8 ms·

N.J.’S Largest Hospital System Pays Up in Ransomware Attack

51 points by LinuxBender 7y ago

jakewins 7y ago
A friend of mine is an MD at a major hospital in the midwest. As I've understood it this is standard practice for them. Their computers freeze up, and the message - my friend has sent me screen shots - will say something like "Hi <hospital name>, the computer is encrypted, please contact the IT department", IT department pays the ransom and the computers kick back on. From a financial POV, as long as the ransom costs per year is lower than the cost to replace their Cerner systems, it makes sense to simply see it as the cost of operations I guess?
- JumpCrisscross 7y ago
  > as long as the ransom costs per year is lower than the cost to replace their Cerner systems, it makes sense to simply see it as the cost of operations I guess? Sort of. Unless the cost and frequency of ransomware incidents are absurdly low, it makes sense to borrow to upgrade. Putting aside the moral hazard of being a compliant mark, there is the risk that the next attack won't be as cheap. Their vendor ought to figure out the hospital's mean annual ransom payment, and come up with financing for an upgraded system that comes out to that amount. Now the cost is locked in, while the variance is sharply reduced. (No risk ever goes to zero.)
  - jakewins 7y ago
    Excellent comment, and indeed this seems like a much saner approach. I guess one complicating factor is the risk that an upgraded system remains vulnerable, which you'd need to account for in some manner.
    - JumpCrisscross 7y ago
      > one complicating factor is the risk that an upgraded system remains vulnerable, which you'd need to account for in some manner Bundle the financing with cybersecurity insurance.
- user5994461 7y ago
  That makes me wonder whether the usual malware came from phishing or vulnerabilities. If it's phishing, typical staff clicking suspicious emails and opening URLs and attachments, there isn't a lot the hospital can do to stop it. A bit of blocking around external emails and shady attachments will help, but people will still fall for it quite often. If it's remote vulnerabilities, probably some unpatched systems, it's risky because that could parallelize the whole hospital anytime, but as long as the vulnerability is patched by the ransomware it's still cheaper than doing the maintenance.
  - wcip 7y ago
    >If it's phishing, typical staff clicking every suspicious email uncarefully opening URLs and attachments, there isn't a lot the hospital can do. Not give typical staff the user permissions required to encrypt all the databases and delete the backups? Too bad info sec is so full of snake oil salesmen, obvious practical solutions exist for these type of problems they just generally don't involve spending six figures on a product so nobody is interested in them.
  - nradov 7y ago
    The impact of staff clicking suspicious emails can be almost entirely eliminated by severely restricting user permissions. Only a special set of administrator accounts should be allowed to execute untrusted binaries. Regular users can only run trusted whitelisted applications.
- alistairSH 7y ago
  Perhaps a dumb question... How does ransomware propagate from end-user PCs to the servers that host critical applications and data? Surely, they don't allow end-users to run email or access the web from "secure" servers?
  - jakewins 7y ago
    I'm not sure how the terminals are organized in terms of how locked down they are, but it's specifically occurring on the terminals they use for accessing patient data; they all freeze up simultaneously. It stops the entire hospital from operating each time until IT pays the bill.
  - PeterisP 7y ago
    IIRC the modus operandi for at least a few of these large ransomware attacks was that the initial attackers who succeed in phishing or whatever would install a remote backdoor there and sell the access for something like $2-10k to professional teams who have the infrastructure and capacity to handle it "properly" - use that foothold to spread across all the workstations, gain user credentials to access servers and destroy backups, and then trigger ransomware everywhere at once perhaps a week after the initial infection, transforming it from a driveby nuisance to a targeted attack that's hard to recover from and that can justify a big payout. Some of the victims had reasonable backups, but they were intended for disaster recovery, not malicious action; so they were accessible from the compromised machines and thus could be disabled or destroyed. An automated attack that manages to hit a random workstation can extract a ransom of a couple hundred dollars; but if they invest a couple day's hacker labor to move deeper, then there are many public cases of $50 000 - $500 000 ransoms paid, and multiple cases such as Baltimore city and Atlanta city which suffered losses in excess of $10m as a result of not paying the ransoms.
