage, maybe you didn't really think through the moral implications as completely as you thought?

I'll give you a hint, when you're calling people names and ignoring what their actual view was while bringing in mom and completely not even addressing the actual situation discussed... you probably do not have the moral high ground. ;)

Maybe think first. Nothing you said even addresses what I said, and yet you're totally exasperated. Well, it isn't going to make more sense by going further off the rails.

You assert that people paying a ransom are victims, but I think there are a lot of people in the world who agree that they are literally assisting the perpetrators to benefit from their crime. Which literally makes them an accomplice under existing law in most places, even if it isn't prosecuted that way. Why is a kidnapping victim under threat in the first place? Because the last asshole's family paid them for doing it.

Re:Good

[Anonymous Coward]

If you have other peoples' property in the car, or materials that your staff depends on to protect the life and health of those people, and you leave the car door unlocked, then yes, you'd better believe that any court in the U.S. would find you liable.

Re:Good

[Grishnakh]

The other problem with this "never blame the victim" mentality is that it seems to assume that bad humans shouldn't exist.

For a different example than the car theft in a bad neighborhood one, how about if you park your car under a really big, old tree as a giant storm is blowing in, and the tree falls over and smashes your car? (Let's suppose that you live here and you should know full well that this tree is really old and could fall over.) No other humans were involved here, just you and your dumb parking job. Is it wrong to assign some of the blame to you for parking next to the old tree? Most people would probably say no, you do deserve some blame, depending on how much you could be expected to know about the state of the tree.

So why should you be absolved of all blame when you park in a bad neighborhood and your car gets broken into?

Bad human behavior exists whether you want it to or not, so you can either refuse to accept it and become a victim, or you can try to minimize your risk by avoiding situations where you're more likely to be a victim. It's only sensible to do the latter.

Re:Good

[Z00L00K]

The analogy isn't exact, it's like passing by a bad neighborhood on the freeway and risk getting shot at.

Re:Good

[OhPlz]

Bad news - your son died because we didn't know he was allergic to the meds we gave him because that information was destroyed by hackers.

Re:Good

[dgatwood]

You assert that people paying a ransom are victims, but I think there are a lot of people in the world who agree that they are literally assisting the perpetrators to benefit from their crime. Which literally makes them an accomplice under existing law in most places, even if it isn't prosecuted that way. Why is a kidnapping victim under threat in the first place? Because the last asshole's family paid them for doing it.

The word I would use is enticing. They're enticing the criminals to commit the crimes. If they didn't make money doing this, they wouldn't do it. If it becomes illegal to help them, and if people are aware that it is illegal to do so then that will make those sorts of criminal behavior much less effective, and fewer people will bother.

At least that's the GP's theory. Personally, I think that there's a sucker born every minute, so making it a crime to pay a ransom won't make a dime's worth of difference.

Re:Good

[ADRA]

One can and certainly should blame companies for not applying best practices (and most likely their legal requirement) to keep information safe. In terms of companies, if they're unable to be effective, they deserve to go out of business. If I drive down the road without car insurance and a deer hits me, do I blame the deer or myself for not getting insurance?

Re:Good

[Grishnakh]

I think the victim should be punished severely too, or else these attacks will keep happening. The victim decided to be a victim, to make himself open to this attack, and this affects the lives of many people at this hospital.

The victim, in this case, is whatever manager or managers decided to have crappy IT security.

IT managers need to start going to prison when these things happen. (Or, if they can show that it was the CEO who prevented them from implementing proper security, the CEO should go to prison.)

Ransomware attacks like this are due to nothing more than sheer negligence. The negligent party should be identified and strongly punished.

Re:Good

[lgw]

That was never going to happen - the question was about whether to restore from backups, or pay the trivial ransom amount. They made the right call, and went to backups, despite that costing more than $1600 in people's time.

Re:Good

[l0n3s0m3phr34k]

Might as well blame it on Jupiter and Vertumnus, Roman Gods of storms and trees respectively. Next time, when parking under a tree, you need to pour some wine on the roof of your car while reciting "Vertumne, uti te ture ommovendo bonas preces bene precatus sum, eiusdem rei ergo macte vino inferio esto."

Re:Good

[aaarrrgggh]

Let's get real though: How are you going to stop an ignorant person like an orderly or doctor from doing really stupid things 0.1% of the time?

In my mind, the only way to control the issue of ransomware is to limit the potential impact a user can have. Comparing $2,000 to the time required to shut systems down, grab a tape, and restore files... you really need to be in a situation where the recovery takes less than an hour rather than paying the ransom. To make that viable no user would be able to encrypt more than (say) 50GB before their network connection is shut down. By my math, that gives you somewhere between 5 minutes and an hour to detect and act. If they distribute the infection before starting encryption in a synchronized manner, you would be down to mere seconds; with sufficient computers and users infected you could even rate-limit to limit the easiest means of detection.

The only thing I can think of is an antivirus in reverse, confirming that files written are valid, but how would you pull that off?!

Re: Good

[Anonymous Coward]

Since IT managers can never get the folks with the money to release some of it to secure the network, I would say jailing them for the inability to work miracles is a bit of an over-reach.

I figure if the government starts fining the shit out of corporations who are lax on network security ( especially those that deal in sensitive personal information ) they'll get the point and start taking things seriously.

If all they have to pay is ~$1600, that's not even worth firing the IT folks over.

Re:Good

[Anonymous Coward]

It's called duress. If someone kidnaps your mom and forces you by reason of violence to commit an unlawful act you may in fact be innocent in the eyes of the law. Depending on your jurisdiction of course.

Re:Good

[Kjella]

Because victims never contribute to their state of being a victim? Saying victim blaming is wrong is saying that if you become a victim you instantly become infallible, could not have contributed to the problem in anyway and are a completely innocent party.

There's two fundamentally different but overlapping meanings of blame. One is the perp's blame - the thief, the murderer, the rapist who is obviously the ultimate cause of everything. But we also used it in the meaning "failed to protect", like if the President got shot many people would blame the Secret Service even though they didn't have any part in it. They just failed to prevent it. The first one isn't really a subject of debate. The second? Well you can implicate almost anyone and everyone if you want to, like take the terror attacks in Brussels. Some will blame the police for not being able to stop it. Some will blame the politicans, the mosques and so on. Who could have done something? Who should have done something differently?

The latter often ends up in some conflict of idealism versus reality. Nobody has any more right to steal from me because I forget to lock the door. But I obviously made it a lot easier for them. Or the mere absence, does the fact that I don't have a home alarm mean I'm more to blame if burglars loot my apartment? This is where victim blaming comes in, you shouldn't do that, be there, get that drunk, wear that skirt, walk those streets. Idealistically, the answer is of course hell no you shouldn't let that control your life. Practically, it's a mixed bag. I lock my door, I don't live in a prepper's bunker. But if bad shit happen, I'd be pretty pissed if you blamed me for not doing enough because it's still not my fault.

Re:Good

[jofas]

Not all components in source and target of the analogy need to be analogous. The burden of liability in failed security is roughly the same here, so the analogy fits. Not locking your car doors in 1973 in my suburb: acceptable. Not locking your car doors in 2016 in my neighborhood: stuff is missing from your car. It's well-known. In the same way, being ignorant of bad guys and malware on the internet in 1993 is acceptable because the risk was much lower. Being ignorant in 2016 is not acceptable and deviates from standard cultural knowledge.

Re:Good

[niftymitch]

Let's get real though: How are you going to stop an ignorant person like an orderly or doctor from doing really stupid things 0.1% of the time?

...

Getting real is spot on.
An orderly or doctor will from time to time will do stupid stuff.
It takes much less than you're 0.1% stupidity rate for this to be an issue.

System need to be patched.
Systems need strong capability models such that no orderly, doctor, nurse or
patient has sufficient capability to cause harm.

