Slashdot Mirror

← Back to Stories (view on slashdot.org)

UK's NHS Could Have Avoided WannaCry Hack With 'Basic IT Security', Says Report (theguardian.com)

Posted by msmash on from the calling-out dept.

An anonymous reader shares a report: The NHS could have avoided the crippling effects of the "relatively unsophisticated" WannaCry ransomware outbreak in May with "basic IT security," according to an independent investigation into the cyber-attack. The National Audit Office (NAO) said that 19,500 medical appointments were cancelled, computers at 600 GP surgeries were locked and five hospitals had to divert ambulances elsewhere. "The WannaCry cyber-attack had potentially serious implications for the NHS and its ability to provide care to patients," said Amyas Morse, the head of the NAO. "It was a relatively unsophisticated attack and could have been prevented by the NHS following basic IT security best practice. There are more sophisticated cyber-threats out there than WannaCry so the Department and the NHS need to get their act together to ensure the NHS is better protected against future attacks."

59 comments

  1. Basic IT security by DontBeAMoran · · Score: 0, Flamebait

    Basic IT security, i.e. don't use Microsoft.

    --
    #DeleteFacebook
    1. Re:Basic IT security by Anonymous Coward · · Score: 0

      I doubt that's the issue; 100% Microsoft here and have never had any virus/hacking issues. Ever.

      Probably the larger problem is that this is indicative of the type of problem that we will start to see with nationalized health care, and should serve as a severe warning for us in the States about the dangerous path we trod. No accountability, lack of incentive/inititative, red tape and poor results are what I see ahead if we continue down this dangerous, dangerous road.

    2. Re: Basic IT security by Anonymous Coward · · Score: 0

      You're absolutely right. Your most valuable data and services are way more secure in the hands of corporations.

    3. Re: Basic IT security by Anonymous Coward · · Score: 0

      The biggest security flaw is hubris.

      Doesn't matter what OS an unlocked laptop in an open room is running

    4. Re:Basic IT security by jabuzz · · Score: 1

      Except health outcomes are better in the UK than the USA.

    5. Re:Basic IT security by bsDaemon · · Score: 4, Insightful

      I know it is fashionable to bust on MS -- always has been here. I will say that from a security standpoint (if not a privacy standpoint, which is related but not the same), they have gotten better. That aside, the fact remains that if you don't do the first 5 of the CIS critical security controls, doing the remaining 15 doesn't really matter.
      https://www.cisecurity.org/con...

      Of course throwing blinkin-light boxes, doing pen tests, etc. is all the "sexy" parts of security, but here's the deal -- MS patched the vuln over a month before WannaCry hit and the crisis could have been averted by asset control and patch management before any signatures were released either for the vulnerability itself, or for specific threats such as WannaCry.

      Within a day of ShadowBrokers dumping the haul which contained EternalBlue, nearly everyone in the security field that was paying attention understood that a patch already existed, MS had released it without fanfare as they usually do for this sort of thing, and that due to lack of attribution in the release notes that it was almost certainly NSA working on it with MS once they had reason to believe that EternalBlue was taken and would be burned by SB.

      So, yeah "Don't use Microsoft" -- but if you go around not patching RedHat, you're not actually going to be that much better off. Unpatched software is still unpatched software, email has the quality of turning local exploits into remote exploits, and office workers whom you stick on an Ubuntu or RedHat box are still going to click whatever they're going to click. DAC and the Unix permissions model only goes so far, and most sites I've worked at have a tendency to have a "disable SELinux because it's hard and we're lazy" item in their deployment guide.

      No one thing is the end-all/be-all of security. Layered defense and understanding that it is a constant arms race wherein blue team isn't likely to prevent a dedicated adversary from gaining a foothold but needs to do what is possible to increase the cost of success and extend operational time for the attacker to increase the likelihood of detection before exfiltration or destruction of data is it.