  - technion 7y ago
    Unfortunately many of the applications in this space basically operate by placing the "database" on a file share that people have access to. This also involves heavy use of OpLocks, causing you to be required to neglect security advise to disable SMBv1. Even without without malware gaining RCE on the server, the end result is encrypted server data.
- KingMachiavelli 7y ago
  Redesigning your environment is hard and expensive so it's easy to see why hospitals and similar industries are so behind and vulnerable. BUT, given that important data needs to be backed up anyway, most commodity backup software and commodity storage platforms are sufficient to restore encrypted data. Even Windows shadow copying feature (which lots of storage platforms will expose snapshots/revisions as) is pretty sufficient to prevent significant data loss. So unless the ransom cost is cheaper than an IT tech reimaging/rebuilding the machine + compliance costs, it doesn't really make sense.
  - deleted 7y ago
    [deleted]
- joe_the_user 7y ago
  Normalizing cyber crime like this seems incredibly bad. Just think when stealing patient and financial information becomes more profitable than what regular ransom ware demands net. Even more, perhaps targeted assassination based on screwing up data? Demanding silence and cooperation for whatever the cyber-criminal do?
- nradov 7y ago
  It's not really fair to bring Cerner into this. The security vulnerabilities that enable these malware attacks are unlikely to be in Cerner applications. Instead it's usually an OS or email problem.
  - SkyPuncher 7y ago
    Seconded this. My wife is a resident. Nearly every EMR she's used, has been either Citrix or Remote Desktop based.
post_break 7y ago
I wonder if Ransomware insurance will be offered by the same companies that do personnel ransom insurance.
- selectodude 7y ago
  These hospitals are uninsurable. They'd balk at the cost that the insurance companies would demand they pay for enhanced network security.
  - panarky 7y ago
    Nah, most large organizations already have kidnap and ransom policies that pay off in event of extortion. They often also have cyber insurance that covers data leaks, but even without cyber insurance the K&R policy often covers costs to recover from ransomware, either by paying the ransom or by replacing/restoring systems.
vuln 7y ago
Ugh I hate when reports are published but lack basic information like malware family and indicators of compromise. The FBI FLASH reports are the worst offenders. I suspect in this case the hospital did not share maybe due to legal reasons?
- ga-vu 7y ago
  Probably because reporters don't work for cyber-security firms and don't give a shit about the C&C URL... just saying.
ikeboy 7y ago
We need to make it illegal to pay ransoms. Paying a ransom is like defecting in a prisoner's dilemma: it benefits you at the expense of hurting everyone else who will be stuck in the same situation. Making it illegal just forces everyone to cooperate and is something everyone would prefer. Should be possible to prosecute under existing laws: you're providing support to a criminal enterprise, sounds illegal already.
- Wowfunhappy 7y ago
  I've been thinking the same thing, lately. When Randsomware was a new idea and seemed to be primarily targeting individuals, it made sense that paying your way out should ultimately be legal. Any law against it would be difficult to enforce, so bad actors would still be incentivized to launch attacks, and only law abiding citizens would be hurt. But now they're attacking banks, and hospitals, and cities. I have trouble imagining large hospital systems would be able to discretely pay hundreds of thousands of dollars illegally without anyone noticing—and if they did, it would be easy to prosecute. Ergo, outlawing these payments should very significantly reduce the number of ransomware attacks against these large targets. If no one can pay, there's no incentive to attack.
- dmix 7y ago
  This story provides a good counterpoint. What if doing so saves lives at a hospital who needs to get back online ASAP? A "saves lives" loophole? Not to mention every law should first be measured on whether it is at all practical to meaningfully enforce. I guarantee there has been 100x more companies who've paid the ransom and didn't release a press release like this one did. If a whole bunch of people are going to do it anyway quietly and the law isn't going to stop them, we're just going to occasionally double up the fines on the random businesses that get caught. While these endless ransomware hackings continue. I'd much rather we spent public resources on prevention.
