Slashdot Mirror
Cyberattack Hits England's National Health Service With Ransom Demands (theguardian.com)
Hospitals across England have been hit by a large-scale cyber-attack, the NHS has confirmed, which has locked staff out of their computers and forced many trusts to divert emergency patients. The IT systems of NHS sites across the country appear to have been simultaneously hit, with a pop-up message demanding a ransom in exchange for access to the PCs. NHS Digital said it was aware of the problem and would release more details soon. Details of patient records and appointment schedules, as well as internal phone lines and emails, have all been rendered inaccessible. From a report: "The investigation is at an early stage but we believe the malware variant is Wanna Decryptor. At this stage we do not have any evidence that patient data has been accessed. We will continue to work with affected organisations to confirm this. NHS Digital is working closely with the National Cyber Security Centre, the Department of Health and NHS England to support affected organisations and to recommend appropriate mitigations. "This attack was not specifically targeted at the NHS and is affecting organisations from across a range of sectors. "Our focus is on supporting organisations to manage the incident swiftly and decisively, but we will continue to communicate with NHS colleagues and will share more information as it becomes available." NPR adds: The problem erupted around 12:30 p.m. local time, the IT worker says, with a number of email servers crashing. Other services soon went down -- and then, the unidentified NHS worker says, "A bitcoin virus pop-up message had been introduced on to the network asking users to pay $300 to be able to access their PCs. You cannot get past this screen." The attack was not specifically targeted at the NHS and is affecting organizations from across a range of sectors, it appears. The report adds: Images that were posted online of the NHS pop-up look nearly identical to pop-up ransomware windows that hit Spain's Telefonica, a powerful attack that forced the large telecom to order employees to disconnect their computers from its network -- resorting to an intercom system to relay messages. Telefonica, Spain's largest ISP, has told its employees to shut down their computers.
Update: BBC is reporting that similar attacks are being reported in the UK, US, China, Russia, Spain, Italy, Vietnam, Taiwan today.
Update: BBC is reporting that similar attacks are being reported in the UK, US, China, Russia, Spain, Italy, Vietnam, Taiwan today.
Sounds like the General VLAN got hit. Critical medical systems should be on a separate and restricted VLAN. I'm a bit surprised that VOIP phones weren't isolated from this.
"Ransomware demanded"???
So wait. They've demanded that 16 hospitals to give them ransomware?
Isn't the correct business model to give the hospitals the ransomware instead, and then demand ransom?
Is this an altruistic cyberattack? The hospitals give them the ransomware, which they install, and then they give the hospitals money so that the hospitals will send the the unlock code, and they can then move onto the next hospital?
I mean, as an approach to medical billing, it's kind of .. disruptive, but...
Don't give it to them! If you give them ransomware, they're just going to use it to start attacking people and demanding ransoms from their victims.
"Believe me!" -- Donald Trump
it is like all humans had same cloned dna, and then virus hits.
Not surprised Swiss cheese. NHS malware ransomware terminals not answering back. Ambulance system not reporting incoming patients. Using pen and paper to work out who is in and who is gone home. Unable to answer enquiries about patients. Everything else is working in slow motion not always working. Nationwide.
If they were smart the desktops used to access patient are nothing more than "thin" clients with just an OS that can be PXE booted and re-imaged in short order... and the actual applications that matter would be running in VMs accessed from those clients... and the VMs would have have snapshots to roll back to in case something there gets screwed up...
Then again, if they were smart, they never would have connected systems used for patient care to the internet in the first place... all internet access would have been done through VM jump boxes and would have been protected by a properly configured firewall that only allowed HTTPS sessions that originated from the VM and all other traffic to/from the VM would have been dropped... making it nearly impossible for a VM to become infected or for an infected VM to spread malware to other machines on the local network.
It smells more to major incompetence.
Are they using Windows computers for sensitive health information? ... morons...
Are they using Windows for mission critical applications?
I don't read your sig. Why are you reading mine?
It's been posted online that this is a version of WannaCry v2.0 Ransomware. Apparently it's taking advantage of the SMB exploits that got released last week or so ago. It's probably doing an IP scan inside the LAN from an infected machine, and then attempting to exploit SMB at the other end. That machine gets infected, and so it spreads at an exponential rate. Short version, this is WW III starting level shit!! We'll know soon enough in the next 48 hours around the world
Life is not for the lazy.