Consider the national security issue of an unpatched flaw known to
one or more TLA but kept secret because it is seen as a bit of power.
The reality it is first hand knowledge of a domestic vulnerability
that needs prompt attention. Those with blinders only looking out
(like management) fail to have the intellect to see the risk from the
outside in without getting smacked alongside the head with a thick
phone book. Once educated, selfishness, malice and malfeasance
come to play.

The Maginot Line intended to protect France failed for much the same cognitive
reason that a chicken will fail to walk around a short fence when there is food
immediately on the opposite side.
See: "Cognitive Psychology and Implications"
By John R. Anderson

The reality is a chicken is so focused on the food directly in front of it
that they will not be able see that walking around the short fence
is an option.

Managers often rise to power by will of force and single mindedness
in the attainment of goals. The efficiency of such single minded goal oriented
cognition gets rewarded with a promotion. Ultimately inventiveness
and thinking around the fence and out of the box is required and the department,
company or nation fails.

See also:
"Kohler's first experiments (1925), he presented the following detour problems to a young child,
a dog and a chicken (Figure 2-19). A fence ... fence, and something they wanted was placed
at position G on the other side — within sight but out of reach."

Re:Good

[david_thornley]

If my car gets a window smashed (and the time it happened it appeared to be because I had locked the doors) or stolen, that inconveniences me. It doesn't really affect others that much. If I'm transporting valuables for someone else, fail to lock the car, and they get stolen because of that, I am to blame.

In a case like this, I blame the criminals, of course, and I also blame those responsible for the lack of sufficient precautions, whoever they may be.

Re:Good

[bughunter]

Especially in a case like Hospitals, of which this is the second I've heard of this month. The first was here in LA County somewhere.

Hospitals are required by HIPAA to keep patients' medical records private. That at least implies an obligation to take network security seriously, and it may even explicitly require it.

Re:Good

[dbIII]

The excuse is shared network drives that act as if they are part of the computer that was infected. Convenience over segmentation resulted in the whole hospital getting infested.
The single user not networked MSDOS mentality is still alive, well and why we are neck deep in a reeking malware swamp.

Re: Good

[BronsCon]

Of course they are, they've got nothing better to do while they wait for the hackers to verify receipt of the wire transfer, or for IT to restore from the most recent backup set.

Re: Good

[Grishnakh]

As I said before, if the IT manager can show why his hands were tied by the CxO, then the CxO should go to jail instead.

Re:Good

[sjames]

So naturally, the police will be charged as accomplices if they fail to prevent the kidnapping. Also, charge the victim (posthumously)?

How about we just charge the people who did the crime!

Re:Good

[Aighearach]

No, you're doing an underpants gnome routine on that one. There is no logical connection between what I said, and what you just said. You simply assert that oranges would become apples ... because.

Re:Good

[Anonymous Coward]

Might as well blame it on Jupiter and Vertumnus, Roman Gods of storms and trees respectively. Next time, when parking under a tree, you need to pour some wine on the roof of your car while reciting "Vertumne, uti te ture ommovendo bonas preces bene precatus sum, eiusdem rei ergo macte vino inferio esto."

I love you slashdot... and god of seasons

Re:Good

[sjames]

So you're claiming that police failing to either prevent the crime or resolve it themselves does nothing at all to encourage more of the same?

It really is just about the same argument.

Re:Good

[Aighearach]

I'm not interested in your argument that oranges are really just about the same as apples.

Obviously you didn't understand my statement, if you think your extrapolation is somehow on the same subject. It isn't analogous at all. And furthermore, I expressed a mainstream opinion that is actually the law in some places; none of the major groups supporting this view would support what you said, or think it was similar. Your claim that it is similar shows that you haven't thought deeply about the subject, AND you also haven't read about differing opinions on it.

For a basic walk-through of the subject and the things that are being discussed, see: http://webcache.googleusercont...

There is nothing in the hardline "do not support kidnappers" line that would be anti-police, or have confused the job of police to be some kind of "pre-crime" unit. Rather, the more obvious companion view would be to support strong police or military action against kidnappers. Exactly the opposite direction than you tried to run with your apples=oranges nonsense. Notice how much better "military action" combines with "make it illegal to pay ransoms" than what you came up with as your idea for what my views would be?

Re:Good

[sjames]

Wow, talk about apples and oranges, the article you pointed to is talking about the U.S. government not paying ransom to terrorists who kidnap someonme. That is a rather small subset of kidnappers. Had you properly constrained your statement to that small subset, it might have made sense. Alas, you didn't.

Note as well, that in those limited cases, it is common that special forces responds vigorously and lethally to rescue the hostages and crush the kidnappers. Quite a substantial effort to strongly discourage such crimes.

In contrast, these filesystem encryption people don't seem to be pursued at all. Track them down and send them a cruise missile and we'll talk. Unless or until that sort of thing happens (or they at least end up locked up), there is no moral high ground to charge the victim with a crime.

I believe if you re-examine the parallels you've drawn, you may see that you are the one who has conflated apples with oranges.

Disaster Recovery

[Anonymous Coward]

This is a good time to test their disaster recovery.

If they'd had a proper backdoor...

[Type44Q]

...this clearly wouldn't have happened.

Re:If they'd had a proper backdoor...

[CaptSlaq]

...this clearly wouldn't have happened.

Found the Spook.

Re:If they'd had a proper backdoor...

[dsmatthews9379]

https://www.youtube.com/watch?...

Congratulations!

[BigBuckHunter]

I want to congratulate Methodist Hospital, for digitizing and not investing in proper architecture (security, backups, partitioned infrastructure). They're lucky that the damage is limited to the loss of data and productivity. We can only hope that they go out of business, and that a hospital with a better IT administration takes their place.

Re:Congratulations!

[Anonymous Coward]

stop blaming the victims.

Re:Congratulations!

[Anonymous Coward]

I want to congratulate BigBuckHunter, for being a presumptuous ass. We can only hope that he go away, and that a someone with a shred of human decency and who doesn't make such assumptions will replace him.

Re:Congratulations!

[gstoddart]

The sad thing is, I don't think this is limited to certain hospitals ... their core competency is health care, and the fact that IT in hospitals has been underfunded or badly done for years isn't exactly news.

We've been hearing these same stories for years now.

Yes, brilliant, let's hope hospitals go out of business so we can waste money starting from scratch, that will totally be efficient.

Re:Congratulations!

[Anonymous Coward]

Gotta blame someone. The victim seems about as good a choice as any.

Who else you going to blame? Trump? Global warming?

Re:Congratulations!

[Anonymous Coward]

There is plenty of blame to go around and Methodist Hospital deserves its fair share. Primary blame goes to the hackers, some goes to the OS vendors, the email vendors, etc... Some goes to the users who probably clicked on something they shouldn't, and some certainly goes to the hospital.

If a victim is a victim only because they are a juicy target then they don't deserve blame. When a victim is a company that should have done a better job protecting themselves then they do deserve a portion.

Re: Congratulations!

[Type44Q]

their core competency is health care

I have yet to observe a hospital that this actually applies to.

Re:Congratulations!

[Anonymous Coward]

Well, don't stop there. There's really no reason why electronic health records should have been mandated in the first place.

Most hospitals use a handful of privately-developed and maintained systems also, which makes problems with security worse, because there's only a handful of security systems malicious infiltrators need to worry about.

It used to be that hospitals had control over their own records system, but now that's not the case anymore. Maybe open source will help, but I'm not holding my breath (not because of open source, but because of the medical system).

Government regulation and a culture of rigid hierarchy is driving health care costs through the roof. No one talks about this, which is at the core of increases in health care costs; it's always assumed that more regulation is better. So what we're left with is overpriced nonsense.

Electronic health records systems are no exception. The mandates left hospitals vulnerable to corporations taking advantage of their situation, and huge record system implementation costs. These security problems are the next step.

The sad thing is this probably isn't even Methodist Hospital's fault. If they're anything like other hospitals, they were probably dragged into this by the government; it probably cost 1.5-2x as much money as originally budgeted; and they probably outsourced their IT at least in part. I could be totally wrong about this, but that's a totally typical scenario.