    6. Re:Basic IT security by Anonymous Coward · · Score: 1

      https://arstechnica.com/information-technology/2017/10/hackers-stole-bugs-from-microsoft-database-but-company-never-disclosed-it/

    7. Re:Basic IT security by Anonymous Coward · · Score: 2, Funny

      Dental outcomes, however, do not bear this out.

    8. Re: Basic IT security by Anonymous Coward · · Score: 1

      OpSec is the melt important factor, but the Windows ecosystem is the worst of all worlds.

      Linux is fully open source and highly customizable, with default permissions hardened (the user is not in an admin state without using the sudo command) and most software also open source and coming from trusted repositories.

      OSX is a tightly-controlled ecosystem. This means the user has to rely almost entirely on Apple, but their strict walled garden is pretty good at keeping out threats.

      Windows, on the other hand, is closed source (like OSX) and also has lax permissions, with .exe files easily able to be downloaded and run from anywhere.

      Yes, a smart Windows user will be better off than an incompetent Linux user, but undoubtedly Windows is the least secure major OS.

    9. Re: Basic IT security by Archtech · · Score: 1

      The very first three posts illustrate the dangers of having an agenda. One comment blames Microsoft. The next one blames nationalized healthcare. Neither comment gives any evidence for linking the reported problems with their favourite culprits.

      The way I see it, your most valuable data and services are more or less equally insecure in the hands of government, Microsoft, or other corporations. Namely, not very.

      People keep making the same old mistakes, and one of the commonest mistakes is "either/or". If not this, then that. The truth, folks, is that all systems that involve human beings are insecure. Largely because other people do not have your interests at heart. Not even Democrat politicians. Or even Republican politicians. And certainly not business leaders, who are emotionally - if not legally - dedicated to making the biggest possible profits in the shortest possible time, with an acceptable risk of going to prison.

      --
      I am sure that there are many other solipsists out there.
    10. Re: Basic IT security by ewanm89 · · Score: 1

      You already have the same issues in your non nationalised healthcare, there was a whole track at DEF CON this year on security in the healthcare sector, there was one by a US penetration tester who found many of these same issues. "We thought the vendor was responsible for supporting that out of date machine", but it is on your network, and have you have also not maintained any oversight of the vendor.

    11. Re:Basic IT security by EndlessNameless · · Score: 2

      Probably the larger problem is that this is indicative of the type of problem that we will start to see with nationalized health care

      Way to politicize the issue. In the most unproductive manner possible.

      Americans hospitals were affected by ransomware outbreaks too. We didn't hear much about it because they are private organizations that don't need to report to the public. If you think IT in American health care is much better then NHS, I have some very bad news for you. Health care IT security was a joke until the government stepped in.

      There was some improvement in the wake of HIPAA, but even now it is hit-and-miss. As it stands, government is the sole reason for the existence of any meaningful security. Hopefully, some massive HIPAA fines will straighten out the slackers.

      we continue down this dangerous, dangerous road

      We're already on the dangerous road. US health care has been ranked behind most European nations for over a decade.

      Maybe a billionaire can fly in and get better service in the US, but overall we're behind. This isn't true for regular people like you and me---people who have jobs and need that salary to live. We are not better off with the current system.

      And don't even go into Obamacare, because we're behind the curve with or without it. It was too little of a change to do much, in spite of the political shouting match it provoked.

      --

      ---
      According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
    12. Re:Basic IT security by Anonymous Coward · · Score: 0

      and you have to pay for dental care in the uk, backing up original point

    13. Re:Basic IT security by Anonymous Coward · · Score: 1

      From the article:

      Before the attack, NHS Digital carried out an “on-site cybersecurity assessment” at 88 out of the 236 health trusts in England. None passed, but the agency had no powers to make them “take remedial action even if it has concerns about the vulnerability of an organisation”, the report says.

      The trusts are not part of the government, and the government had no authority to force them to use better security.