  - Wowfunhappy 7y ago
    You're saving lives now but endangering future lives. If no one paid the ransom, ransomware wouldn't exist. the more people who pay the ransom, the more incentive attackers have to create ransomware.
newhotelowner 7y ago
How do you prevent your system from a ransomware attack? If the user is using Windows 10 Professional and doesn't have admin access, can they still be a victim of a ransomware attack?
- kodablah 7y ago
  > How do you prevent your system from a ransomware attack? You don't (well, not with 100% certainty anyways), you mitigate the harm.
- PeterisP 7y ago
  Sure, that user can encrypt all the documents that they have access to and care about, so that can be the target of a ransom. Also, in many smallish organizations users have access to e.g. a common network share, so in the absence of proper backups, a single compromised user (e.g. the owner/manager's administrative assistant with access to all kinds of documents) may be able to seriously disrupt the whole organization.
- nradov 7y ago
  You prevent users from running untrusted applications. Only whitelisted applications can execute. https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview https://docs.microsoft.com/en-us/windows/security/threat-pro...
  - Cheyana 7y ago
    I don't see how this would help when all of this ransomware is usually a javascript dropper that gets in through the browser, encrypts files, and then gets out after the damage is done. The only thing that ever saved us in the half dozen or so times that we've been hit is a robust backup system.
    - nradov 7y ago
      Are you certain that was the attack vector, and if so which specific browser vulnerability was it? I'm not aware of any browser JavaScript sandbox escape vulnerabilities that would allow file write access since about 2015. While it's remotely possible there is a zero-day vulnerability being exploited out there it seems highly unlikely. If your organization has been hit multiple times by similar problems then the IT management must be terribly incompetent.
ngneer 7y ago
How arrogant to comment that these hospital systems should have been secured by now, given that WannaCry has hit hospitals in the past couple of years. Shows a lack of understanding of the economics of security. I agree with the point made by others about not negotiating with terrorists. Outlawing payments would not prevent the attacks, though, the prisoner's dilemma will remain. I am not an economist, but as long as the value of the assets being rescued is greater than the value of the money handed over, the trade will occur. At some point, yes, the ransom will be too great, but the parties will continue to seek the path of least resistance.
- tinus_hn 7y ago
  Yeah, we should just accept their mediocrity! After all, you can’t expect people to take all these difficult security measures like installing updates and using complex passwords.
  - ngneer 7y ago
    I said nothing of the sort. Only that the manner in which the security expert commented on their practices came off high and mighty. Knowing how to secure a system is not enough, knowing how to get there matters.
gyuserbti 7y ago
The untold story in these things is the role of forced EMR regulations. I've worked in healthcare for some time, as does my spouse and my family. These record systems used to all be developed in-house systems, fully self supporting, with little outside involvement. Then in the 2000s gov regulations started mandating adoption of EMRs. Especially here this seems like a no-brainer but in actuality for many hospitals they were unnecessary and introduced with massive cost overruns as hospitals were forced to buy them from a limited pool of vendors that were approved by deadline rather than by intrinsic need. How does this relate to the ransoms? Because if the EMRs were adopted organically, my guess is it would have happened more gradually, with more diversity of systems, more open source, more testing, and more emphasis on security, backup, and self-reliant reliability. It's hard to overemphasize the change in records infrastructure in hospitals due to mandated EMRs, and a lot of it has been for the worse. EMRs would have been implemented eventually without the mandates, but at lower cost and greater security probably. It's just another example of how overregulation in healthcare that sounds good but in practice ends up creating unnecessary costs and causing problems. It also once again doesn't get attention in healthcare price discussions, because it's structural, indirect, and removed from the immediate billing. I blame these types of ransomware attacks in part on EMR mandates and those who encouraged them. Should bthe federal gov, which encouraged this mess, pay the costs, either of the ransoms, or the cost of not paying?