Re:Congratulations!

[HumanWiki]

I hope you understand that it's not always the IT Administration that causes this, right? Many, many. many times it's the non-IT business units that demand we DONT put prevention in place because it will make them have 2 more steps to log in, can't save anywhere they want w/o elevating their status, can't just plug any old USB device in to their PCs, they have to change their passwords every 30 days and can't be one of their last 6, they demand to have YouTube or Facewebs or whatnot, the execs NEED to have access to their home DVRs and Home Automation systems so we have to poke firewall holes and install some insecure version of some remote control application.... Or... We're not allowed to partition out network segments because when Jim Bob needs that 1 file, on that 1 server, those 3 times a year and can't wait an extra 20m to have the access granted, he whines to his boss to yells at my boss's boss and I then have to put a permanent unlock in place. Then his buddy wants a similar deal for another file on a different server. Or... We don't like this version of MDM on our personal phones and don't think you IT people need access to them.. It's out personal phone, what business of yours is it if I download some nasty files at home and then plug my phone in to my work PC or put it on the internal WiFi network? It's my personal phone.. You don't need to know what I do with it. No.. Truly it's the IT Administration that's always at fault because we just sit around doing nothing all day... H*ll, I know I pretty much have my Firewall in Porn Star mode... It'll take it through whatever hole you find.

Re:Congratulations!

[Anonymous Coward]

The Criminals are always 100% at fault.

However, you have to expect people that deserve to be killed to act like this.

Methodist should have prepared for this garbage to act like garbage.

Sad state of affairs.

Re: Congratulations!

[Anonymous Coward]

That's a stupid argument! That's like saying banks shouldnt lock any doors because people shouldn't commit crimes/theft.

Re:Congratulations!

[Sir_Eptishous]

I hope you understand that it's not always the IT Administration that causes this, right? Many, many. many times it's the non-IT business units that demand we DONT put prevention in place because it will make them have 2 more steps to log in, can't save anywhere they want w/o elevating their status, can't just plug any old USB device in to their PCs, they have to change their passwords every 30 days and can't be one of their last 6, they demand to have YouTube or Facewebs or whatnot, the execs NEED to have access to their home DVRs and Home Automation systems so we have to poke firewall holes and install some insecure version of some remote control application....

You're right on the money brother.

The thing many forget is that security and securing the network, SAN, virtual infrastructure, servers, workstations, etc, etc is actually pretty low on the priority list for "real world" admins out there. Were too busy "taking care of business", you know, keeping things running smoothly to ensure profits, etc. Unfortunately many things admins do to increase security will annoy or slow down someone or something, and many times are inevitably undone so that little jimmy from marketing can get to those pdfs easier, etc.

Re:Congratulations!

[Grishnakh]

No, hackers shouldn't get any blame at all. The hackers were doing their jobs, and they did them well as you can see by their success.

It was the IT people at the hospital who failed. Their *job* was to prevent this kind of thing, and they failed miserably.

Malicious hackers are going to exist whether you like it or not, and trying to "blame" them makes as much sense as blaming a hurricane for the damage it does. There's nothing productive about that; you're not going to convince hurricanes to not happen or to take different courses by talking to them and trying to convince them they're wrong. The same goes for career criminals. The only thing you can do is try to reduce your risk from hurricanes and criminals, by designing and building better buildings, not building next to the shore in a hurricane-prone area, and by using good IT security practices.

Re: Congratulations!

[aaarrrgggh]

Clearly; their core competency is in invoicing.

Re:Congratulations!

[Anonymous Coward]

By that logic those nut jobs that triggered the bombs in Brussels should get none of the blame. They were terrorist doing there job! Complete and utter BS.

Of course the hackers should get the majority of the blame. Criminals doing their job don't get any credit for doing their job.

Re:Congratulations!

[CheapEngineer]

If she hadn't worn that damn short skirt

Re:Congratulations!

[Anonymous Coward]

You sound like the PR rep for the hackers. And your statement about the IT department failing miserably is quite an indictment. Are you aware of the details of this particular attack? Do you think your superior skills could have prevented this hack or any similar attack because you are master of the universe when it comes to computer security? By your logic every single computer system that has ever been successfully hacked proves that all IT professionals are idiots and if they just gave you a call their problems would have never occurred.

Re:Congratulations!

[l0n3s0m3phr34k]

Not only did the hospital IT fail, there are federal policies that are made to help protect against this. A hospital should be doing a risk assessment annually, and is required to document why specific remediation weren't followed per HIPAA. 164.306 is very clear on this all; even the policies that are "addressable" still require them to "Document why it would not be reasonable and appropriate to implement the implementation specification;"

They could be hit with "civil money penalties" of "$50,000 for each violation", and this can be " a separate violation occurs each day the covered entity or business associate is in violation of the provision. " The ONLY thing that might save the hospital is that PHI hasn't actually been exposed. Source

Re: Congratulations!

[Anonymous Coward]

Come to Canada. Don't get me wrong we aren't perfect by a long shot but it isn't all about the bill if you can say "hoser" with a straight face and know what the last hockey game score is, eh.

Actually I'd bet Canadian hospital IT is somewhat safer because most of the machines are older.

Re:Congratulations!

[HiThere]

Sorry, but NO!!!
There exist, or used to exist, hackers who didn't deserve any blame. The "cookie monster" hack, e.g., was a warning and didn't do any harm. The implementers of that were hackers who didn't secerve any blame. I don't quite remember the context, but the Morris Worm was, IIRC, an edge case. IIRC he didn't intend any harm, but he made a programming mistake that let the worm get out of control. Sorry, blame is deserved, though not in huge amounts.

The distinction is between warnings and damage. And, or course, intention...which doesn't change the culpability, but may change the deserved amount of blame.

Malicious hackers are going to exist, but they deserve to be blamed for the damage they do. Even unintentional damage, though in that case proving that it was unintentional would be quite a feat.

And guess what? There *IS* no perfect security. NONE! Even instantaneous writes to a WORM aren't perfect security, and are ghastly expensive to run and store, much less to retrieve from. And all storage media have a certain risk of failure.

That said, I agree that most computer systems don't pay sufficient attention to system security. But there's always a trade off, you invest your time and effort where it seems worthwhile to you. And nobody can predict things perfectly. Computer people tend to be aware of computer security, but don't pay enough attention to the service degradation that enhanced security can sometimes cause. And often make silly choices, or choices that don't consider all the effects. Like requiring passwords to be changed every week to something impossible to memorize, and not expecting post-it notes to appear on monitors.

Re:Congratulations!

[wyHunter]

The reason why we have EMRs is because companies like McKesson lobbied to have them in the bill. They make a lot of money from medical software. A LOT of it.

Re:Congratulations!

[david_thornley]

Weekend before last, I went to an urgent care center because I was having serious problems and it was a weekend. It wasn't anywhere near my normal clinic. The doctor I saw had full information on me, including my drug allergies, so she knew to find something that didn't have sulfa in it. I went to my regular doctor the next day, since I like to keep him in the loop. He looked at my test results and other things, and gave me some additional instructions.

Without some sort of electronic record system, what would have happened? The doctor at the urgent care center would've asked about drug allergies, but there's no guarantee I'll be conscious when hauled into such a situation. Somebody would have had to move a paper copy of my test results somewhere my regular doctor could see it, and it wouldn't have happened fast enough.

I really do benefit from electronic medical records.

Re:Congratulations!

[Grishnakh]

Um, you're confusing "the hackers" with "all hackers".

I was only talking about blaming the hackers who were directly responsible for this particular incident. I'm not talking about all hackers (which is a pretty vague term BTW) for all history. Maybe I wasn't clear, and should have used the term "these hackers".

But blaming these hackers I think is counter-productive. It's as pointless as blaming "the Chinese hackers" for the OPM data breech last year. They're doing their jobs. Blaming them is pointless, because you're making a moral judgment that they shouldn't do what they did. They disagree. Esp. for the Chinese, where they're doing the right thing by hacking into US government computers. If you disagree, then you have to also denounce the US government for employing hackers who do the same thing to other nations. There is no moral high ground anywhere here.

