3 ms·

What I don't understand is how can any malware get installed on a server storing critical hospital data? And why is it running Windows? Do hospitals store their

What I don't understand is how can any malware get installed on a server storing critical hospital data? And why is it running Windows? Do hospitals store their data on workstations used by employees?

masklinn 11y ago
> And why is it running Windows? Do hospitals store their data on workstations used by employees? You are aware that there are server editions of Windows right? And that they don't exist for the fun of it?
- lukaslalinsky 11y ago
  Yes, but I could not imagine some admin installing the malware by mistake. Reading more on it, I stand corrected. The malware gets installed thanks to a buggy version of JBoss allowing remote execution access to the server.
  - masklinn 11y ago
    Yes, and the malware may not even have to be installed on the server, there are many companies and systems with dodgy security practices (either just because, or because a legacy application needs that, or whatever). If the hospital has its stuff on a NAS, any infected computer with write access to that NAS will be able to hit it.
  - tamana 11y ago
    Almoat all malware is installed by mistake, or by exploiting a bug.
- PhantomGremlin 11y ago
  You are aware that there are server editions of Windows right? But why is Windows still used anywhere that security is important? Shouldn't "best practices" imply that anything Windows-related be shunned? In 2002 Chairman Bill said "Security is top priority".[1] It's 2016 and the problems seem as bad as ever. Okay, maybe Linux, OpenBSD, et al. would have as bad or worse problems if they were in such widespread use. But, after so many years, isn't it time to give those other OSes a chance? They might actually be better, not worse. [1] http://www.cnet.com/news/gates-security-is-top-priority/ http://www.cnet.com/news/gates-security-is-top-priority/
21 11y ago
As the article says, most were infected through misconfigured JBoss installations, which exposed the JMX control console to the web. The article also implied that this is some sort of default JBoss setting. So the initial infection had nothing to do with Windows.
- xenadu02 11y ago
  I'll also assume JBoss installs its services as SYSTEM, instead of creating limited-permission accounts. Microsoft historically hasn't done a good job of making it easy (and the default) to set things up this way though they take it a lot more seriously now. NTFS supports permission execute on ACLs and the system enforces them. I wish they had made a policy decision to default that to off and require you re-auth with admin credentials to set the bit. It would work more like +x/chmod/sudo does and prevent a decent number of such things.

masklinn 11y ago

> And why is it running Windows? Do hospitals store their data on workstations used by employees? You are aware that there are server editions of Windows right? And that they don't exist for the fun of it?

lukaslalinsky 11y ago
Yes, but I could not imagine some admin installing the malware by mistake. Reading more on it, I stand corrected. The malware gets installed thanks to a buggy version of JBoss allowing remote execution access to the server.
- masklinn 11y ago
  Yes, and the malware may not even have to be installed on the server, there are many companies and systems with dodgy security practices (either just because, or because a legacy application needs that, or whatever). If the hospital has its stuff on a NAS, any infected computer with write access to that NAS will be able to hit it.
- tamana 11y ago
  Almoat all malware is installed by mistake, or by exploiting a bug.
PhantomGremlin 11y ago
You are aware that there are server editions of Windows right? But why is Windows still used anywhere that security is important? Shouldn't "best practices" imply that anything Windows-related be shunned? In 2002 Chairman Bill said "Security is top priority".[1] It's 2016 and the problems seem as bad as ever. Okay, maybe Linux, OpenBSD, et al. would have as bad or worse problems if they were in such widespread use. But, after so many years, isn't it time to give those other OSes a chance? They might actually be better, not worse. [1] http://www.cnet.com/news/gates-security-is-top-priority/ http://www.cnet.com/news/gates-security-is-top-priority/

21 11y ago

As the article says, most were infected through misconfigured JBoss installations, which exposed the JMX control console to the web. The article also implied that this is some sort of default JBoss setting. So the initial infection had nothing to do with Windows.

xenadu02 11y ago
I'll also assume JBoss installs its services as SYSTEM, instead of creating limited-permission accounts. Microsoft historically hasn't done a good job of making it easy (and the default) to set things up this way though they take it a lot more seriously now. NTFS supports permission execute on ACLs and the system enforces them. I wish they had made a policy decision to default that to off and require you re-auth with admin credentials to set the bit. It would work more like +x/chmod/sudo does and prevent a decent number of such things.