5 ms·

Shutting everything down seems like a really rash response, especially when these systems seem to be used for critical communication e.g. the phones too. The Tw

by lol768 9y ago

Shutting everything down seems like a really rash response, especially when these systems seem to be used for critical communication e.g. the phones too. The Twitter messages seem to suggest that doctors are seeing this on their personal machines, but why would this impact the phone system? Are they not separated out? I'm also really curious as to how this started. The article mentions a "bug" in the IT systems - some sort of novel zero day in the software they're using that was exploited remotely? Or is it more likely someone screwed up and ran something without thinking? Edit: There are reports on twitter that this is impacting X-rays, pagers as well as the phone system. This is ridiculous if true and suggests there have been some major failings when putting this infrastructure in place.

FLUX-YOU 9y ago
>There are reports on twitter that this is impacting X-rays, pagers as well as the phone system. This is ridiculous if true and suggests there have been some major failings when putting this infrastructure in place. Take a look at that operating system and the UI from the article and tell me how that's unexpected.
- alex_hitchins 9y ago
  That will be stock photography, rather than taken today.
  - FLUX-YOU 9y ago
    It is still accurate. We still have XP machines floating around our campus. They are running EMR software.
    - lol768 9y ago
      Are they paying Microsoft for extended support?
      - alex_hitchins 9y ago
        What does this cover provide? Any ideas? I assume every customer is different?
      - throwaway049 9y ago
        Yes. NHS has a national level support agreement for XP. There are a lot of legacy systems and it's not just the bother of replacing the system, there are a lot of front line staff who only know how to use specific applications and are not generally computer literate so moving them to new systems will slow everything down for weeks or months as they learn a new application.
    - alex_hitchins 9y ago
      Christ. There is no excuse for that whatsoever. A live machine?
      - FLUX-YOU 9y ago
        >There is no excuse for that whatsoever. Except for budget and non-technical leadership in technical leadership roles
      - pjc50 9y ago
        If the software doesn't run on versions higher than XP, then there's no alternative. There's a lot of expensive equipment which is stuck on XP.
        mercurial 9y ago
        Virtual machines are a thing.
        pjc50 9y ago
        How does that help? We're talking about devices that need, for whatever driver-related reason, to run on the bare metal. A non-health example: http://www.effectivebits.net/2011/08/to-run-windows-or-not-to-run-windows.html http://www.effectivebits.net/2011/08/to-run-windows-or-not-t...
        peterwwillis 9y ago
        And medical devices cannot just be modified after they are approved for medical use. Any changes must be introduced by the original vendor (or an approved 3rd party vendor) and put through a barrage of tests and certifications needed to release such a device for use on a human. Those include EMC/EMI testing, QC testing, safety testing, RF testing, clinical trials, regulatory compliance, etc. When you buy a medical device running Windows 3.1, it will run that until it is thrown away or replaced.
- excalibur 9y ago
  I'm not sure which article you were referencing, but the pictures in the Guardian piece clearly show Windows 7.
oneeyedpigeon 9y ago
How on earth could an X-ray machine be affected? Why the hell does the NHS have an X-ray connected to the Internet?
- nopcode 9y ago
  It's hopefully not connected to the internet, but to the local network. Many medical appliances in hospitals expose remote control over regular tcp/ip, Preferably running Windows XP or CE.
  - oneeyedpigeon 9y ago
    I wasn't seriously suggesting it was directly connected, but my understanding (and I am far from knowledgeable when it comes to security) is that mission-critical devices should be physically 'firewalled' from the Internet, and even any network.
    - alexsays 9y ago
      They should be; but security in government organisations is pretty bad. They are heavy on security on it, but in completely ineffectual areas.
    - iak8god 9y ago
      If you do that, how do the images get from the x-ray machine to the radiologist for analysis? How do they end up as part of the electronic health record & accessible for future use? If you create an air gap and ask people to use USB sticks to move data from "mission-critical" systems to the main network, you only slightly reduce the risk of those systems becoming infected and you now have a situation that's much less convenient (time is money) and creates a new vector for leaking personal health information.
alexsays 9y ago
If it's hitting everything it seems like it's just forking everywhere. For it to do that there must be some _really_ bad security practices

by lol768 9y ago

FLUX-YOU 9y ago

>There are reports on twitter that this is impacting X-rays, pagers as well as the phone system. This is ridiculous if true and suggests there have been some major failings when putting this infrastructure in place. Take a look at that operating system and the UI from the article and tell me how that's unexpected.

alex_hitchins 9y ago
That will be stock photography, rather than taken today.
- FLUX-YOU 9y ago
  It is still accurate. We still have XP machines floating around our campus. They are running EMR software.
  - lol768 9y ago
    Are they paying Microsoft for extended support?
    - alex_hitchins 9y ago
      What does this cover provide? Any ideas? I assume every customer is different?
    - throwaway049 9y ago
      Yes. NHS has a national level support agreement for XP. There are a lot of legacy systems and it's not just the bother of replacing the system, there are a lot of front line staff who only know how to use specific applications and are not generally computer literate so moving them to new systems will slow everything down for weeks or months as they learn a new application.
  - alex_hitchins 9y ago
    Christ. There is no excuse for that whatsoever. A live machine?
    - FLUX-YOU 9y ago
      >There is no excuse for that whatsoever. Except for budget and non-technical leadership in technical leadership roles
    - pjc50 9y ago
      If the software doesn't run on versions higher than XP, then there's no alternative. There's a lot of expensive equipment which is stuck on XP.
      - mercurial 9y ago
        Virtual machines are a thing.
        pjc50 9y ago
        How does that help? We're talking about devices that need, for whatever driver-related reason, to run on the bare metal. A non-health example: http://www.effectivebits.net/2011/08/to-run-windows-or-not-to-run-windows.html http://www.effectivebits.net/2011/08/to-run-windows-or-not-t...
        peterwwillis 9y ago
        And medical devices cannot just be modified after they are approved for medical use. Any changes must be introduced by the original vendor (or an approved 3rd party vendor) and put through a barrage of tests and certifications needed to release such a device for use on a human. Those include EMC/EMI testing, QC testing, safety testing, RF testing, clinical trials, regulatory compliance, etc. When you buy a medical device running Windows 3.1, it will run that until it is thrown away or replaced.
excalibur 9y ago
I'm not sure which article you were referencing, but the pictures in the Guardian piece clearly show Windows 7.

oneeyedpigeon 9y ago

How on earth could an X-ray machine be affected? Why the hell does the NHS have an X-ray connected to the Internet?

nopcode 9y ago
It's hopefully not connected to the internet, but to the local network. Many medical appliances in hospitals expose remote control over regular tcp/ip, Preferably running Windows XP or CE.
- oneeyedpigeon 9y ago
  I wasn't seriously suggesting it was directly connected, but my understanding (and I am far from knowledgeable when it comes to security) is that mission-critical devices should be physically 'firewalled' from the Internet, and even any network.
  - alexsays 9y ago
    They should be; but security in government organisations is pretty bad. They are heavy on security on it, but in completely ineffectual areas.
  - iak8god 9y ago
    If you do that, how do the images get from the x-ray machine to the radiologist for analysis? How do they end up as part of the electronic health record & accessible for future use? If you create an air gap and ask people to use USB sticks to move data from "mission-critical" systems to the main network, you only slightly reduce the risk of those systems becoming infected and you now have a situation that's much less convenient (time is money) and creates a new vector for leaking personal health information.

alexsays 9y ago

If it's hitting everything it seems like it's just forking everywhere. For it to do that there must be some _really_ bad security practices