6 ms·

Existing discussion thread: https://news.ycombinator.com/item?id=14324129 https://news.ycombinator.com/item?id=14324129 --------- Shutting everything down see

by lol768 9y ago

Existing discussion thread: https://news.ycombinator.com/item?id=14324129 https://news.ycombinator.com/item?id=14324129 --------- Shutting everything down seems like a really rash response, especially when these systems seem to be used for critical communication e.g. the phones too. The Twitter messages seem to suggest that doctors are seeing this on their personal machines, but why would this impact the phone system? Are they not separated out? I'm also really curious as to how this started. The article mentions a "bug" in the IT systems - some sort of novel zero day in the software they're using that was exploited remotely? Or is it more likely someone screwed up and ran something without thinking? There are reports on twitter that this is impacting X-rays, pagers as well as the phone system. This is ridiculous if true and suggests there have been some major failings when putting this infrastructure in place. Perhaps underinvestment in IT is to blame.

s_kilk 9y ago
> Perhaps underinvestment in IT is to blame. Or, indeed, over-investment in trash-tier IT services provided by blood-sucking IT consulting companies. I've seen the insides of some UK Government IT systems (not the NHS), and it's astonishing how little functional software one can get in exchange for a few hundred million sterling. That, and the bitrot of holding on to ancient, never-updated IT systems. [Edit], back on topic, I sincerely hope whoever did this is burned alive for their crimes.
- rubatuga 9y ago
  The whole EHR market is absolute crap in Canada too. You have around 10 competing standards with no interoperability, multiple data sources cobbled together through webpage links, and all running on a slow as fuck central server that you Citrix into. Another research department I worked at was seriously underfunded, which resulted in questionable decisions, such as using round cube for email, and a central shared drive with a Microsoft access database containing patient data. Hospitals have terrible security.
  - jensv 9y ago
    What is the issue or alternative to Roundcube? I thought they were pretty good.
    - rubatuga 9y ago
      It's a terrible UI for webmail, and our webmail was subject to a hack a few weeks ago, and they've since closed off WAN access. I'm pretty sure it was related to roundcube. Which is a bummer.
- vertex-four 9y ago
  To be fair - healthcare IT infrastructure sucks everywhere, even in the country most well-known for remarkably expensive privatised healthcare. It's not really obvious at this point how to fix it. Have the Government Digital Service or similar work on it directly and ditch the contractors?
  - s_kilk 9y ago
    > Have the Government Digital Service or similar work on it directly and ditch the contractors? Basically, yes. Bring it all in-house, ban the contractors/consultants/mercenaries/etc. Remove the profit motive and suddenly you don't have millions of dollars/pounds being siphoned off by vampiric consultancies and third-party vendors. Suddenly you can spend tax-payers money in a sane and rational way. Hire a bunch of talented people who care about the wellbeing of their nation state, pay them well enough and task them with building the best systems possible in the most efficient way possible.
    - arcbyte 9y ago
      I agree with your solutiom, but there is far, far less blood sucking going on than you might imagine and far, far more organizational incompetence. That is, organizations hire contractors and then dont know how to tell them what they want, but simultaneously refuse to let the contractor have initiative because they dont know how to set up a pay structure for it. Businesses screw themselves.
      - w4tson 9y ago
        Yeah but the truth isn't as exciting as thinking you can write DJango app to save the NHS. It's far more fun to think you can knock something up with your friends in a few months. Then requirements start coming in, the stakeholders, the politics. The multi faceted organizations, the disparate teams with never ending edge cases. 3 years later when it's past phase 2 and creaking at the seams, along comes the next upstart... DJango! Which idiot picked that?!!! Me n my friends could....
    - pjc50 9y ago
- matthewmacleod 9y ago
