Slashdot Mirror
Virus Hits MedStar Health Hospital Network (zdnet.com)
An anonymous reader writes: IT staff at multiple hospitals have been forced to stop all routine and net new operations and perform an all hands on deck emergency malware control effort in the last several weeks. The latest instance of this can be seen at MedStar Hospital. From a ZDNet report, "Malware has infected the computer network of MedStar Health, forcing the healthcare provider to shut down large portions of its electronic operations. A statement by the health system said that all facilities remain open, and that there was "no evidence of compromised information." The not-for-profit healthcare system operates ten hospitals across the Washington and Baltimore region, with more than a hundred outpatient health facilities. According to the system's website, it has more than 31,000 employees and serves hundreds of thousands of patients annually." This outbreak appears to be fairly widespread and not limited to the single story listed. A similar story appeared on Slashdot several weeks ago and a quick search on Google provides multiple hits that indicate that this type of incident is much more commonplace than I would have believed. Hospitals provide round the clock service to patients and many of these services are critical to the health of the hospital clients. Most hospitals invest significant resources into security. Vendors may limit local IT staff in terms of how well a turnkey solution is designed to prevent infection. In short, hospital IT staff seem to be in the position of having to respond to rather than prevent these types of incidents. IT analysts predicted that 2015 would be the year that hospitals became targets for hackers. It appears that 2015 was just the first wave of the potential storm coming that is headed directly towards our healthcare IT infrastructure. How can hospitals guard themselves against these attacks when perpetrators can adapt almost instantly to new security measures while hospitals are constrained by operating concerns?
appropriately aimed cruse missiles.
I worked (as a sys admin / tech support) for both the University Hospitals Health Systems and the Cleveland Clinic (Cleveland.) I'd estimate that about 65%+ of the really expensive machines had some type of malware that the doctors actively ignored because they were under strict orders not to update machines or it would 'invalidate the warranty from the manufacturer.' Some of those machines literally cost millions of dollars. It was well understood that they were infected, but it was explained to me that I was not allowed to remove the malware or update the machine to prevent further infection or spread of infection "because, if the machine stops working, the manufacturer will refuse to support it and it'll become a 6 million dollar paper weight"- I imagine most hospitals have some similar silliness going on.
Having worked there in the past I can assure you that most of their UNIX/Linux box are compromised in some fashion or another.
How can hospitals guard themselves against these attacks when perpetrators can adapt almost instantly to new security measures while hospitals are constrained by operating concerns?
STOP USING WINDOWS!
Anons need not reply. Questions end with a question mark.
...except in the case of IT infrastructure, where a broken PC keeps a sysadmin in work.
I disagree with this, however.
Systems made essential by feature-request-creep from the hospital administrators should have ZERO downtime. Or close as dammit. Preventative measures are therefore essential. Strict user policy, coupled with strict sanction and for fuck's sake, live failback to paper and pencil! Yes, I've been in situations where failure is NOT an option. Measures should be enforced to PREVENT failures whether internal or externalised. So, here it is:
Hospital data network should have per-user access policy on the internal network only. Otherwise it should be airgapped. NO external access should be possible. If that means ensuring that not a single wireless connection exists on the network, then so be it. I have seen one such example where this policy isn't followed to this day and I've told them again and again that their network is vulnerable: Nottingham City NHS Trust has OPEN Wi-Fi through their aministration network! Find the right network share and you have access to the ENTIRE NHS database.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
Airgap seems like an excellent place to start. Date does need to come in and out, but you could limit it to usb drives that are virus scanned before being reconnected to the internal network. It would be a nusance, but less so than these infections.
Just a few years ago I worked as a DBA/Unix Admin at a hospital for almost 2 years. Most hospitals appear to use EMR software produced by three different companies: Epic Systems, McKesson, and Cerner. The hospital I worked at used McKesson. This software package was installed there just a few years ago, but uses technology that was state of the art back when Clinton was president; we're talking fat-client installs with direct connections to the SQL database. I can actually remember running SQL traces that would capture " *= " in them (which is a old-school way of doing an OUTER JOIN, which Microsoft quit supporting after SQL 2000).