51 points by LinuxBender 7y ago

A friend of mine is an MD at a major hospital in the midwest. As I've understood it this is standard practice for them. Their computers freeze up, and the message - my friend has sent me screen shots - will say something like "Hi <hospital name>, the computer is encrypted, please contact the IT department", IT department pays the ransom and the computers kick back on. From a financial POV, as long as the ransom costs per year is lower than the cost to replace their Cerner systems, it makes sense to simply see it as the cost of operations I guess?

JumpCrisscross 7y ago
> as long as the ransom costs per year is lower than the cost to replace their Cerner systems, it makes sense to simply see it as the cost of operations I guess? Sort of. Unless the cost and frequency of ransomware incidents are absurdly low, it makes sense to borrow to upgrade. Putting aside the moral hazard of being a compliant mark, there is the risk that the next attack won't be as cheap. Their vendor ought to figure out the hospital's mean annual ransom payment, and come up with financing for an upgraded system that comes out to that amount. Now the cost is locked in, while the variance is sharply reduced. (No risk ever goes to zero.)
- jakewins 7y ago
  Excellent comment, and indeed this seems like a much saner approach. I guess one complicating factor is the risk that an upgraded system remains vulnerable, which you'd need to account for in some manner.
  - JumpCrisscross 7y ago
    > one complicating factor is the risk that an upgraded system remains vulnerable, which you'd need to account for in some manner Bundle the financing with cybersecurity insurance.
user5994461 7y ago
That makes me wonder whether the usual malware came from phishing or vulnerabilities. If it's phishing, typical staff clicking suspicious emails and opening URLs and attachments, there isn't a lot the hospital can do to stop it. A bit of blocking around external emails and shady attachments will help, but people will still fall for it quite often. If it's remote vulnerabilities, probably some unpatched systems, it's risky because that could parallelize the whole hospital anytime, but as long as the vulnerability is patched by the ransomware it's still cheaper than doing the maintenance.
- wcip 7y ago
  >If it's phishing, typical staff clicking every suspicious email uncarefully opening URLs and attachments, there isn't a lot the hospital can do. Not give typical staff the user permissions required to encrypt all the databases and delete the backups? Too bad info sec is so full of snake oil salesmen, obvious practical solutions exist for these type of problems they just generally don't involve spending six figures on a product so nobody is interested in them.
- nradov 7y ago
  The impact of staff clicking suspicious emails can be almost entirely eliminated by severely restricting user permissions. Only a special set of administrator accounts should be allowed to execute untrusted binaries. Regular users can only run trusted whitelisted applications.
alistairSH 7y ago
Perhaps a dumb question... How does ransomware propagate from end-user PCs to the servers that host critical applications and data? Surely, they don't allow end-users to run email or access the web from "secure" servers?
- jakewins 7y ago
  I'm not sure how the terminals are organized in terms of how locked down they are, but it's specifically occurring on the terminals they use for accessing patient data; they all freeze up simultaneously. It stops the entire hospital from operating each time until IT pays the bill.
- PeterisP 7y ago
  IIRC the modus operandi for at least a few of these large ransomware attacks was that the initial attackers who succeed in phishing or whatever would install a remote backdoor there and sell the access for something like $2-10k to professional teams who have the infrastructure and capacity to handle it "properly" - use that foothold to spread across all the workstations, gain user credentials to access servers and destroy backups, and then trigger ransomware everywhere at once perhaps a week after the initial infection, transforming it from a driveby nuisance to a targeted attack that's hard to recover from and that can justify a big payout. Some of the victims had reasonable backups, but they were intended for disaster recovery, not malicious action; so they were accessible from the compromised machines and thus could be disabled or destroyed. An automated attack that manages to hit a random workstation can extract a ransom of a couple hundred dollars; but if they invest a couple day's hacker labor to move deeper, then there are many public cases of $50 000 - $500 000 ransoms paid, and multiple cases such as Baltimore city and Atlanta city which suffered losses in excess of $10m as a result of not paying the ransoms.
- technion 7y ago
  Unfortunately many of the applications in this space basically operate by placing the "database" on a file share that people have access to. This also involves heavy use of OpLocks, causing you to be required to neglect security advise to disable SMBv1. Even without without malware gaining RCE on the server, the end result is encrypted server data.
KingMachiavelli 7y ago
Redesigning your environment is hard and expensive so it's easy to see why hospitals and similar industries are so behind and vulnerable. BUT, given that important data needs to be backed up anyway, most commodity backup software and commodity storage platforms are sufficient to restore encrypted data. Even Windows shadow copying feature (which lots of storage platforms will expose snapshots/revisions as) is pretty sufficient to prevent significant data loss. So unless the ransom cost is cheaper than an IT tech reimaging/rebuilding the machine + compliance costs, it doesn't really make sense.
- deleted 7y ago
  [deleted]
joe_the_user 7y ago
Normalizing cyber crime like this seems incredibly bad. Just think when stealing patient and financial information becomes more profitable than what regular ransom ware demands net. Even more, perhaps targeted assassination based on screwing up data? Demanding silence and cooperation for whatever the cyber-criminal do?
nradov 7y ago
It's not really fair to bring Cerner into this. The security vulnerabilities that enable these malware attacks are unlikely to be in Cerner applications. Instead it's usually an OS or email problem.
- SkyPuncher 7y ago
  Seconded this. My wife is a resident. Nearly every EMR she's used, has been either Citrix or Remote Desktop based.

post_break 7y ago

I wonder if Ransomware insurance will be offered by the same companies that do personnel ransom insurance.

selectodude 7y ago
These hospitals are uninsurable. They'd balk at the cost that the insurance companies would demand they pay for enhanced network security.
- panarky 7y ago
  Nah, most large organizations already have kidnap and ransom policies that pay off in event of extortion. They often also have cyber insurance that covers data leaks, but even without cyber insurance the K&R policy often covers costs to recover from ransomware, either by paying the ransom or by replacing/restoring systems.

vuln 7y ago

Ugh I hate when reports are published but lack basic information like malware family and indicators of compromise. The FBI FLASH reports are the worst offenders. I suspect in this case the hospital did not share maybe due to legal reasons?

ga-vu 7y ago
Probably because reporters don't work for cyber-security firms and don't give a shit about the C&C URL... just saying.

ikeboy 7y ago

We need to make it illegal to pay ransoms. Paying a ransom is like defecting in a prisoner's dilemma: it benefits you at the expense of hurting everyone else who will be stuck in the same situation. Making it illegal just forces everyone to cooperate and is something everyone would prefer. Should be possible to prosecute under existing laws: you're providing support to a criminal enterprise, sounds illegal already.