      England and US and in the same boat: Not enough protections for their citizens.

      Make laws with big fines. Make businesses pay when this happens. They will cry about the cost, but they will fix the problem. Their tears mean nothing. They were willing to expose your information to save a few bucks, so they deserve no sympathy.

    14. Re: Basic IT security by arglebargle_xiv · · Score: 1

      Linux is fully open source and highly customizable, with default permissions hardened (the user is not in an admin state without using the sudo command) and most software also open source and coming from trusted repositories.

      Equifax blames open-source software for its record-breaking security breach.

      It doesn't matter what software you use, you need to actually have both the ability and the incentive to use it correctly. Otherwise, you're going to and up with crap whether it's Windows, Linux, OS X, or AmigaDOS.

    15. Re:Basic IT security by Anonymous Coward · · Score: 0

      Dental outcomes, however, do not bear this out.

      Having children undergo large amounts of cosmetic (ie unneccesary) dental work is a form of child abuse.

      Having it yourself is acceptable in the same way that other forms of masochism and self abuse are. If someone wants to spend her own money on a pair of 56H she is allowed to . If she tries it on her teenage daughter, a welfare check might happen. The same applies to a man who wanted his favorite body part "enhanced" It is all needless visual enhancements. Your whiter than white teeth are just as real and useful as a penis extension and you inflicted pain, discomfort and financial strain to be "improved".

      Those glow-in-the dark teeth don't look good. They seem to be a point of pride with people - perhaps in the same way that some people still despise work-calloused hands.

  2. Most things can be fixed with basic IT security. by jellomizer · · Score: 4, Interesting

    The problem is there are a lot of things under basic IT security and it is nearly impossible to checklist them all.
    Health Care tends to be at least a decade behind in technology and implementing new technology is a big deal, because breaking a downstream system, could cost someones life. So there is nearly always a big queue of things that should be done that you just can't get business approval to do.

    --
    If something is so important that you feel the need to post it on the internet... It probably isn't that important.
  3. doctors independent contractors / own offices by Joe_Dragon · · Score: 1

    doctors independent contractors / own offices have to do there own IT. Other times they are stuck on old apps that may need ADMIN rights and even only run in windows XP.

    1. Re:doctors independent contractors / own offices by Anonymous Coward · · Score: 0

      Other times they are stuck on old apps that may need ADMIN rights and even only run in windows XP.

      As one of those stick-in-the-muds who have complained about MS's striving to "improve"* Windows, this is a great example of a market failure. There's clearly a massive consumer base of systems that the only real desire is to receive security updates with a minimal of breakage--hopefully none. To that end, I honestly blame MS the most for this.

      * Not to say I have an actual issue with MS having a "consumer" grade version of Windows. Hell, MS went out of their way to merge the consumer and business versions of Windows in Windows XP and look how it's bitten business in the ass so much. Meanwhile, they still have a separate "Server" line of Windows. It'd seem obvious to also have a "Windows XP Enterprise" funded mostly by service contracts. But, again, "market failure".

    2. Re:doctors independent contractors / own offices by hakioawa · · Score: 2

      doctors independent contractors / own offices have to do there own IT. Other times they are stuck on old apps that may need ADMIN rights and even only run in windows XP.

      This wasn't the case though. The majority of infections were in unpatched Win7 machines. And for the specific issue one of the major reasons for NOT patching was the need to communication with SMB1 servers. Most frequently these server run Linux.

    3. Re:doctors independent contractors / own offices by dhaen · · Score: 1

      Well those same IT people should have patched the servers! Oh wait, they probably knew sweet FA about Unix.

    4. Re:doctors independent contractors / own offices by ewanm89 · · Score: 2

      Samba 3.6 added basic support for SMB2.0. This support was essentially complete except for one big item:
      durable file handles (Added in Samba 4.0.0).