It's very simple: if you don't want to be hacked, then improve your security. Not using Windows is a good, first, easy step. There's no such thing as ransomware for Linux systems.

Re:Congratulations!

[Grishnakh]

By that logic, when a wartime enemy drops bombs on your city, you shouldn't bother with any AAA defenses to keep their bombers away, you should just sit around and let yourself be bombed, and then just talk about how bad the bombers are for bombing you.

Re:Congratulations!

[HiThere]

You are mixing two categories of things. Some are unequivocally stupid, but done anyway. Like demands to access sites using flash or more than basic javascript. (I'm dubious about ANY site that uses javascript, including this one.) Especially is it uses javascript to invoke sites not a part of the host domain. Others, like demanding passwords be changed frequently and to something non-memorable are stupid, and lead to their own category of security hazards.

Re: Congratulations!

[Anonymous Coward]

In the previous decades we wore bracelets with drug allergies.

Re: Congratulations!

[david_thornley]

There's a lot more people with drug allergies than I've seen wearing bracelets, and that's from before electronic records. Moreover, the fact that I have a mild shellfish allergy turned out to be relevant for treatment of my heart attack.

And...

[friesofdoom]

Those employees better not be thinking of running an ad-blocker after this! Those heathens!

only 4 bitcoin?

[Anonymous Coward]

Why such a low ransom for such a high risk?
I bet the hospital has more $ in its petty cash drawer...

Perhaps this is a proof-of-concept run for the attackers...

Re:only 4 bitcoin?

[alphatel]

Why such a low ransom for such a high risk? I bet the hospital has more $ in its petty cash drawer...

Perhaps this is a proof-of-concept run for the attackers...

They just don't know what they have. Once they see the publicity guaranteed this goes up to 400 BTC in a heartbeat.

Re:only 4 bitcoin?

[bill_mcgonigle]

Why such a low ransom for such a high risk?
I bet the hospital has more $ in its petty cash drawer...

And who benefits from all this drama? They could have been back up and running before they went to the press. How does the hospital not suffer from this PR (like that they have no network isolation, perimeter security, or backups)? Something else is going on.

Re:only 4 bitcoin?

[khasim]

There is no real risk for the attackers.

And, if the ransom is that low, there is more incentive to just pay it rather than spend the time/money to recover everything themselves (and miss some things and have to pay it anyway).

The attackers are in this for the money. One HUGE score would mean more incentive for politicians / police / FBI / etc to try to find them.

A thousand smaller scores mean that this is just-something-that-happens and we-should-get-used-to-it. And the money keeps rolling in.

Re:only 4 bitcoin?

[Anonymous Coward]

Because Locky is a shitty piece of malware.

1 user got it at my work, it hardly damaged any files (way less than CryptoLocker). It supposedly looks for network shares but failed miserably.

It also starts as a JS script that should then download some programs but that all failed. Could be related to our firewall though.

Either way deleted the encrypted files, scolded the user who opened the fake invoice email, then zip attachment, then ran the .JS file.

Then blocked .JS files from running.

Re:only 4 bitcoin?

[tnk1]

Not necessarily. These criminals want to provide good "service" to their "customers". If it gets out that this sort of extortion payment has no effect on getting back their data, no one will pay it and they will lose their "business".

That doesn't prevent "me too" organizations from walking in and hacking them as well, of course.

And be aware that these organizations are often extremely professional these days, using very sophisticated spear phishing attacks and other means. It is increasingly less true that this is simply due to someone clicking on a link to a viagra spam email. They're making very concerted efforts to learn organizational charts and watching emails to ensure that they send their emails as people who you'd usually trust to send you a link.

Here's a long read about how these pro hacker outfits are using spear phishing and sophisticated attacks that could be pretty scary even to a place that takes security fairly seriously. If they fell prey to something like that, they wouldn't have to be idiots.

http://www.infoworld.com/artic...

Re:only 4 bitcoin?

[Anonymous Coward]

Well... if you are going to extort the shit out of someone and you know you have them by the balls you can start small, no point in asking for the bank from the get go and have them outright refuse. They pony up the chump-change and instead of keys they will get asked for more, probably.

Re:only 4 bitcoin?

[tnk1]

Yes. If they're going to pay, they want to do so nice and quiet-like. Otherwise, they're going to have their shit locked up again by some other group the day after they unlock it.

For my part, I do hope they have some clever scheme behind the scenes here, because this PR is a bad idea for them in their predicament. It's not like their security has been fixed this quickly.

Re:only 4 bitcoin?

[fnj]

Yes. However ... the amount of ransom demanded should have no relation to the sentence that should be applied to the scum-suckers responsible. There should be no leeway for laughing it all off if the ransom is deemed a "minor" amount. Kidnapping is equally reprehensible whether you demand $1 million or $10.

Re:only 4 bitcoin?

[ArchieBunker]

The ransom is the same for everyone no matter who is infected. The emails I've seen with this attachment are coming out of Iran and Pakistan.

Re:only 4 bitcoin?

[Anonymous Coward]

They weren't targeted. Some doofus just clicked on the same trojan horse email attachment that you probably received as well, but due to the lax IT configuration in hospitals, it takes out the entire network, not just the personal files on your laptop. It's an epidemic, not a sting. You losing the pictures of your children when they were young isn't news, but when a hospital loses patient files because they were shared on site-wide writable network shares, then the headline is "hackers infiltrated our systems". When hospitals in Germany fell victim to Locky, the news was full of "hackers attacked hospital" too. It's just to save face. Yesterday, weeks after the dramatic headline news, there was a tiny article in the regional newspaper which came to the same conclusion, that the hospitals were just random victims of the same attack that is tried against everybody.

Re:only 4 bitcoin?

[Hotawa Hawk-eye]

It's in the spirit of "We are prepared to bring this to court. However, if you're willing to settle for $100 per file we are accusing you of sharing, we are willing to consider this matter resolved."

As an attacker, it makes sense that you would want to ask for a large enough amount of money that you actually make money, but not enough that it's worth it for your target to fight back. In this case, it seems like that "sweet spot" is 4 bitcoin (or about $1600 dollars) probably precisely because it's "petty cash" to the hospital.

Re:only 4 bitcoin?

[Okian Warrior]

There is no real risk for the attackers.

Slashdot had an earlier story about a guy being extradited to the US for doing what every millisecond trading system does.

Yet when actual people are affected, the government doesn't seem to care.

I can draw a parallel to swatting, where the government has to respond by going overboard "just in case" the report turns out to be real, but doesn't bother to investigate the false reports and turns a blind eye to the perpetrators, even when the swatting ends in tragedy.

Re:only 4 bitcoin?

[Scragglykat]

Indeed. I mean, the last time I had a Big Mac Attack, I was shocked at the price of Big Macs... but this... a Big Hack Attack is not nearly as pricey as I would have imagined it to be.

Re:only 4 bitcoin?

[david_thornley]

The two cases have little in common. In the case of the guy in the UK, he was identified (and did some things critically different from high-frequency traders). The only lack of risk for this attacker is that it might be difficult to identify and convict the guy, since if it can be pinned on someone it's a pretty serious felony.

Re:only 4 bitcoin?

[Anonymous Coward]

If someone dies they will be prosecuted to the full extent of the law aka life in prison...

$1.6K is like what half a day in the ER chump chan

[Joe_Dragon]

$1.6K is like what half a day in the ER chump change for them.

Dont worry

[Anonymous Coward]

When the FBI has everything backdoored, we will be safe.

Choises, the good the bad and the ugly

[Anonymous Coward]

The option of proper backups or better security seems to be in the past and remaining options are to pay up or figure out to get by without the data. For an hospital ponying up 4k$ or losing tons of important data shouldn't be much of a choice at all, most important step is to understand that coughing up the cash is the only hope of getting the data back.