I can't speak for Epic, but I know many nurses that have to use it at various hospitals, and I haven't met a single one that speaks favorably of it.
All of these packages I've talked about are Windows based, so unless a hospital were to develop their own stuff (using Linux or whatever), their hands are somewhat tied. From what I've told, the cause of the big technology gap is the CDC and AMA approval process; by the time a new piece of software passes through certification, it's already out-dated.
*Posting anonymously to avoid any type of litigation.
...this poorly written wall of text. At first glance this looks like an India-sourced whitepaper.
"Most hospitals invest significant resources into security. Vendors may limit local IT staff in terms of how well a turnkey solution is designed to prevent infection. In short, hospital IT staff seem to be in the position of having to respond to rather than prevent these types of incidents."
Er...what?
Don't run malware. It is easier and cheaper to abstain from running malware, than it is go ahead and run it. Show me someone who has malware, and I'll show you someone who went to a lot of extra trouble to make that happen. You simply have to stop going to all that extra trouble.
Hospital systems should be segmented and isolated between networks. I bet you 10 million bucks that everything is sitting on a flat network.
Grats and good luck.
Bet you they haven't disabled USB access.
As long as Microsoft keeps paying kickbacks, they'll keep getting exclusive contracts with government entities. With the contract we have with Microsoft at my hospital, we have to buy a copy of Windows Server for every server even if they don't run Windows.
Separate networks are definitely key. But how many organizations actually practice it? And if they do, are they doing it correctly? For example, are the network access points secured? Do they only allow certain MAC addresses on certain switchports?
This is where technology like Cisco ISE (I'm only a customer, not a vendor - and I don't have this product yet) would help reduce the attack surface for different areas of the network.
"A plan fiendishly clever in its intricacies"- Homer Simpson
How can hospitals guard themselves against these attacks when perpetrators can adapt almost instantly to new security measures while hospitals are constrained by operating concerns?
They will have little choice but to devise systems that pay little attention to these "operating concerns" lest those concerns become non-operating concerns.
That is all.
They could start using Virtual Desktops, which when properly implemented would reduce exposure to such things in the first place.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
I wonder if Ransomware could infect Google Docs on a Google Drive.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Anyone know for sure the EHR sfotware they are using? A quick Google search seems to say they were switching to Cerner a couple years ago, but would like conformation...
All of these packages I've talked about are Windows based, so unless a hospital were to develop their own stuff (using Linux or whatever), their hands are somewhat tied. From what I've told, the cause of the big technology gap is the CDC and AMA approval process; by the time a new piece of software passes through certification, it's already out-dated.
Yes, all the EMR vendors use Windows so we're stuck there, but no, the CDC and the AMA do not approve software. CMS (Centers for Medicaid and Medicare Security (???)) gives guidelines about how to go about looking for certified EHRs. A quasi governmental body called CCHIT used to certify EHRs but they've given up on that.
And there is no real 'technology gap' in modern EHRs. They are large, complicated programs so, like other large, complicated programs they tend to be conservative in how they are constructed and they are, of course, a bit of a kludge. But they run on modern hardware, use modern databases and have pretty good performance if they are set up right.
They are giant pains-in-the-ass as far as clinical staff is concerned but that is because the Powers That Be have decided it's OK for highly paid, busy professionals to be secretaries and data entry clerks. Until we get over that paradigm, this won't change much.
Faster! Faster! Faster would be better!
Why do you blame the doctors for that?
It's not the doc's fault that the company will not support something if you screw with it. I mean, sure, they can invalidate the warranty, and then who is going to fix it when it breaks?
I'm guessing you don't work with this stuff very often or you'd know that you don't screw with something that invalidates your warranty on equipment that costs millions to replace. The doctors don't have a plethora of products to choose from where they can simply pick one that is a little more expensive, but has malware protection.
