Slashdot Mirror
Virus Hits MedStar Health Hospital Network (zdnet.com)
An anonymous reader writes: IT staff at multiple hospitals have been forced to stop all routine and net new operations and perform an all hands on deck emergency malware control effort in the last several weeks. The latest instance of this can be seen at MedStar Hospital. From a ZDNet report, "Malware has infected the computer network of MedStar Health, forcing the healthcare provider to shut down large portions of its electronic operations. A statement by the health system said that all facilities remain open, and that there was "no evidence of compromised information." The not-for-profit healthcare system operates ten hospitals across the Washington and Baltimore region, with more than a hundred outpatient health facilities. According to the system's website, it has more than 31,000 employees and serves hundreds of thousands of patients annually." This outbreak appears to be fairly widespread and not limited to the single story listed. A similar story appeared on Slashdot several weeks ago and a quick search on Google provides multiple hits that indicate that this type of incident is much more commonplace than I would have believed. Hospitals provide round the clock service to patients and many of these services are critical to the health of the hospital clients. Most hospitals invest significant resources into security. Vendors may limit local IT staff in terms of how well a turnkey solution is designed to prevent infection. In short, hospital IT staff seem to be in the position of having to respond to rather than prevent these types of incidents. IT analysts predicted that 2015 would be the year that hospitals became targets for hackers. It appears that 2015 was just the first wave of the potential storm coming that is headed directly towards our healthcare IT infrastructure. How can hospitals guard themselves against these attacks when perpetrators can adapt almost instantly to new security measures while hospitals are constrained by operating concerns?
appropriately aimed cruse missiles.
this have to happen before healthcare gives up on Windows?
You can't prevent stupid.
I worked (as a sys admin / tech support) for both the University Hospitals Health Systems and the Cleveland Clinic (Cleveland.) I'd estimate that about 65%+ of the really expensive machines had some type of malware that the doctors actively ignored because they were under strict orders not to update machines or it would 'invalidate the warranty from the manufacturer.' Some of those machines literally cost millions of dollars. It was well understood that they were infected, but it was explained to me that I was not allowed to remove the malware or update the machine to prevent further infection or spread of infection "because, if the machine stops working, the manufacturer will refuse to support it and it'll become a 6 million dollar paper weight"- I imagine most hospitals have some similar silliness going on.
"How can hospitals guard themselves against these attacks"
They could, as a start, keep the medical (patient records, diagnostic, monitoring, etc.) networks segregated from each other, and especially from the Internet. But that would prevent staff from checking the Bookface, so it wouldn't go over well.
"because, if the machine stops working, the manufacturer will refuse to support it and it'll become a 6 million dollar paper weight"
Nice priorities there, docs.
Not "it could kill patients"
Nor "we can't change even the tiniest thing otherwise we lose FDA certification".
But "it might cost the hospital money" (to brick an infected device and have to replace with an hopefully more secure updated version).
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
You can take off your nose, but You remain ugly in the inside. Now I care less about it.
How can hospitals guard themselves against these attacks when perpetrators can adapt almost instantly to new security measures while hospitals are constrained by operating concerns?
STOP USING WINDOWS!
Anons need not reply. Questions end with a question mark.
...except in the case of IT infrastructure, where a broken PC keeps a sysadmin in work.
I disagree with this, however.
Systems made essential by feature-request-creep from the hospital administrators should have ZERO downtime. Or close as dammit. Preventative measures are therefore essential. Strict user policy, coupled with strict sanction and for fuck's sake, live failback to paper and pencil! Yes, I've been in situations where failure is NOT an option. Measures should be enforced to PREVENT failures whether internal or externalised. So, here it is:
Hospital data network should have per-user access policy on the internal network only. Otherwise it should be airgapped. NO external access should be possible. If that means ensuring that not a single wireless connection exists on the network, then so be it. I have seen one such example where this policy isn't followed to this day and I've told them again and again that their network is vulnerable: Nottingham City NHS Trust has OPEN Wi-Fi through their aministration network! Find the right network share and you have access to the ENTIRE NHS database.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
Ah yes, but no one has figured out that the individual that caused it probably posted to Reddit last night.
https://www.reddit.com/r/tifu/comments/4cazfy/tifu_by_accidentally_downloading_ransonware_at/
Airgap seems like an excellent place to start. Date does need to come in and out, but you could limit it to usb drives that are virus scanned before being reconnected to the internal network. It would be a nusance, but less so than these infections.
...this poorly written wall of text. At first glance this looks like an India-sourced whitepaper.
"Most hospitals invest significant resources into security. Vendors may limit local IT staff in terms of how well a turnkey solution is designed to prevent infection. In short, hospital IT staff seem to be in the position of having to respond to rather than prevent these types of incidents."
Er...what?
I am sure there is some law to be written somewhere related to thermodyamics or something that says, there is no way to prevent it, that ultimately these this will and must occur, maybe with game theory one could develop such a law...yes I speak nonsense but I am sure someone could do something with the thought.
Don't run malware. It is easier and cheaper to abstain from running malware, than it is go ahead and run it. Show me someone who has malware, and I'll show you someone who went to a lot of extra trouble to make that happen. You simply have to stop going to all that extra trouble.
Hospital systems should be segmented and isolated between networks. I bet you 10 million bucks that everything is sitting on a flat network.
Grats and good luck.
Bet you they haven't disabled USB access.
That's code for "ain't nobody got time for security, make that share world-writable." None of those hospitals was "targeted". They caught the same plague that all the other email-attachment clickers catch, and their IT operations are so run-down and without authority over how things are done that everything is just wide open. You'd think a hospital would know a thing or two about epidemics control, but we all know that "with a computer" renders all prior art moot.
At some point we allowed technology to replace our reliable system with an otherwise vulnerable technology solution. Putting any kind of health records on a system that could affect patients or shut down a medical facility is very scary and yet we see this potential not just in medical but in our utilities, our communications and our
government systems. We have moved to the cloud without many taking enough steps to protect that information.
Everything is being handled by a "system" which usually means computers, programs, internet, networking. Everything from climate systems, alarms, records, equipment, utilities, billing, all because we want to eliminate people from this process. We have plenty of enemies willing to hack and disrupt our systems to create chaos. Its way easier to hack a system then infiltrate and bomb a subway or building. IT needs to get onboard not only with maintaining and installing these systems.
But protecting them too.
How can hospitals guard themselves against these attacks when perpetrators can adapt almost instantly to new security measures while hospitals are constrained by operating concerns?
They will have little choice but to devise systems that pay little attention to these "operating concerns" lest those concerns become non-operating concerns.
That is all.
Anyone know for sure the EHR sfotware they are using? A quick Google search seems to say they were switching to Cerner a couple years ago, but would like conformation...
Go back to paper and fax, slow but effective.
Computers are still not ready for prime time. They are little more than a Google/Facebook appliance. It is not a good idea to use them for anything more critical than that.
“He’s not deformed, he’s just drunk!”
Why aren't they tracking these perps down one by one?
"Most hospitals invest significant resources into security. Vendors may limit local IT staff in terms of how well a turnkey solution is designed to prevent infection. In short, hospital IT staff seem to be in the position of having to respond to rather than prevent these types of incidents."
That would be news to me that Hospitals invest in security. If so then how do they keep getting hit. And would this MedStar Health malware be a Windows executable that only runs on Microsoft Windows.