                                            Release Notes for Samba 3.6.0
                                                          August 9, 2011

      So more unpatched software is what you are saying?

    5. Re:doctors independent contractors / own offices by Anonymous Coward · · Score: 0

      It is not possible to have an application that runs *only* in Windows XP. If it was written to the Win32 API (which has not changed for more than a decade) it will work on all versions of WIndows implementing the Win32 API.

      Only very very very very very badly written applications are not compatible with later versions of Windows.

    6. Re: doctors independent contractors / own offices by Anonymous Coward · · Score: 0

      The Linux servers are running old versions of SMB to support the old versions of Windows on scanners. The versions of Windows cannot be updated without recertification or replacement of the scanners in many instances. A better solution would be bridging those scanners but that's an additional layer of complexity and cost with declining budgets in real terms.

    7. Re:doctors independent contractors / own offices by Anonymous Coward · · Score: 0

      The majority of infections were in unpatched Win7 machines.

      In the hospital where I work. The (under 5% of) systems running XP were not hit at all. That makes me wonder what it would have been like if we had not "up"graded. Perhaps we would have been completely immune.

    8. Re:doctors independent contractors / own offices by Gonoff · · Score: 1

      Well those same IT people should have patched the servers! Oh wait, they probably knew sweet FA about Unix.

      Two comments...
      1. We do know Unix thanks
      2. This knowledge is mostly irellevant as the vast majority of our servers use Windows.

      --
      I'll see your Constitution and raise you a Queen.
    9. Re:doctors independent contractors / own offices by Anonymous Coward · · Score: 0

      It is not possible to have an application that runs *only* in Windows XP. If it was written to the Win32 API (which has not changed for more than a decade) it will work on all versions of WIndows implementing the Win32 API.

      Only very very very very very badly written applications are not compatible with later versions of Windows.

      For a long time, we had a number of major, web-based applications that were specifically written to run in only IE 5.5 or 6. If that is your defenition of badly written, you will find few people to argue with you.

      Now those same apps are slowly being forced to move from IE9 to IE11 but they will not work under Edge or Chrome (whick would feel better).

  4. No shit Sherlock by amalcolm · · Score: 2

    I wonder who got paid ££££ to come to THAT conclusion

    --
    Time for bed, said Zebedee - boing
    1. Re:No shit Sherlock by DivineKnight · · Score: 3, Insightful

      But security costs money!

    2. Re:No shit Sherlock by forkfail · · Score: 1

      Especially the paying out of all those golden parachutes to CTO's...

      --
      Check your premises.
    3. Re:No shit Sherlock by Opportunist · · Score: 1

      Then toss the fuckers with lead parachutes and out of your 17th floor. Read your Sun Tsu, as soon as 2 have hit the concrete, the rest will suddenly be MUCH more compliant.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    4. Re:No shit Sherlock by Altrag · · Score: 1

      Trouble is, its also their 17th floor. So unless they feel like throwing themselves out, this isn't really a thing that can be done short of revolution essentially.

    5. Re:No shit Sherlock by Opportunist · · Score: 1

      I know my CTO. Trust me, I can toss that wet noodle.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  5. Brits need to buy a clue... by Anonymous Coward · · Score: 0

    "The Basics of Information Security, Second Edition: Understanding the Fundamentals of InfoSec in Theory and Practice" by Jason Andress

    1. Re:Brits need to buy a clue... by jabuzz · · Score: 1

      Right so a link to a USA commerce website urging British people to buy a book! Let's try that again with a link to the UK Amazon web site.

      https://www.amazon.co.uk/Basic...

  6. Could start with by Anonymous Coward · · Score: 0

    Basic IT staff. Seems the majority of workers have been outsourced all that's left is some low level workers (change your keyboard level) and a few overworked admins who don't have any power to get the required changes past the pen pushers.

    IT is seen as a low end job but when staff and patients rely on IT working it really should be a priority especially considering their push towards digitising everything.