Re:Choises, the good the bad and the ugly

[Anonymous Coward]

Duh, 4B or 1.6k$ anyway, peanuts compared to patient data, but the hackers better hope they are never caught, for that little money its an awful lot of prison time

Re:Choises, the good the bad and the ugly

[Etherwalk]

Duh, 4B or 1.6k$ anyway, peanuts compared to patient data, but the hackers better hope they are never caught, for that little money its an awful lot of prison time

Forget prison time, they're not going to ever be able to get particularly good medical care.

Re:Choises, the good the bad and the ugly

[aaarrrgggh]

The saved recovery time compared to restoring from tape would make it worthwhile for a number of organizations-- which is what becomes very scary for the long-term prospects of this type of attack. Have a low enough ransom and it can last forever.

Backups?

[Anonymous Coward]

Backups people, it's not hard using current technology and you get extra points for verifying those backups once you've done them. After all, a set of blank tapes in the safe are no good to man nor beast. This is a damn hospital with people's lives at stake and you'd think that they would take more care with their date!

Re:Backups?

[fnj]

Do they have any?

Even if they do, if a whole lot of data has been lost from on-line storage, it would cost a whole lot more than $1600 in time and labor to restore it.

Re:Backups?

[david_thornley]

Apparently, they did restore from backups. It's still a whole lot of disruption, but it's recoverable.

the answer

[Anonymous Coward]

The people who sent the ransomware, and their families should be rounded up and tortured , and killed. I'm actually quite serious. It will send a message to those who think that they can get away with this crap.

Re:the answer

[religionofpeas]

Good idea. Now if you can please point them out.

Re:the answer

[Anonymous Coward]

Little did you know, but it was your brother-in-law Jerried that did this.

Re: the answer

[Type44Q]

The people who sent the ransomware, and their families should be rounded up and tortured , and killed

"...and their families?!" This person, and whatever sick fuck modded them up, need a major ass-kicking.

Re:the answer

[mongothesecond]

I'll get the appropriate corporate military asset in motion.

Re:the answer

[Anonymous Coward]

Flamebait.

No, it is not ok to punish innocent people because they happen to be related to guilty people.

And no, it is not ok to use torture as punishment.

And it wouldn't matter anyway, because it is a well-known fact of sociology that the likelihood of getting caught is the primary deterrent to crime; severity of punishment has relatively small impact by comparison.

Re:the answer

[Anonymous Coward]

Ah, it looks like Microsoft has let Tay loose on slashdot.

Re: the answer

[Anonymous Coward]

Is that you Trump?

Keep on your toes. Ransomware on huge upswing

[Anonymous Coward]

I've seen huge upswings in locky and other ransomware hitting the email gateway since the first. Literal 30x upswing.

Lots of the locky infected messages are mimicking fax gateways and network-to-email scanner/mfp devices. The others are the usual tracking, invoice, tax, payment, etc social engineering schemes.

Via email, most use executables in zip files.

I've banned zip file attachment just to cut down on the load.

I've heard reports that there are some really aggressive targeting via ad networks too.

Backup, backup, and backup some more. Then audit. Then do DR drills. Then Audit the DR drills.

Your user's endpoints aren't secure. Locky and company work inside a user's context and do not need admin privs. Backup is the only thing that will save you.

Re:Keep on your toes. Ransomware on huge upswing

[Anonymous Coward]

I've banned zip file attachment just to cut down on the load.

What admin's job wouldn't be complete if they weren't inventing new ways to stop their company from getting things done instead of properly administering their network? There are a lot of ways that you could secure your email without the ham-fisted (and ineffective) file blocking. Instead, your users are going to be renaming their files things like application.pdf with instructions to rename it to zip, so all you've achieved is making another hurdle for employees to jump before they can do their job. Now they see IT as something to work around rather than a tool.

And IT people wonder why they're the first out the door when the budget gets lean.

Re:Keep on your toes. Ransomware on huge upswing

[Anonymous Coward]

Top advice.

However, I would think executable whitelists would go a long way to mitigating these risks.

Or at the very least, they force the malware to implement a privilege-escalation exploit first.

Re:Keep on your toes. Ransomware on huge upswing

[OhPlz]

Just send me the file to my Yahoo email address, the corporate one is a PITA.

Re:Keep on your toes. Ransomware on huge upswing

[Anonymous Coward]

Or simply start your migration plan away from Windows and leave all this nonsense behind.

Re:Keep on your toes. Ransomware on huge upswing

[Anonymous Coward]

I don't know about you, but my users listen to me and respect my opinions.

They see companies and nonprofits they work with get hit with ransomware and they're quite happy to deal with temporary work-arounds. If you want to see how "stop things from getting done" is just visit any outfit that's been hit and has their fileserver shredded. (Oh shit, did I turn on shadow copies? When's the last time I checked the backups? Why did that user have write access to all these folders and shares?)

It doesn't really matter anyway. Most companies use a 3rd party service to serve up serious attachments anyway. (Link to a portal, temporary access code, download via https) Email transport is flakey. Lots of gateways and MTAs have severe attachment restriction sizes. SMTP is old and there is no guarantee of delivery.

Re:Keep on your toes. Ransomware on huge upswing

[nuckfuts]

p>Your user's endpoints aren't secure. Locky and company work inside a user's context and do not need admin privs. Backup is the only thing that will save you.

THIS is absolutely correct. I have personally helped mop up after ransomware incidents on four occasions. Three of them were at the same company. You can moan all you want about users being clueless, but spear-phishing and similar tactics are becoming increasingly sophisticated and it is extremely hard to prevent ransomware attacks in some environments.

Re:Keep on your toes. Ransomware on huge upswing

[HiThere]

Linux/Unix/Mac prevent some classes of attack, but not ones where the executable is started by the browser and the user has write permission.

Seriously, an earlier report said this malware depended on running javascript, and that can be done on nearly any machine. The only exceptions I can think of are some users who either turn off javascript execution or use an ad blocker and some servers that don't have an browser installed.

There might be a problem with...

[anegg]

electronic medical records.

If this turns out to be a typical outcome of medical facility IT administration, then electronic medical records might not be such a good idea, at least not without adjustments to how the records are hosted.

Just like "critical infrastructure" should not be connected to the Internet, it seems medical facility records infrastructure needs to be separate as well. Perhaps this is a general architectural strategy that should be implemented wherever organizations process sensitive information - one level of infrastructure for general purpose communications and Internet access, another (separate) level of infrastructure for the sensitive information, with an acceptance of the higher cost of maintaining the proper separation. One big mashup appears to have some significant risks.

Re:There might be a problem with...

[Anonymous Coward]

> Just like "critical infrastructure" should not be connected to the Internet, ...

At my hospital, we, of course like most, attempt to use Microsoft's attempt at a server OS, so we are not very secure. That network is not connected to the Internet, as you suggested, but we've still had the servers partially wiped twice. The first time was a couple of years ago when a nurse was using her modem on her Windows piece of garbage desktop to connect to AOL. The modem was supposed to be for sending FAXes. We got infected and a bunch of files on the Windows servers were wiped. The next time was when an employee plugged an infected USB key into a Windows desktop. We physically disconnect (read smash) every USB port besides the keyboard and mouse ports. To work around that, the nurse plugged a USB hub into the computer then her mouse and USB key into the hub. So, even an airgap didn't help. You need to run secure systems. Being lax because something isn't connected to the Internet will get you into trouble.

Re:There might be a problem with...

[Anonymous Coward]

Bingo.

As this story appeared I was sending off an email to yet another IT guy at a hospital that has no concept of how networks, firewalls or SSL/TLS works and is apparently incapable of operating Google to interpret simple error messages. Yet this is the monkey responsible for deploying a electronic medical records system for the facility. The technical staff in these places are frequently just IT poseurs that are intellectually incapable of securing anything more sophisticated than a seat belt.

Re: There might be a problem with...

