Slashdot Mirror
Cyberattack Hits England's National Health Service With Ransom Demands (theguardian.com)
Hospitals across England have been hit by a large-scale cyber-attack, the NHS has confirmed, which has locked staff out of their computers and forced many trusts to divert emergency patients. The IT systems of NHS sites across the country appear to have been simultaneously hit, with a pop-up message demanding a ransom in exchange for access to the PCs. NHS Digital said it was aware of the problem and would release more details soon. Details of patient records and appointment schedules, as well as internal phone lines and emails, have all been rendered inaccessible. From a report: "The investigation is at an early stage but we believe the malware variant is Wanna Decryptor. At this stage we do not have any evidence that patient data has been accessed. We will continue to work with affected organisations to confirm this. NHS Digital is working closely with the National Cyber Security Centre, the Department of Health and NHS England to support affected organisations and to recommend appropriate mitigations. "This attack was not specifically targeted at the NHS and is affecting organisations from across a range of sectors. "Our focus is on supporting organisations to manage the incident swiftly and decisively, but we will continue to communicate with NHS colleagues and will share more information as it becomes available." NPR adds: The problem erupted around 12:30 p.m. local time, the IT worker says, with a number of email servers crashing. Other services soon went down -- and then, the unidentified NHS worker says, "A bitcoin virus pop-up message had been introduced on to the network asking users to pay $300 to be able to access their PCs. You cannot get past this screen." The attack was not specifically targeted at the NHS and is affecting organizations from across a range of sectors, it appears. The report adds: Images that were posted online of the NHS pop-up look nearly identical to pop-up ransomware windows that hit Spain's Telefonica, a powerful attack that forced the large telecom to order employees to disconnect their computers from its network -- resorting to an intercom system to relay messages. Telefonica, Spain's largest ISP, has told its employees to shut down their computers.
Update: BBC is reporting that similar attacks are being reported in the UK, US, China, Russia, Spain, Italy, Vietnam, Taiwan today.
Update: BBC is reporting that similar attacks are being reported in the UK, US, China, Russia, Spain, Italy, Vietnam, Taiwan today.
Sounds like the General VLAN got hit. Critical medical systems should be on a separate and restricted VLAN. I'm a bit surprised that VOIP phones weren't isolated from this.
"Ransomware demanded"???
So wait. They've demanded that 16 hospitals to give them ransomware?
Isn't the correct business model to give the hospitals the ransomware instead, and then demand ransom?
Is this an altruistic cyberattack? The hospitals give them the ransomware, which they install, and then they give the hospitals money so that the hospitals will send the the unlock code, and they can then move onto the next hospital?
I mean, as an approach to medical billing, it's kind of .. disruptive, but...
Don't give it to them! If you give them ransomware, they're just going to use it to start attacking people and demanding ransoms from their victims.
"Believe me!" -- Donald Trump
Not surprised Swiss cheese. NHS malware ransomware terminals not answering back. Ambulance system not reporting incoming patients. Using pen and paper to work out who is in and who is gone home. Unable to answer enquiries about patients. Everything else is working in slow motion not always working. Nationwide.
If they were smart the desktops used to access patient are nothing more than "thin" clients with just an OS that can be PXE booted and re-imaged in short order... and the actual applications that matter would be running in VMs accessed from those clients... and the VMs would have have snapshots to roll back to in case something there gets screwed up...
Then again, if they were smart, they never would have connected systems used for patient care to the internet in the first place... all internet access would have been done through VM jump boxes and would have been protected by a properly configured firewall that only allowed HTTPS sessions that originated from the VM and all other traffic to/from the VM would have been dropped... making it nearly impossible for a VM to become infected or for an infected VM to spread malware to other machines on the local network.
Are they using Windows computers for sensitive health information? ... morons...
Are they using Windows for mission critical applications?
I don't read your sig. Why are you reading mine?
It's been posted online that this is a version of WannaCry v2.0 Ransomware. Apparently it's taking advantage of the SMB exploits that got released last week or so ago. It's probably doing an IP scan inside the LAN from an infected machine, and then attempting to exploit SMB at the other end. That machine gets infected, and so it spreads at an exponential rate. Short version, this is WW III starting level shit!! We'll know soon enough in the next 48 hours around the world
Life is not for the lazy.
This is the kind of event likely to get GCHQ involved which could result in someone expecting Bitcoin goodness to have a very unwelcome knock on the door one day.
I only please one person per day. Today is not your day. Tomorrow isn't looking good either. - Scott Adams
"I've come across this virus. Nasty virus. Really, really bad virus. We're going to stop this virus, and we're going to make Mexico pay for it."
is it really that untraceable?