  7. Protect vs. WannaCry easily... apk by Anonymous Coward · · Score: 1

    From MS - SMB Ports 445/139 (TCP) & 137/138 (UDP) protection via regedit.exe:

    Disable SMBv1 on the SERVER, configure the following registry key:

    Registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters Registry entry: SMB1

    REG_DWORD: 0 = Disabled
    REG_DWORD: 1 = Enabled

    Default: 1 = Enabled

    Enable SMBv2 on the SERVER, configure the following registry key:

    Registry subkey:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters Registry entry: SMB2

    REG_DWORD: 0 = Disabled
    REG_DWORD: 1 = Enabled

    Default: 1 = Enabled

    ---

    Disable SMBv1 on the CLIENT, run the following commands:

    sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi

    sc.exe config mrxsmb10 start= disabled

    Enable SMBv2 & SMBv3 on the CLIENT, run the following commands:

    sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi

    sc.exe config mrxsmb20 start= auto

    ---

    * The above is per https://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1,-smbv2,-and-smbv3-in-windows-vista,-windows-server-2008,-windows-7,-windows-server-2008-r2,-windows-8,-and-windows-server-2012/

    (THIS HAS BEEN PATCHED but you can protect this way too & it works...)

    Not sure if this works in a "mixed-mode" network though (check MS link) using older Windows (e.g. XP/2000 etc.).

    APK

    P.S.=> For a SINGLE 'standalone' non-networked PC (no home network/LAN but TCP/IP connected online) turn off Server & Workstation services.

    That shuts off any "handles" (port 445) this thing propogates thru + turn off NetBIOS over TCP/IP in your internet connection & uncheck/disable Client for Microsoft Networks + File and Print Sharing. Port 139 & 445 always pop up issues over time. It also makes your packet trains smaller (no encapsulation of LanMan)

    I covered all this 11++ yrs. ago in a security guide I wrote for users with a single system & apparently, its advice STILL STANDS THE "TEST OF TIME" https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&btnG=Google+Search&gbv=1/ vs. even today's threats like this one.

    * This effectively makes this threat a non-issue + saves you CPU cycles/RAM & other I/O wasted on services you don't NEED as a single PC user only... & you don't. They're just wastes with a single PC really. Many services are (covered in guide above based on CIS Tool guidance (who took fixes to their ware from "yours truly" too, no less)) & again, no more encapsulated packet bulk.

    AND?

    Don't be STUPID & click on attachments in bogus malicious emails this thing propogates thru also (Chrome/Opera/Webkit users - BEWARE of the ShellControlFile issue that just popped up (.scf file) noted here-> http://www.theregister.co.uk/2017/05/17/chrome_on_windows_has_credential_theft_bug/ ) ... apk

    1. Re:Protect vs. WannaCry easily... apk by Anonymous Coward · · Score: 0

      The funny thing is that the trick you've posted won't save NHS from being infected. NHS machines needs LAN access because other resources were only available only thru LAN. Your trick will work for stand alone home computers but home PC's have firewalls at the router also, which makes your tip useless I guess.

  8. Tell that to TNT by Anonymous Coward · · Score: 0

    It took the NHS a few days to recover, ask TNT how long it took them.

  9. basic best practice by Anonymous Coward · · Score: 0

    "basic IT security best practice." what? It's either basic practices or best practices, it can't be both.

  10. Surprised? No... by The+Cynical+Critic · · Score: 1

    Can't say I'm particularly surprised as it seems like the only government-run places where you'll see even halfway decently managed IT is in agencies that handle state secrets relating to subjects like defense and diplomacy. Everywhere else IT tends to be thoroughly mismanaged due to incompetent management, interference from non-IT management, insufficient budget to do the job properly or a combination of these.

    Not that using XP, an OS known to be thoroughly insecure by design, after official support ended helped matters. You'd have hoped that they would have at least migrated to Windows 7, which is a massive step forwards in terms of security, but it seems like there was a massive organizational failure for the NHS to have found themselves with their pants down like this.