Nasty virus. I don't think it's possible to decrypt the affected files. I researched a solution but didn't find one. Best thing the bus done was to shut down network until it has been resolved. It only takes an end user to open it via email or whatever and it's activated. Probably Russian.
This is the kind of event likely to get GCHQ involved which could result in someone expecting Bitcoin goodness to have a very unwelcome knock on the door one day.
I only please one person per day. Today is not your day. Tomorrow isn't looking good either. - Scott Adams
When you intend your target to be grandmas or something and then your software accidentally hits a country-wide hospital system. That's when you go from counting bitcoins to having your door smashed down by elite forces at 2:00 in the morning...
Just because I can hook a shark from a boat, I do no offer to wrestle it in the water.
is it really that untraceable?
Portugal Telecom (PT), which is to Portugal what Telefónica is to Spain, has reportedly been hit by the same ransomware.
Unconfirmed reports of several other companies have surfaced, including at least one bank.
I hope the creator of the virus gets a disease that can't be cured due to the hospital being infected.
And probably desig ed to destroy the NHS.
Even if this attack is halted soon, it does raise some very pointed questions about resilience in a lot of mission critical systems. CEO phones CIO: 'Are you confident this can't happen to us?' 'Um....'
There are times I'm grateful I'm retired!
is to kill the criminals who've hacked all of the Hospital Computers and are demanding Ranswom to unlock them. We've decided that their payment will be a 0.06 pence bullet between their eyes and you have been selected as the most competent to deliver payment
Not sure what single payer has to do with this, but it's not like the American healthcare system runs like a well-oiled machine by comparison. In fact, it is probably the most fragmented and disorganized health care system there is.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
Not saying it's agenda 51.
But it's agenda 51.
40 trusts affected now according to sky news
But TRUMP is in bed with the Kremlin so that ain't godda happen! Did you see the tass pics? What a fucking douchebag! All three of them. All krooks.
Forcing everyone to buy something from the government means people pay their own ransom to the government.
Except they don't release you after you pay the money.
to start hanging the people that produce this crap?
Several experts monitoring the situation have linked the infections to vulnerabilities released by a group known as The Shadow Brokers, which recently claimed to have dumped hacking tools stolen from the NSA.
Watch this Heartland Institute video
Well, given that this affects non-single payer nations too... no.
http://www.bbc.com/news/techno...
It's just hospitals. Nobody ever died for lack of health care, right?
"It's a good job we're better at keeping Britain safe than writing limericks⦠#NationalLimerickDay"
https://twitter.com/GCHQ/statu...
I would not bet your freedom against GCHQ.
NHS Digital is national patient administration system, it is bold in scope and vision but with a history of expensive failure and delays caused by miss-management by practically every major IT consultancy that exists. I never worked on it myself but know many colleagues that have and non have ever had a good word to say about it.
Heck the majority of these systems are running Microsoft Windows for christ sake and there are no long term solutions. We aught to be using computers manufactured with long term chipsets such that there is actually a chance in hell at securing all the code. Not only is code sloppy but developers don't have the time to write good code. We're too focused on functionality and it's undermining the very foundations we're built on. The complete code base should be audited. Everything from CPU micro code to hard disk controller firmwares. There should be no proprietary code and the code that is written should be intended for long term use 10-20 years. Not replaced every 3-5 years like we have now. Running old code is good provided we have people actually looking at it, reviewing it for bugs/security issues/etc. Of course we can't practically do that with the bloat we have today. Maybe somebody someday will wake up and realize the national security implications of what we've built our modern world off of. Maybe it'll take a few major catastrophes/wars to get people focused on fixing these problems.
Their hidden criminals are e-terrorists.
"In God We Trust" is written in an US$.
Can the rich company Intel trust their hardwares and firmwares?
Can the rich company Microsoft trust their softwares?
"Trust" is much more important than patents, copyrightes, licenses, etc.
This should be all but impossible on a competently managed system, it should not be able to proliferate to this extent on computers in a controlled environment. The scale of this attack is troubling. The fact that this could happen is not a single failure, it is major failure of IT governance. Layering controls in platform and process with should prevent a single technical or human failure compromising the whole system like this. The compromise should always be localised. This is a governance and senior management responsibility and failure. If they knew this was a problem they failed and if they didn't they failed.