  Or, indeed, over-investment in trash-tier IT services Yeah, I think this is probably closer to what's happening. I've worked with some of these Enterprise-level IT consultancies in the past. I do understand that it's quite a different market from the lean, tech-focused web development market, but some of the solutions I've seen implemented are shockingly* bad.
- arethuza 9y ago
  I wonder if it would be appropriate to "dramatically overreact" and send in the SAS or similar to send a polite message that mucking with the NHS is really not a good idea. Maybe post offer a decent reward - say £10 million for information leading to the identification of the culprits.
  - toyg 9y ago
    If this trend of targeting large institutions continues, yeah, I can see someone eventually "overreacting" with black ops. This said, they're probably popping champagne at Tory HQ right about now.
    - sirkneeland 9y ago
      wouldn't they be popping corks at Labour HQ? I mean, this isn't really "strong and stable"...
      - toyg 9y ago
        Labour won't attack on this because they know it might have happened to them just as easily, whereas it fits the Tory narrative that "the NHS is useless and should be privatised" with almost no spin.
      - arethuza 9y ago
        The NHS is fundamentally a socialist endeavour - any failings in it are obviously the fault of socialism!
        keithpeter 9y ago
        Most of my local Tories know that any kind of direct assault on the NHS would result in instant annihilation at the next election. There are more subtle methods of course including outrageously broken internal market management restructures (Stafford Hospital Trust, 'fund holding GPs' in the time of Thatcher) and the like.
  - 9y ago
- mathnode 9y ago
  Exactly this. When ever anything comes to tender, out of the usual three on the table, the cheapest will always be chosen. And because departments are left to their own devices, they solve all their problems with shared drives and excel sheets. Ransomware is the hero we didn't ask for.
AndrewKane 9y ago
she was a waitress in a cocktail bar now she owns a jet... http://bit.ly/2jdTzrM http://bit.ly/2jdTzrM
m0nty 9y ago
Everything is a "bug" according to most journalists. We'll probably get something a bit more coherent from Ars Technica or The Register. WRT the failings: I've worked in IT in the UK for more than 25 years, and I have never (until now) worked in a place that took security seriously. That includes schools, a large accountancy firm, several well-known public sector establishments, a political campaign, etc. "Optimistic security" is the model here, and hospitals have huge rambling networks with many legacy systems and third-party solutions. I would be surprised if they don't have security issues. Where they are secure, it's probably down to some unsung hero(es) somewhere, who took it on themselves to push security. (I've done this myself and it's a thankless task; nobody notices or cares. Dogs not barking, etc.)
- gadders 9y ago
  Investment Banks take it seriously. So seriously some clown in IT Sec cut off the links to 3rd party libraries from the internal Nexus.
- thecosas 9y ago
  Ars story: https://arstechnica.com/information-technology/2017/05/nhs-ransomware-cyber-attack/ https://arstechnica.com/information-technology/2017/05/nhs-r...
- lol768 9y ago
  > Everything is a "bug" according to most journalists. We'll probably get something a bit more coherent from Ars Technica or The Register. That's a good point, tech journalism is usually pretty poor. https://twitter.com/ShaunLintern/status/863039464649744384 https://twitter.com/ShaunLintern/status/863039464649744384 suggests it's significantly more boring than a zero-day (though still incredibly problematic). Your experiences with UK IT make for depressing reading.
  - m0nty 9y ago
    > Your experiences with UK IT make for depressing reading. I am astonished that even skilled techies don't take security seriously, using passwords like their car registration or company name - I've seen that with a military contractor, ffs. People who had signed the Official Secrets Act and had network links into supposedly secure sites. It depresses me too.
count 9y ago
Voip phones run on windows servers! Thanks Cisco.
sctb 9y ago
We've merged threads with that original from https://news.ycombinator.com/item?id=14324303 https://news.ycombinator.com/item?id=14324303.