    --
    "Why should I want to make anything up? Life's bad enough as it is without wanting to invent any more of it."
    1. Re:Surprised? No... by Anonymous Coward · · Score: 0

      You'd have hoped that they would have at least migrated to Windows 7, which is a massive step forwards in terms of security,

      The whole report was published by UK NHS and most of the infected machines at NHS were Win7. Your post is garbage because I am on XP with no AV since 2013. I cannot tell you for sure if I am infected but I have my router logs to show you as proof that the outbout connections are all clean and not a single C&C connections from my XP so far. The only culprit on my router logs are Android and iOS gadgets with all types of telemetry and data slurping happening on the background.

  11. Re:Most things can be fixed with basic IT security by Anonymous Coward · · Score: 0

    So there is nearly always a big queue of things that should be done that you just can't get business approval to do.

    Which leads ultimately to outsourcing and service based view on the IT. If the business experts don't understand accounting, physical security, cleaning or legal services, they buy those from the providers as well. Then they can fulfill any compliance requirements to the monitoring authorities or courts, whatever they might be.

  12. Rudd = laughable by Anonymous Coward · · Score: 0

    The spooks at GCHQ want to monitor everyone else. Meanwhile, Amber Rudd admits she doesnâ(TM)t understand encryption and the government cannot even protect its own data.

  13. Don't assume the secret stuff is that good either by raymorris · · Score: 2

    > it seems like the only government-run places where you'll see even halfway decently managed IT is in agencies that handle state secrets relating to subjects like defense and diplomacy.

    You might be surprised at the crap you see at those agencies too. "Defense and diplomacy" you say, so for example the State Department. Can you imagine if the top-level head of the State Department, the Secretary of State, was handling "subjects like defense and diplomacy" by using an out-of-date, unpatched mail server set up in her house by some idiot whose education in the field consisted of asking basic questions on Reddit, a guy who apparently couldn't even be bothered to read the manual? Yeah, that's the IT security we get for " state secrets relating to subjects like defense and diplomacy".

  14. Re:Most things can be fixed with basic IT security by Anonymous Coward · · Score: 0

    LOL no all these 'ransomware' outbreaks can be prevented 100% with one simple trick: NOT BEING STUPID. Sadly people are stupid and they're getting more stupid as time passes, not smarter, so they're falling for stupider and stupider tricks, then crying and whining about how unfair it is that they've been taken advantage of. People working in the healthcare industry tend to be even more stupid because they're overworked and chronically sleep deprived.

  15. Blame the victim in CIA/NSA hoarding of exploits.. by Anonymous Coward · · Score: 0

    Hands up those who have had patches cause no outage?

  16. are you saying by Anonymous Coward · · Score: 0

    Unqualified individuals are just throwing medical equiptment on the internet? Not only on the internet you say, but without being behind a router?

    Of course hospitals are. Hospitals have been for decades. This is a Hiring issue, not a security issue.

  17. Re:Most things can be fixed with basic IT security by Kjella · · Score: 3

    Which leads ultimately to outsourcing and service based view on the IT. If the business experts don't understand accounting, physical security, cleaning or legal services, they buy those from the providers as well. Then they can fulfill any compliance requirements to the monitoring authorities or courts, whatever they might be.

    It doesn't solve the fundamental problem, which is that a lot of medical software is sold with some very specific system requirements and they're not certified to work on anything else. Part of it is that the liability is huge, part of it is that the vendors know they got the clients over a barrel. So you got a hodgepodge of outdated and obsolete configurations and it's not like a hospital will shut down a million dollar MRI machine or operating theater equipment simply because the OS is out of support or only supports SMBv1. You can red-flag it in a compliance report but unless there's actually money in the budget for a replacement system it's just CYA documentation. Worse yet if the product is EOL or the vendor has quit or if the new system is such a big change it's not really an upgrade anymore.

