5 ms·

If hackers attacked the hospital (2017)

36 points by wglb 8y ago

sp332 8y ago
I thought this story was only 4 paragraphs long, but you have to click the "continue reading" button to see the rest.
pg_bot 8y ago
I'm surprised that no one ever talks about America's e-prescribing infrastructure getting hacked. Over 99% of all electronic prescriptions are handled by a single company (surescripts). It's a massive single point of failure that could cause chaos if they were no longer able to operate. Most states are now moving to make all prescriptions electronic. It seems that not enough people know that this is a problem, but it's also another reason why prescriptions are more expensive than they should be.
- dsfyu404ed 8y ago
  Political points lost by allowing a single point of failure < political points gained by talking big about how requiring easily auditable electronic records will reduce prescription drug abuse. I'm still salty about having to get refills every 30 days (down from 90) and having to see my doctor every four months (up from a year).
- Thriptic 8y ago
  Luckily most other emerging integrations (payer - provider for eligibility checks and coverage decisions, provider - provider for real time medical record transfers, etc) are decentralized by design with a number of large aggregators. While it's possible for basically any company to get access to these networks for a nominal fee and thus facilitate a transient DDOS by flooding the network, it would be relatively easy to drop this traffic and boot them. Also doesn't McKesson have their own interface for electronic prescriptions or am I incorrect?
  - pg_bot 8y ago
    You are incorrect. https://www.healthcareitnews.com/news/surescripts-partners-mckesson https://www.healthcareitnews.com/news/surescripts-partners-m...
ransford 8y ago
It's good to see attention paid to the day-to-day challenges hospital IT folks face when grappling with medical devices. These folks deserve better. As an industry of thing-makers, we've done a pretty poor job of supporting use cases involving big diverse populations of devices that aren't centrally managed. Devices don't identify themselves in any consistent way; device makers don't allocate MAC addresses predictably from their assigned ranges; security folks often don't have link-layer visibility into their own networks; and so on. Result: hospitals are desperate to "secure" their medical devices, yet they don't know what those devices are, what patch levels they're at, or what their "baseline" behavior is supposed to be, among other things that are crucial for security. The security industry has decided that medical devices are a special case of IoT, and you can now choose from a wide variety of AI blinky boxes to send you anomaly alerts. That has been going about as well as it does in other domains. Two things that may help hospital tech workers in the coming years are: efforts like IETF's MUD [1] to make devices state their purpose clearly; and efforts like the NTIA's software transparency initiative [2] that are aiming to make manufacturers say what's in their devices. The FDA is also cracking the whip on medical device makers to incorporate security into their development processes, and they love comments from nerds who can help. </soapbox> (I am one of the academic researchers behind the defibrillator hacking [3] that inspired the Homeland episode mentioned in this article, and I've been cutting my fingers on innumerable sharp corners in hospital wiring closets on and off since then.) [1] https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/ https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/ [2] https://www.ntia.doc.gov/SoftwareTransparency https://www.ntia.doc.gov/SoftwareTransparency [3] https://www.secure-medicine.org/hubfs/public/publications/icd-study.pdf https://www.secure-medicine.org/hubfs/public/publications/ic...
- marcosdumay 8y ago
  > Devices don't identify themselves in any consistent way SNMP standardized that before sysadmins everywhere decided it was devil's reincarnation and banned all of it that they could. When working on an equivalent standard, it may be useful to think about why your standard won't suffer the same fate from the same reasons.
  - 8y ago
xs 8y ago
The Boston's Children's hospital was attached once by anonymous. This podcast covers the story very well. https://darknetdiaries.com/episode/14 https://darknetdiaries.com/episode/14

36 points by wglb 8y ago

I thought this story was only 4 paragraphs long, but you have to click the "continue reading" button to see the rest.

I'm surprised that no one ever talks about America's e-prescribing infrastructure getting hacked. Over 99% of all electronic prescriptions are handled by a single company (surescripts). It's a massive single point of failure that could cause chaos if they were no longer able to operate. Most states are now moving to make all prescriptions electronic. It seems that not enough people know that this is a problem, but it's also another reason why prescriptions are more expensive than they should be.

dsfyu404ed 8y ago
Political points lost by allowing a single point of failure < political points gained by talking big about how requiring easily auditable electronic records will reduce prescription drug abuse. I'm still salty about having to get refills every 30 days (down from 90) and having to see my doctor every four months (up from a year).
Thriptic 8y ago
Luckily most other emerging integrations (payer - provider for eligibility checks and coverage decisions, provider - provider for real time medical record transfers, etc) are decentralized by design with a number of large aggregators. While it's possible for basically any company to get access to these networks for a nominal fee and thus facilitate a transient DDOS by flooding the network, it would be relatively easy to drop this traffic and boot them. Also doesn't McKesson have their own interface for electronic prescriptions or am I incorrect?
- pg_bot 8y ago
  You are incorrect. https://www.healthcareitnews.com/news/surescripts-partners-mckesson https://www.healthcareitnews.com/news/surescripts-partners-m...

ransford 8y ago

It's good to see attention paid to the day-to-day challenges hospital IT folks face when grappling with medical devices. These folks deserve better. As an industry of thing-makers, we've done a pretty poor job of supporting use cases involving big diverse populations of devices that aren't centrally managed. Devices don't identify themselves in any consistent way; device makers don't allocate MAC addresses predictably from their assigned ranges; security folks often don't have link-layer visibility into their own networks; and so on. Result: hospitals are desperate to "secure" their medical devices, yet they don't know what those devices are, what patch levels they're at, or what their "baseline" behavior is supposed to be, among other things that are crucial for security. The security industry has decided that medical devices are a special case of IoT, and you can now choose from a wide variety of AI blinky boxes to send you anomaly alerts. That has been going about as well as it does in other domains. Two things that may help hospital tech workers in the coming years are: efforts like IETF's MUD [1] to make devices state their purpose clearly; and efforts like the NTIA's software transparency initiative [2] that are aiming to make manufacturers say what's in their devices. The FDA is also cracking the whip on medical device makers to incorporate security into their development processes, and they love comments from nerds who can help. </soapbox> (I am one of the academic researchers behind the defibrillator hacking [3] that inspired the Homeland episode mentioned in this article, and I've been cutting my fingers on innumerable sharp corners in hospital wiring closets on and off since then.) [1] https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/ https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/ [2] https://www.ntia.doc.gov/SoftwareTransparency https://www.ntia.doc.gov/SoftwareTransparency [3] https://www.secure-medicine.org/hubfs/public/publications/icd-study.pdf https://www.secure-medicine.org/hubfs/public/publications/ic...

marcosdumay 8y ago
> Devices don't identify themselves in any consistent way SNMP standardized that before sysadmins everywhere decided it was devil's reincarnation and banned all of it that they could. When working on an equivalent standard, it may be useful to think about why your standard won't suffer the same fate from the same reasons.
- 8y ago

xs 8y ago

The Boston's Children's hospital was attached once by anonymous. This podcast covers the story very well. https://darknetdiaries.com/episode/14 https://darknetdiaries.com/episode/14