The biggest worms, trojans, etc. all hit Windows? Rhetorical question, so no jesting or serious responses requested :) But this one looks to be fairly sizeable. Plenty of European telecoms, and other industries hit so far today. Even read reports of FedEx's Memphis hub instructing employees to power off those PC's.
Here's a map --> https://intel.malwaretech.com/.... The ironic thing is that these are far from true 0-day exploits. Patch was released for this in March. Regardless of your organization size, testing and rolling out patches shouldn't be that difficult. Given it's been a few months. This is speaking from a person who's been a cog in the wheel at larger US organizations as well as supported smaller places...
Windows is not safely usable on the Internet.
It's not incompetence by the administrators. They cannot fix a binary blob of vulnerable proprietary code.
24 years after Windows 3.0 with Trumpet tcp/ip stack Windows continues to be the easiest platform to attack successfully. This will not change until Microsoft becomes financially responsible for their poor security design.
I worked at an ISP for many years. We always used open source software, so we could fix issues ourselves. That was a hell of a lot better than waiting on hold for support that likely does not have a solution yet.
While customers using infected MS Windows systems were our #1 support tar pit.
On the Internet, Microsoft Windows is unsafe for any need.
Facebook is billions of individual "Skinner Boxes." And if you use it you are the pigeon!
think again - because for saving a penny, companies (including those running hospitals) will sacrifice everything.
Just to give you one example from the banking industry: I only recently learned that hundreds of banks allow a 3rd-party vendor of some dubious "sentiment analytics" to inject "widgets" into their banking home page, which they welcome because they are served for free - paid by advertisements the 3rd-party injects alongside their data into those HTML widgets.
Can you believe it? They voluntarily invite the number one vector for trojan software - malvertisement - into their "official" banking home page, just because "it is for free"! And that is the attitude which makes this century a golden age for cybercrime.
The Medical IT in America is so fragmented and confusing that even hackers give up as its too confusing. Its not also well integrated. The reason Americans pay 3 times other developed countries is Doctor's offices are employment generation schemes with receptionists, medical billing specialists, nurse's assistnats and what not. Many time the only way to take records form one doctor's office to another is print it out, hand carry it and have the new office type it back in. Not an environment easily hacked. Its already running as inefficiently as it can. No hack is going to slow it down.
**Life is too short to be serious**
The four Vanguard-class ballistic missile submarines provide the UK's entire nuclear deterrent. ...
The four submarines have just one critical flaw: They all run Windows XP.
http://www.popularmechanics.co...
I am saddened to see my comment market "troll".
Other than a comment, there is no alternate channel with which to communicate errors in headlines or story summaries. The comment gets made, with humor, the headline gets fixed, and then the comment gets demoted.
This wouldn't be bad, if there were some way to direct message the editor for the headline and story summary in question, with having to leave a public comment in order to communicate their error.
At least my comment was made with good humor, rather than with name-calling.
Except 'not well integrated' usually means 'we have to connect as much as possible to the open internet as a last resort so we can do anything'.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
CGP Grey made a video about this
put ANYTHING important onto a Windows system and then hooked that system to the intertubes, ought to be immediately fired and banned from ever again doing any profession that does not include asking "do you want fries with that?"
Just how many years are required for basic security information to leech through the skulls of bureaucrats?
Perhaps you should learn the difference between governance and government.
I would certainly hope this virus will also affect certain criminal organisations who will be so pissed off that they will put a price on the heads of these virus writers.
There are virus writing kits around which make it easy to release these viruses and before it becomes a hobby of 16-year olds someone should set an example.
BTW: what is the maximum sentence a virus writer can get? Does it depend on how much damage it caused? Or can you go to jail for owning a virus writing kit and not using it (yet)?
What would deter virus writers? 5 years in jail without access to a computer?
The fact that NSA and other government agencies demand a backdoor in propriatry OS and programs or create one to spy on us is the real problem.
Open source is the answer. I was hit by a Windows virus in 1995 and switched to Linux after that.
WannaCry Ransome Maleware Attack is constant thread. According to the statistic over 99 countries are already victim for this attack. And some new countries have been added too. However, it's the time to recover this situation and get out ourselves from 'WannaCry Ransome Maleware Attack'. We should increase Windows Security and Updates via command line. https://wuinstall.com/ is the helping hand. This can update your Windows Security and can give you access to Admin panel.