    Microsoft actually used to be best in class here with their 5+5 support on client desktops. With their new "life of device" who knows, as vendors tend to not give a shit when the warranty has expired. But I think there will be a demand for like really long term support, I mean XP lived for well over 10 years and Win7 is still king of the hill, if only you got security patches I think many could run the same OS for decades. Particularly in a business context where you might only run a few vertically integrated applications and the OS is almost invisible.

    --
    Live today, because you never know what tomorrow brings
  18. Basic IT Practice by Khyber · · Score: 1

    Keep critical systems off the internet. This way your only method of attack is an insider.

    Human laziness enabled this mess - and the UK and USA are fucking hotbeds of laziness and useless bloat.

    I say this as an American.

    --
    Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
  19. Sorry what? by citylivin · · Score: 1

    What basic IT security practices are they refering to? everyone keeps saying that, but to me that sounds like a user that heard "someone from IT" use those words and then parots them to everyone till it becomes fact.

    It would be nice, you know, on a technical site, to actually list somewhere what the referenced "basic IT security" steps to prevent this were IN THIS SPECIFIC INSTANCE.

    Not like generally, as some comments are doing. Was it everyone running as admin? were they not running virus scanners? not segmenting the network? Patching too slow (obviously!)? I mean if its a report on this, can we get more specifics? that would be the interesting part! Not just people shit talking different departments. An actual technical discussion would be nice.

    Maybe next article...

    --
    As a potential lottery winner, I totally support tax cuts for the wealthy
    1. Re:Sorry what? by Anonymous Coward · · Score: 0

      But not likely. Actual information does not sell newspapers (and ads). Only hot air, posturing, and sensationalism does that.

    2. Re:Sorry what? by Anonymous Coward · · Score: 0

      Exactly my sentiment. I was searching for that BASIC IT SECURITY PRACTICES to at least arm myself with new knowledge.

      Was it everyone running as admin?
      This is not required for the exploit to flourish, because the payload will elevate itself as SYSTEM and traverse the whole of your LAN with open SMB1 port 445.

  20. Cluttered IT closets by Anonymous Coward · · Score: 0

    What they needed was clean closets for storing things. If they had only hired creimer - he works for pennies, too! - their IT closets would have been the envy of the industry.

    And I think we all know that with clean IT closets, these hacks are next to impossible.

    Just one more disaster that could have been prevented by an IT miracle worker.

  21. Re:Most things can be fixed with basic IT security by jellomizer · · Score: 1

    It isn't that people are now more stupid, it is that more stupid people have access to technology.

    --
    If something is so important that you feel the need to post it on the internet... It probably isn't that important.
  22. Not SOP by Anonymous Coward · · Score: 0

    But, "Basic IT Security" costs MONEY.

    Can't have that now can we. It cuts into the CIO's bonus.

  23. Re:Most things can be fixed with basic IT security by Anonymous Coward · · Score: 0

    So you got a hodgepodge of outdated and obsolete configurations and it's not like a hospital will shut down a million dollar MRI machine or operating theater equipment simply because the OS is out of support or only supports SMBv1.

    It does sound like they could use some IT support, or take the liability hit when they lose patients over avoidable technical issues or sanctions over a review. They are out of business anyway if they can't pay their liability insurances. Doctors and nurses are trained to understand hygiene and dealing with immunodeficient patients, so maybe the jump to understanding data hygiene and how to interact with obsolete information systems wouldn't be such a large issue.

  24. Wrong: Above my ps allows LAN by Anonymous Coward · · Score: 0

    Wrong: Above my ps allows LAN use (butt not in "mixed mode" environs it notes (older Windows OS only SMB1 & no SMB2/3)).

    APK

    P.S.=> Funny thing here is you need to learn to read & how to network (hope this taught you part of it)... apk