[Anonymous Coward]

Even a ten finger interface won't protect you if you run Windows.

Re: There might be a problem with...

[Anonymous Coward]

Even a ten finger interface won't protect you if you run Windows.

I think it's been twenty years since I've seen that phrase. It meant to have two terminals and to literally have to retype information displayed on one screen into the other system.

You're right about it not protecting you completely. We have air-gapped (literally on different physical networks) Windows desktops and require users to enter information manually, but still about once a year someone still gets a virus. We have no CD drives and disable USB keys with a group policy. We still have no clue as to how that could possibly happen.

Re: There might be a problem with...

[HiThere]

Microsoft upgrades?

Re:There might be a problem with...

[dmr001]

Good luck getting EMR applications disconnected from the Internet. Every institution I know of has their EMR available behind a firewall, accessible visa Citrix. So we can work on our charts after putting the kids to bed (not uncommon for that to be a 1-2 hour task) and covering our partners during overnight call and answering emergency calls when out of town. And for seeing patients in nursing homes, and home visits (they still happen!). And our EMR's exchange information with one another, so if you go to hospital X in my town and then show up in office Y to follow up with your regular provider we can tell what happened Or, I dunno, I suppose you could keep us (physicians) locked up in the office for 24 hours 2-3 days a week and for 14 hours (instead of 12) on non-call days. I know, boo hoo hoo, but I think this horse has left the barn.

Re:$1.6K is like what half a day in the ER chump c

[Anonymous Coward]

literally a taste of their own medicine!

Backups?

[rrohbeck]

Do they have any?

Disaster recovery time

[grasshoppa]

Good thing a big fancy place like a hospital, you know, with all that juicy mission critical data, has a solid and well tested disaster recovery plan, right?

Right?

hahahaahhaah

Event Sourced FTW

[Anonymous Coward]

Immutable, append-only event streams cannot be crypto-lockered away. Bonus: also trivial to send securely to an offsite location for additional secure archiving.

can't find good (Methodist) help...

[Anonymous Coward]

Methodists obviously don't have good computer security because they don't smoke enough pot.

Re: can't find good (Methodist) help...

[Anonymous Coward]

[Knock knock knock] Dave's not here man!

Re:$1.6K is like what half a day in the ER chump c

[DCFusor]

You're being too kind. Most of a decade ago 2 hours in ER cost me way over $4k - and that's after months of negotiation and paying some cash under the table.

Dirty Russians!

[Anonymous Coward]

Not that they are behind this.

I seem to remember. . .

[smooth wombat]

people on here cackling about the incompetence of government workers in regards to the iPhone issue (no MDM software installed), the IRS hack and a few other items.

Considering the near daily reports of private industry being hacked or compromised, it looks like the government has some work to do if it wants to run its operations like private industry does as some say should be done.

When did AV became so useless ?

[herve_masson]

So, a stupid macro virus open thousand files on a PC at full speed, delete them, and create another one with .locky extension. No AV software has he capability to detect something unusual ? dangerous ? Suspect ? (I wonder how AV waste my CPU and disk IOs so badly...)

This locky shit has been around for a few month, and no AV can do anything about it ?? seriously ? They did not even bother changing the .locky file extension...

Re:When did AV became so useless ?

[Anonymous Coward]

They were ALWAYS useless. That is why there are so many viruses out there. Always have been.

Re:When did AV became so useless ?

[SumDog]

Since the past decade. Enumerating viruses is useless. There are too many. Machine learning can be fooled and has high false positive rates. A French researcher at Kiwicon in 2014 showed that the parsers most AVs use run as the System user. He was able to use broken JPEGs and PDFs against the parser and get code execution as the System users (read: you don't even have to open the file. The virus scanner ran the executable code!)

Active virus scanners are totally worthless today and actually increase the attack vectors to machines. Passive virus scanners are about equally as useless.

Re:When did AV became so useless ?

[Anonymous Coward]

Ransomware has upended the usual AV paradigm.

Previously viruses were most interested in silent privilege escalation (getting admin/root), and hiding while silently using the system as a botnet or to steal information (bank, cc details)

Ransomeware does not need to get root or admin (but it will try to increase the damage it can do). It will run as the user and corrupt every file it can get at that that user has access too. Then, instead of hiding, it makes itself known so it can demand ransom.

No AV can protect against this. Only strict code whit listing and backups can stop it. The ability to run arbitrary code is dangerous to untrained users.

Funny how "walled garden" computing systems offer both auotomated off-site backup and safe, whitelisted code both backed up with cryptographic security. Ipads are popular because of what they can't do. They can't run viruses because they arent' signed from the app store repository and they can't let you forget your backup because your data is hosted elsewhere.

Re:When did AV became so useless ?

[nuckfuts]

Kaspersky Endpoint Security includes a component named System Watch that can detect and stop ransomware behaviour, but that component doesn't get installed on server versions of Windows yet so it's no good for Remote Desktop servers. Not sure about other brands of AV.

Re:When did AV became so useless ?

[HiThere]

Not so. Back in the days of the Mac II and MSWind95 there were virus scanners that were quite useful. Of course, the free ones were as good as the commercial ones...

Re:When did AV became so useless ?

[herve_masson]

Sure, the goold old technique that searches for viruses signature became uneffective long time ago.

Monitoring the filesystem activity is something I can imagine quite easily. This is not rocket science. On my PC, I don't know many program that need to open and write a lot of files, and I would not mind to be warned against them, every time. I may loose the first dozen files before the detection program fires the "unusual activity" alert, but that would at least prevent the program to destroy the next thousands files.

At the bare minimum, AV should have trapped a program writing .locky files since it's such a well known devastating virus for so long. Not rocket science either...

Re:When did AV became so useless ?

[drinkypoo]

Monitoring the filesystem activity is something I can imagine quite easily.

Easy to imagine, difficult to implement. Sadly, Linux has the functionality to truly prevent unauthorized technology but most distributions don't even use it. I refer, of course, to selinux. It's a super PITA to maintain, so people don't do it. Someone made an effort at an application to automagically create profiles once, but it has languished and no longer functions.

lessons have not been learned

[Anonymous Coward]

Is there a fuckin' echo in here?? AIRGAP THE FUCKING NETWORKS!!

[Filter error: Don't use so many caps. It's like YELLING.]

Pay them off, get the key, decrypt, and THEN...

[Anonymous Coward]

Tell everyone far and wide that the scammers took your money and REFUSED to give the encryption key, and that you had to restore everything from old backups.

Ruin the assholes' business model, since no one is going to pay if they are known to take the ransom and skip out.

The one with Linda Hamilton

[Impy the Impiuos Imp]

hackers infiltrated its computer network, encrypted files and are now holding the data hostage

There's a meat slicer from the beginning of the original Children of the Corn with their name on it.

Which victim?

[s.petry]

Security people have for decades said "STOP PUTTING EVERYTHING ON THE INTERNET!". And yet we have just about everything including public infrastructure on the Internet. The lies about "why" are very consistent. "Saves money" is probably the most popular, yet who is seeing that savings? Has the cost for you improved, or are the savings are going to execs and bureaucrats? You (Consumer) are the most at risk due to these policy decisions.

A specific class of people saying "do it anyway" does not mean it should be done, it means that people should be better than lemmings. Eventually it will happen, because it will have to happen.

While I certainly feel sorry for anyone who is personally harmed by losing data housed on these systems, I also hope it serves as a wake up call. "Centralized" is not usually the best option.

Blaming the victim, if you claim the Hospital is the victim, is actually appropriate. Blaming the person who's identity may be stolen or trashed was not being done, and those are the real victims here.

Re:Which victim?

[Anonymous Coward]

I have to put my microwave on the interweb because The Facebook told me to. Oh and ZDNet

Re:Which victim?

[duke_cheetah2003]

Security people have for decades said "STOP PUTTING EVERYTHING ON THE INTERNET!". And yet we have just about everything including public infrastructure on the Internet. The lies about "why" are very consistent. "Saves money" is probably the most popular, yet who is seeing that savings? Has the cost for you improved, or are the savings are going to execs and bureaucrats? You (Consumer) are the most at risk due to these policy decisions.