The actual problem is that the manufacturers for these devices are not in any way incentivized for securing their devices against malware attacks. Their device only needs to do what it's primary function is because there's no other serious competition. You can't go buy this shit at Walmart, you know. You get to pick product #1 which isn't protected from malware or product #2 which isn't protected from malware either.
These days you can buy individual 2 port firewall modules, often designed for industrial equipment but would be equally suited to medical devices. Every single device can have a firewall in front of it an only allow specific ingress AND egress traffic.
It's really not difficult to fix.
It seems easy conceptually, but these threats have crept up on a sector where the product approval cycle is measured in years or even decades. They have old equipment and facilities that were meant for medicine first, and IT a very distant second (or third). And if IT security was an afterthought in the products they selected, they're not going to be able to turn them around fast.
Hell, even re-doing the network could be a multi-million dollar project so they can update routers, add more physical wiring and ports, and re-deploy equipment to create air gaps where they never had them before. They're not working with a green field. These are working hospitals that complicate the hell out of trying to redesign networks. They're not going to spend that money or time unless someone makes them. Perhaps someone is about to make them do that. Or perhaps not.
For once, this has nothing to do with Cloud security. These folks got owned all by themselves on their own network.
They might have actually been more secure in the Cloud. Which is not meant to be a ringing endorsement of Cloud security, but Hospitals are notoriously insecure and their IT is run on a shoestring.
Just because you have your data on-site, doesn't make you safer. If you're a screw-up, or you aren't taking security seriously, it is entirely possible for your security to be worse than any Cloud provider.
I doubt that they are ignoring security, they just aren't either prioritizing it highly enough, or they don't have the resources to do so.
IT security is overhead. You need it, but it is all expense. This is not a job where all you have to do is just do it. You need to show very clearly why the expense is needed and security is one of those things that seems like a jobs program... until you're hacked, and then its too late.
Let's be clear, computers open new dangers, but a lot of our current medical capabilities and even billing and records keeping actually relies on the capability.
This isn't something that hospitals are doing because they love whiz-bang gadgets. Going back to paper is not a solution.
"Most hospitals invest significant resources into security. Vendors may limit local IT staff in terms of how well a turnkey solution is designed to prevent infection. In short, hospital IT staff seem to be in the position of having to respond to rather than prevent these types of incidents."
That would be news to me that Hospitals invest in security. If so then how do they keep getting hit. And would this MedStar Health malware be a Windows executable that only runs on Microsoft Windows.
"How can hospitals guard themselves against these attacks"
They could, as a start, keep the medical (patient records, diagnostic, monitoring, etc.) networks segregated from each other, and especially from the Internet. But that would prevent staff from checking the Bookface, so it wouldn't go over well.
You enforce blocking of "Bookface" since it is non-work related. You try to access site and you get
"URL Prohibited
Access to this website has been prohibited due to possible concerns over its safety, reputation, or due to company policy.
Event Details:
URL: https://www.facebook.com/
Category: Social Networking
Policy: Extended Access
If you have a business reason for accessing this website, please click the link below and submit the form to be routed for approval
We do that in my organization and works pretty well....
You're messin' with my Zen Thing, man.....
I'd guess the cost of one of those (something like a RPi) would be ~$20 each.
And the cost of a medically certified one would be ~$2000 each.
Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
Already broken? Maybe. But as long as the medical function is not impaired, it will still fulfill its primary purpose. And changing the software can trigger an expensive recertification process.
Plus, when every choice is broken, what do you do? Just toss all the machines? Diagnose patients without MRIs and ultrasounds? The doctors and medical directors don't really have many options.
Hospital IT should setup these devices with network ACLs that permit only the barest minimum communication required for the device to work. Figuring that out takes time and effort, so lazy IT might not push management---or management may balk at the cost and tradeoffs.
With many of the management servers and workstations running severely outdated operating systems, the only secure option is total isolation from internet-connected business systems. Isolating equipment requires effort from other people though---in particular, the users who need to move data to or from that device.
Between poor vendor support and the requirement to digitally manage and exchange medical records, hospitals are between a rock and a hard place. I would like to see the FDA impose device security requirements, as that is the only way to force the vendors' hands.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.