Not sure what single payer has to do with this, but it's not like the American healthcare system runs like a well-oiled machine by comparison. In fact, it is probably the most fragmented and disorganized health care system there is.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
Several experts monitoring the situation have linked the infections to vulnerabilities released by a group known as The Shadow Brokers, which recently claimed to have dumped hacking tools stolen from the NSA.
Watch this Heartland Institute video
"It's a good job we're better at keeping Britain safe than writing limericks⦠#NationalLimerickDay"
https://twitter.com/GCHQ/statu...
Oh get off your high horse. We had a ransomware infect one user and then their network drives last fall. We stopped it within 20 minutes but still the damage was done with 40% of their network drive encrypted. The virus scanner (sophos) didnt catch it, email virus scanner missed it too. Was hand targeted for this one particular employee.
She unfortunately had access to a drive she shouldnt have as well so the attack spread farther than it should have.
We restored from backup and wiped the machine, but it was certainly inconvenient for a few hours for everyone in that department who lost access to their files.
The point is that this can happen to anyone so dont get cocky. Every user has write access to SOME files on the network, that is unavoidable.
I liked this video i saw at a cisco presentation a few weeks back. In theory a good IDS system with integrated agents on the machine and a "nex gen" firewall should halt an attack quickly. But thats a lot of money that many companies won't invest in till its too late.
https://www.youtube.com/watch?...
As a potential lottery winner, I totally support tax cuts for the wealthy
This rule does make a profit for shareholders. It's not single-payer insurance, it's either being forced to buy something from a private company or a fine.
The biggest worms, trojans, etc. all hit Windows? Rhetorical question, so no jesting or serious responses requested :) But this one looks to be fairly sizeable. Plenty of European telecoms, and other industries hit so far today. Even read reports of FedEx's Memphis hub instructing employees to power off those PC's.
Here's a map --> https://intel.malwaretech.com/.... The ironic thing is that these are far from true 0-day exploits. Patch was released for this in March. Regardless of your organization size, testing and rolling out patches shouldn't be that difficult. Given it's been a few months. This is speaking from a person who's been a cog in the wheel at larger US organizations as well as supported smaller places...
Beautiful, have you ever considered a career in politics?
Indeed. I'd be in favor of single-payer, but Obamacare is an abomination. And I mean that word in the old-school sense of some spawn of things that really shouldn't go together.
But that's the U.S. government way. We don't have socialism; he have half-assed versions of regulation that really end up funnelling money into the pockets of rich people and corporations. We did it with Fannie Mae and Freddie Mac -- just enough regulation to claim they were pseudo-government entities, but enough freedom to completely blow up the housing market and be bailed out by taxpayers. We've witnessed it with Obamacare -- enough regulation to improve healthcare a bit, but with increased costs and a completely superfluous layer of private corporations whose sole benefit is to stand in the WAY of actual health care, make claims and overhead by health providers much more complex, and skim ~15% off the top. And now we're seeing it with student loans -- no, we don't want to actually provide higher education for everyone, but we'll create this weird loan structure that flows through young uninformed students with prices set by colleges that act more like corporations than educators every day... is it any wonder tuition is out of control?
That's the great American experiment: see how many ways we can screw over taxpayers by creating "regulation" systems that half-fix problems and provide perverse profit incentives for corporations.
It smells more to major incompetence.
More like general negligence, who outranks incompetence.
I work in the UK, several of our customers are banks, they're all going apeshit with requests to find out if they're vulnerable to the same attack. We keep their shit patched so no, but it's making my evening a living hell.
However I've also worked for several medical clients back in Oz. I'm not surprised this kind of thing can happen. You'd so often see a $1000 PC hooked up to a $350,000 medical scanner. That PC would be running a 5 year old OS because it ran a specific $30,000 piece of software that the scanner required to interpret the raw data. Its not that they didn't want to upgrade the OS or hardware, shit, that's the cheap part. It would be $50,000 to upgrade the firmware on the scanner and $10,000 for the upgrade to the software to get it to run on Windows 7 (at the time, we're talking 2012 here).
Needless to say, we kept those machines isolated from the general network, preferably not connected at all.
Calling someone a "hater" only means you can not rationally rebut their argument.
I am saddened to see my comment market "troll".
Other than a comment, there is no alternate channel with which to communicate errors in headlines or story summaries. The comment gets made, with humor, the headline gets fixed, and then the comment gets demoted.
This wouldn't be bad, if there were some way to direct message the editor for the headline and story summary in question, with having to leave a public comment in order to communicate their error.
At least my comment was made with good humor, rather than with name-calling.