This. Not everything needs to be connected to the internet. There should be designated terminals that have internet access which are isolated from your organizations intranet. I personally blame the IT staff for this. Mission critical systems need to be 100% isolated from the internet, period, end of discussion. It's just too big of a risk in this day and age.

Re:Which victim?

[fnj]

Blaming the victim, if you claim the Hospital is the victim, is actually appropriate.

Some blame for recklessness/incompetence is due, but it is distinctly secondary to the blame for the actual CRIME. It in no way diminishes the culpability of the scum-sucker who ACTUALLY DID THE DAMAGE.

Re:Which victim?

[Anonymous Coward]

I know CIO's need buzzwords to impress the other C-level exec's, but seriously, it's time to take away all their white paper privileges.

We should never blame the victim, but yeah, the cloud is hella-stupid.

Re:Which victim?

[l0n3s0m3phr34k]

Many "medical devices" in hospitals actually require internet connections and run ancient OSes like Win2k. It takes years to write new code, as everything has to go through FDA approval. Of course that's really no excuse to use vlans, proxies, IDS, and other mitigation techniques for this equipment...but until hospitals are hit with $50,000 per violation per day their just going to keep ignoring it all.

Re:Which victim?

[wyHunter]

I agree with you. There is too much on the internet. I'd happily pay more for things if there wasn't so much out there. Having said that, the cost of SOME things IS way less than it used to be - but that's mostly because of outsourcing to low cost countries with slave labor and questionable environmental practices.

Re:Which victim?

[Thor Ablestar]

Your Chief Doctor should sign an order that this medical device should be properly backed-up by the competent sysadmin (you), that the IT dept receives the finances to do so and that any violator pays from his own pocket.

Re:Which victim?

[l0n3s0m3phr34k]

Something like this is needed; until actual "people in charge" have to pay these fines out of their own pocket, these headlines will just repeat. As long as they can hide "behind the corporate veil" and put profits over customers...and hospitals need to be held to higher standards. What if the info that was encrypted was medical files that was needed for life-saving operations? I hate to say this, but maybe if some innocent patient actually died because of these hacks then we, as a civilization, might actually do something about it.

Obama's back door

[I'm not god any more]

How come these hackers aren't using proper encryption with a government back door?

Are they criminals or something?

Re:$1.6K is like what half a day in the ER chump c

[Anonymous Coward]

Who knows? Pricing for hospital services is all over the place and not public. That may only buy a couple of hours in one hospital's ER while at another it may pay for an entire day.

It's absurd. Imagine if all restaurants did the the same thing. And it was "Chef's Choice" each time. Now, the chef is the expert and can make some delicious meals, but you never know what food you'll be served and you never know how much it's going to cost.

If someone dies ...

[jbeaupre]

If someone dies in the hospital and it can be traced to critical files being unavailable, the malware owners could be charged with murder.

https://en.wikipedia.org/wiki/...

But not in Kentucky.

https://en.wikipedia.org/wiki/...

Re:If someone dies ...

[ArchieBunker]

Oh yeah real scary for the people in Russia or Latvia writing this stuff.

Re:If someone dies ...

[Anonymous Coward]

Oh yeah real scary for the people in Russia or Latvia writing this stuff.

Russia, yeah, few fucks would be given. Latvia has an extradition treaty with the U.S. (originally signed in 1923!) and, coincidentally, a sizeable Russian ethnic minority left over from the Soviet Union days, which is venomously hated by the govt. and is, I suspect, a fertile cybercriminal breeding pool.

Re:If someone dies ...

[pj2541]

Your signature seems quite odd on a post to this thread. Aren't the 'hackers' in this case obtaining revenue by coercion?

Re:If someone dies ...

[Anonymous Coward]

Ever heard of extradition? Some dude just got extradited for NASDAQ trading.

Re:If someone dies ...

[Anonymous Coward]

If someone dies in the hospital and it can be traced to critical files being unavailable, the malware owners could be charged with murder.

No the hospital should be charged for murder for having shit security.

ALL hospitals have shit security.
Pen Tester here...

Re:$1.6K is like what half a day in the ER chump c

[Joe_Dragon]

and then you get a bill in the mail from the runner / server for there own work. (it's not part of the bill you paid at the restaurants)

$1600 is Cheap

[entropy01]

Bad guys are only asking for $1600? Without hesitation they should, pay it, get their shit together, and move on. $1600 is chump change.

Re:$1600 is Cheap

[oic0]

Lord knows they charge everyone who walks in the door that much just to breathe their air.

Re:$1.6K is like what half a day in the ER chump c

[fnj]

I can see you haven't been in an ER for half a day, or know anybody who has.

Hunt him down and kill him

[Anonymous Coward]

I can't think of a rational or moral excuse for letting these people remain on earth, to encourage more. If you don't stop it, it won't stop.

Considering? Drop everything and pay it.

[chispito]

For several years now, every single security analyst, including the FBI (https://securityledger.com/2015/10/fbis-advice-on-cryptolocker-just-pay-the-ransom/) I've come across has said the same thing about crypto-ransomware: pay them.

There is time to be idealistic later. Right now, you're being mugged: Do what you need to survive.

Re:Considering? Drop everything and pay it.

[dbIII]

That's why we can't have nice things.
Too many people are paying the Danegild so we can't get rid of the Dane.

There are LTO-6 drives out there bring the price per GB of backups down to lower than it has ever been so there is no excuse for anyone other than home users or sole traders. Still too much with that capital outlay of the drive? USB drives are cheap if you only need to back up single digits of TB and infinately better than nothing.

Re:$1.6K is like what half a day in the ER chump c

[Joe_Dragon]

well that may be there profit after paying out the staff and buying the drugs.

Logic and Reason, or is that Raisen?

[s.petry]

The fact that there was a crime does not negate or diminish the poor decisions that led up to the crime taking place. Everything is not pure black or pure white. In fact the overwhelming majority of the world is gray. Sure, hold the criminals accountable for their actions. That said you also must hold the actors who presented the opportunity accountable for their actions.

Re:Logic and Reason, or is that Raisen?

[l0n3s0m3phr34k]

Even worse for this "victim" is that the U.S. Department of Health & Human Services has specifically made laws about IT security for organizations like this, and supposedly enforces security. So in this example, it goes beyond "I didn't know" to "I willfully ignored the law that's been on the books for almost two decades".

Welp

[Anonymous Coward]

$1600? At a hospital, that's about the price of of a band-aid and a few Ibuprofen.

FTA

[hercludes]

Ketucky. KET.

No one does security right

[ErichTheRed]

Even the NSA allowed Snowden, a SharePoint administrator working for a contractor, access to some pretty critical data. If they can't properly control access to information, especially given how many tools there are out there to do so, it's not a shocker that private businesses fail to do so also.

The ransomware epidemic illustrates a very good point -- companies still treat their internal networks as 100% trusted. Once a machine is plugged in, there's nothing stopping it from roaming around the interior. This is the main problem -- laptops get taken home, executives demand admin access to the OS, they bring a virus, Trojan or other nasty in, and suddenly everyone has a bad day.

Internal networks should at the very least have separation of critical systems, preferably air-gaps between seriously critical systems. But that's expensive and companies refuse to spend any money on IT.

Not a problem

[Dunbal]

Just revert to the backup. Right?

Locky requires Windows & Office to work ..

[khz6955]

Curious how you failed to mention that Locky requires Windows & Office to work ..

Re:Locky requires Windows & Office to work ..

[StormReaver]

I think it's about time that IT administrators that allow Windows to directly access critical information are held accountable as accomplices to the crime. We are at least a decade beyond the point where there is some type of excuse, even a feeble one, for this kind of negligence.

Re:$1.6K is like what half a day in the ER chump c

[aaarrrgggh]

$1.6K is the cost of an aspirin in the ER.