by lol768 9y ago

s_kilk 9y ago

> Perhaps underinvestment in IT is to blame. Or, indeed, over-investment in trash-tier IT services provided by blood-sucking IT consulting companies. I've seen the insides of some UK Government IT systems (not the NHS), and it's astonishing how little functional software one can get in exchange for a few hundred million sterling. That, and the bitrot of holding on to ancient, never-updated IT systems. [Edit], back on topic, I sincerely hope whoever did this is burned alive for their crimes.

rubatuga 9y ago
The whole EHR market is absolute crap in Canada too. You have around 10 competing standards with no interoperability, multiple data sources cobbled together through webpage links, and all running on a slow as fuck central server that you Citrix into. Another research department I worked at was seriously underfunded, which resulted in questionable decisions, such as using round cube for email, and a central shared drive with a Microsoft access database containing patient data. Hospitals have terrible security.
- jensv 9y ago
  What is the issue or alternative to Roundcube? I thought they were pretty good.
  - rubatuga 9y ago
    It's a terrible UI for webmail, and our webmail was subject to a hack a few weeks ago, and they've since closed off WAN access. I'm pretty sure it was related to roundcube. Which is a bummer.
vertex-four 9y ago
To be fair - healthcare IT infrastructure sucks everywhere, even in the country most well-known for remarkably expensive privatised healthcare. It's not really obvious at this point how to fix it. Have the Government Digital Service or similar work on it directly and ditch the contractors?
- s_kilk 9y ago
  > Have the Government Digital Service or similar work on it directly and ditch the contractors? Basically, yes. Bring it all in-house, ban the contractors/consultants/mercenaries/etc. Remove the profit motive and suddenly you don't have millions of dollars/pounds being siphoned off by vampiric consultancies and third-party vendors. Suddenly you can spend tax-payers money in a sane and rational way. Hire a bunch of talented people who care about the wellbeing of their nation state, pay them well enough and task them with building the best systems possible in the most efficient way possible.
  - arcbyte 9y ago
    I agree with your solutiom, but there is far, far less blood sucking going on than you might imagine and far, far more organizational incompetence. That is, organizations hire contractors and then dont know how to tell them what they want, but simultaneously refuse to let the contractor have initiative because they dont know how to set up a pay structure for it. Businesses screw themselves.
    - w4tson 9y ago
      Yeah but the truth isn't as exciting as thinking you can write DJango app to save the NHS. It's far more fun to think you can knock something up with your friends in a few months. Then requirements start coming in, the stakeholders, the politics. The multi faceted organizations, the disparate teams with never ending edge cases. 3 years later when it's past phase 2 and creaking at the seams, along comes the next upstart... DJango! Which idiot picked that?!!! Me n my friends could....
  - pjc50 9y ago
matthewmacleod 9y ago
Or, indeed, over-investment in trash-tier IT services Yeah, I think this is probably closer to what's happening. I've worked with some of these Enterprise-level IT consultancies in the past. I do understand that it's quite a different market from the lean, tech-focused web development market, but some of the solutions I've seen implemented are shockingly* bad.
arethuza 9y ago
I wonder if it would be appropriate to "dramatically overreact" and send in the SAS or similar to send a polite message that mucking with the NHS is really not a good idea. Maybe post offer a decent reward - say £10 million for information leading to the identification of the culprits.
- toyg 9y ago
  If this trend of targeting large institutions continues, yeah, I can see someone eventually "overreacting" with black ops. This said, they're probably popping champagne at Tory HQ right about now.
  - sirkneeland 9y ago
    wouldn't they be popping corks at Labour HQ? I mean, this isn't really "strong and stable"...
    - toyg 9y ago
      Labour won't attack on this because they know it might have happened to them just as easily, whereas it fits the Tory narrative that "the NHS is useless and should be privatised" with almost no spin.
    - arethuza 9y ago
      The NHS is fundamentally a socialist endeavour - any failings in it are obviously the fault of socialism!
      - keithpeter 9y ago
        Most of my local Tories know that any kind of direct assault on the NHS would result in instant annihilation at the next election. There are more subtle methods of course including outrageously broken internal market management restructures (Stafford Hospital Trust, 'fund holding GPs' in the time of Thatcher) and the like.
- 9y ago
mathnode 9y ago
Exactly this. When ever anything comes to tender, out of the usual three on the table, the cheapest will always be chosen. And because departments are left to their own devices, they solve all their problems with shared drives and excel sheets. Ransomware is the hero we didn't ask for.

AndrewKane 9y ago

she was a waitress in a cocktail bar now she owns a jet... http://bit.ly/2jdTzrM http://bit.ly/2jdTzrM

m0nty 9y ago

Everything is a "bug" according to most journalists. We'll probably get something a bit more coherent from Ars Technica or The Register. WRT the failings: I've worked in IT in the UK for more than 25 years, and I have never (until now) worked in a place that took security seriously. That includes schools, a large accountancy firm, several well-known public sector establishments, a political campaign, etc. "Optimistic security" is the model here, and hospitals have huge rambling networks with many legacy systems and third-party solutions. I would be surprised if they don't have security issues. Where they are secure, it's probably down to some unsung hero(es) somewhere, who took it on themselves to push security. (I've done this myself and it's a thankless task; nobody notices or cares. Dogs not barking, etc.)

gadders 9y ago
Investment Banks take it seriously. So seriously some clown in IT Sec cut off the links to 3rd party libraries from the internal Nexus.
thecosas 9y ago
Ars story: https://arstechnica.com/information-technology/2017/05/nhs-ransomware-cyber-attack/ https://arstechnica.com/information-technology/2017/05/nhs-r...
lol768 9y ago
> Everything is a "bug" according to most journalists. We'll probably get something a bit more coherent from Ars Technica or The Register. That's a good point, tech journalism is usually pretty poor. https://twitter.com/ShaunLintern/status/863039464649744384 https://twitter.com/ShaunLintern/status/863039464649744384 suggests it's significantly more boring than a zero-day (though still incredibly problematic). Your experiences with UK IT make for depressing reading.
- m0nty 9y ago
  > Your experiences with UK IT make for depressing reading. I am astonished that even skilled techies don't take security seriously, using passwords like their car registration or company name - I've seen that with a military contractor, ffs. People who had signed the Official Secrets Act and had network links into supposedly secure sites. It depresses me too.

count 9y ago

Voip phones run on windows servers! Thanks Cisco.

sctb 9y ago

We've merged threads with that original from https://news.ycombinator.com/item?id=14324303 https://news.ycombinator.com/item?id=14324303.