Management

[Anonymous Coward]

The IT Manager was probably at his pizza parlor making pizzas when this all went down.

Bit Of A Stretch

[Anonymous Coward]

It's a but of a stretch to be saying that hackers infiltrated the network blah blah blah.

A hospital employee opened an email with a Locky file attachment and it then encrypted what that user had access to.

Ransomware sucks donkey dicks. There are various mitigation techniques, some effective, some not so much, and sometimes the effective methods are too much of an impediment to do company work. But, a decent administrator should have backups.

The effective recovery from ransomware is restoring from backup. Paying these cock gobblers is just encouraging more of them.

Re:$1.6K is like what half a day in the ER chump c

[Dutch Gun]

Of course it's chump change, since even most individuals could actually afford that payment if they really needed to. What they're considering is either the negative publicity paying off criminals would have on their organization, or perhaps the moral implications of paying off criminals.

Re:$1.6K is like what half a day in the ER chump c

[david_thornley]

Joe_Dragon may not be from the US. ERs in other countries often charge far less than what the US charges.

No reason for so much to be attached to the wan

[Anonymous Coward]

Just silly. Every single iota of your LAN does not need to be on the WAN Those days are long gone.

Hackers? Seriously?

[Anonymous Coward]

Maybe it's just me, but as an I.T. security guy, this sounds like a shoddy admin had no backups when common encrypting malware hit. I'd be stunned if this were an 'active hack'.

Poorly done

[s.petry]

What gets overlooked, and I'll argue intentionally, is that people are not being held accountable for their actions. This is the flaw I constantly see in discussions regarding "Social Justice". You just attempted to do just that, using a very odd example. Given your example, the secret service would be blamed if the President got shot. And they should be blamed. Numerous people assigned to Presidential detail failed if that was to happen. Bob gets paid to take a bullet for the President, and he hid when trouble started. Jerry neglected email about a shooter, Beth ignored the metal detector because that lady just looked nice, etc.. etc...

Sure, the person who pulled the trigger is a criminal. The other people don't get a free pass at negligence and/or bad decisions because of the crime.

One more example: Say you are in a public park and a big guy sits across from you on a different bench. You start tossing pebbles and they land close to his feet. He gives you a look that lets you know he's not happy, but you continue to toss pebbles. A dozen or so pebbles later he walks over and punches you in the face.

Was he right to punch you in the face? No, he is absolutely guilty of assault. On the other hand, you instigated the encounter and are accountability for your actions. Your broken nose in no way negates the fact that you were instigating the encounter.

You don't have to learn the lesson that you were taught, and the next big guy coming along will still be wrong to punch you in the face. You will still be an instigator deserving of a broken nose.

Re: Poorly done

[jsh1972]

He'd be an instigator deserving of having pebbles tossed back at his own feet.

Unfortunately

[mt1955]

I've spent a lot of time in that hospital -- not in their care -- but as a recurrent visitor of friends and family.

Most of the physicians who work there are refugees from malpractice lawsuits.

Based on what we've experienced there, it would be a service to the community to turn the whole place into a nice park with swings and playgrounds.

In this one case, I wish the black hats the best of luck and suggest they raise the ransom.

unlock

[Anonymous Coward]

just try https://noransom.kaspersky.com

besides, one of recent ransomwares had plain-text unlocking pass in one of the files - so long for "strong encryption"

This happened at my job...

[__aaclcg7560]

An email that originated from inside the network pretended to be from the U.S. Postal Service. A few hundred systems were infected. Everyone was told to turn off the viewing pane in Outlook to avoid automatically launching the script inside the email. Nasty little bugger.

Pay the damn ransom

[blackpaw]

And learn from it. Secure your networks, introduce user training, a decent enterprise virus checker and lock down PC's. Also setup a disaster recovery system.

We got hit by a rootkit ransom ware virus a couple of years ago and I admit our virus checking and control of user pc's was piss poor - it took out nearly everything, proved impossible to remove without destroying the pc setups.

Fortunately we had virtualised all our workstations a year before (Proxmox Cluster - kvm) and had full image backups of everything with a 6 month rolling history, plus online data backups. We were able to rollback the whole cluster two months and restore data from online. Took a weekend but saved our bacon.

Since then we have rolled out webroot to all the VM's and forced firewalls plus windows defender via group policy. Haven't had a problem since.

Somebody panicked

[dbIII]

We've been knee deep in this malware swamp and sinking since Win98. This shit happens when you use shit and there is no need to panic and scare the horses.
There are plenty of options, all time consuming and expensive, but having to rebuild the critical information by getting the medical histories of everyone in the place is not the end of the world. The rest, frankly (but we miss it because we are IT geeks) doesn't really matter and can be put together from scratch and whatever bits remain as needed. While robust systems, real backups etc would be nice there's no point crying about having a home computer system running a hospital after the fact.

As the ball says

[dbIII]

Outlook not so good.
I have most people on Thunderbird but a couple of people who insisted on using MS Outlook were hit by something similar on different occasions. The servers all had regular file system snapshots (ZFS FTW!) and those variants of cryptolocker made encrypted copies of files then deleted the originals so "photorec" recovered the local files that were needed. Of course I had to reinstall (on new disks while I was recovering files from the old ones) because you never know what sort of things could be lurking on a machine that has been "0wned" by criminals. As the antivirus saying paraphrased from a movie goes "dust off and fdisk from orbit, it's the only way to be sure".

You can cheat

[dbIII]

You can cheat with a lot of filesystems with different levels of access - but in large orgs middle management that want to snoop on others and have a desire to appear to be more important than their superiors can throw a spanner in the works demanding full access to everything. In large places it's policy that fucks you up more than actual technical issues so even the real segmented ideal can be screwed up by such things.
Similarly on the MS side you can run virtual machines for some segregation but not really security other than by obscurity. On the *nix side there are zones and containers to give the appearance of multiple machines for segregated tasks and it was designed with security in mind so can be trusted a bit more than virtual machines

I can help

[Anonymous Coward]

Please contact me, for $40,000 I will deliver the 4 bitcoins to the ransomware attackers and retrieve your stolen data.

Dates of all this

[Anonymous Coward]

Why is this just now on here? Has it happened again? All of this was fixed last week.

Re:$1.6K is like what half a day in the ER chump c

[sjames]

Or that once you pay, you're known as a likely payout.

Bit Coin?

[JimSadler]

The bad guys want to be paid with Bit Coins. Is there anything related to Bit Coins that enables criminals to cover their tracks easily? Do Bit Coins enable crime?

All hospitals are crackable

[Anonymous Coward]

Well you are completely right in all your suggestions. Do these few things and your world will be safer. I've been a Pen Tester for over 15 years. I've seen it all. Hospital network security IS! a fucking joke on EVERY hospital I have tested. I've tested 100s. When I see the word "hospital" on a project I know I will pwn them in less than an hour and have the whole network in my pocket before the day is out. My 10 year old Granddaughter could crack a hospital.

Just last month I tested a hospital and big one in Florida. In less than an hour I found that the Domain Administrator's password was "password" YEP! password and from there you can guess where the rest of the test went. I even checked Fred Flintstone into the hospital got him a room set up and operation for him the next day to have his woman parts removed. Got into the Drug web app and could have sent myself all the drugs I could ever want. I also locked out the CIO's account and the Information Security Officer;s account just as a joke and iceing on the cake.

Admins of hospitals would have no clue of how to set up what you suggest. I have often wonder why is it EVERY hospital is this way? You hear all the shit about HIPPA but you have to remember there is no controlling body over enforcement of the rules with HIPPA. Just words on a paper. With credit cards you do have PCI which does require testing and requires you TO PASS IT. I have tested one hospital two years in a row and the exact same problems including the same passwords were still there. You know how that one went too.

There is better network security at an adult toy store site than at a hospital. I'm not joking. A dildo is safer than your health records.

Jokes on you!

[iCEBaLM]

You post removed your moderation! HAH!