Wowfunhappy 7y ago
I've been thinking the same thing, lately. When Randsomware was a new idea and seemed to be primarily targeting individuals, it made sense that paying your way out should ultimately be legal. Any law against it would be difficult to enforce, so bad actors would still be incentivized to launch attacks, and only law abiding citizens would be hurt. But now they're attacking banks, and hospitals, and cities. I have trouble imagining large hospital systems would be able to discretely pay hundreds of thousands of dollars illegally without anyone noticing—and if they did, it would be easy to prosecute. Ergo, outlawing these payments should very significantly reduce the number of ransomware attacks against these large targets. If no one can pay, there's no incentive to attack.
dmix 7y ago
This story provides a good counterpoint. What if doing so saves lives at a hospital who needs to get back online ASAP? A "saves lives" loophole? Not to mention every law should first be measured on whether it is at all practical to meaningfully enforce. I guarantee there has been 100x more companies who've paid the ransom and didn't release a press release like this one did. If a whole bunch of people are going to do it anyway quietly and the law isn't going to stop them, we're just going to occasionally double up the fines on the random businesses that get caught. While these endless ransomware hackings continue. I'd much rather we spent public resources on prevention.
- Wowfunhappy 7y ago
  You're saving lives now but endangering future lives. If no one paid the ransom, ransomware wouldn't exist. the more people who pay the ransom, the more incentive attackers have to create ransomware.

newhotelowner 7y ago

How do you prevent your system from a ransomware attack? If the user is using Windows 10 Professional and doesn't have admin access, can they still be a victim of a ransomware attack?

kodablah 7y ago
> How do you prevent your system from a ransomware attack? You don't (well, not with 100% certainty anyways), you mitigate the harm.
PeterisP 7y ago
Sure, that user can encrypt all the documents that they have access to and care about, so that can be the target of a ransom. Also, in many smallish organizations users have access to e.g. a common network share, so in the absence of proper backups, a single compromised user (e.g. the owner/manager's administrative assistant with access to all kinds of documents) may be able to seriously disrupt the whole organization.
nradov 7y ago
You prevent users from running untrusted applications. Only whitelisted applications can execute. https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview https://docs.microsoft.com/en-us/windows/security/threat-pro...
- Cheyana 7y ago
  I don't see how this would help when all of this ransomware is usually a javascript dropper that gets in through the browser, encrypts files, and then gets out after the damage is done. The only thing that ever saved us in the half dozen or so times that we've been hit is a robust backup system.
  - nradov 7y ago
    Are you certain that was the attack vector, and if so which specific browser vulnerability was it? I'm not aware of any browser JavaScript sandbox escape vulnerabilities that would allow file write access since about 2015. While it's remotely possible there is a zero-day vulnerability being exploited out there it seems highly unlikely. If your organization has been hit multiple times by similar problems then the IT management must be terribly incompetent.

ngneer 7y ago

How arrogant to comment that these hospital systems should have been secured by now, given that WannaCry has hit hospitals in the past couple of years. Shows a lack of understanding of the economics of security. I agree with the point made by others about not negotiating with terrorists. Outlawing payments would not prevent the attacks, though, the prisoner's dilemma will remain. I am not an economist, but as long as the value of the assets being rescued is greater than the value of the money handed over, the trade will occur. At some point, yes, the ransom will be too great, but the parties will continue to seek the path of least resistance.

tinus_hn 7y ago
Yeah, we should just accept their mediocrity! After all, you can’t expect people to take all these difficult security measures like installing updates and using complex passwords.
- ngneer 7y ago
  I said nothing of the sort. Only that the manner in which the security expert commented on their practices came off high and mighty. Knowing how to secure a system is not enough, knowing how to get there matters.

gyuserbti 7y ago

The untold story in these things is the role of forced EMR regulations. I've worked in healthcare for some time, as does my spouse and my family. These record systems used to all be developed in-house systems, fully self supporting, with little outside involvement. Then in the 2000s gov regulations started mandating adoption of EMRs. Especially here this seems like a no-brainer but in actuality for many hospitals they were unnecessary and introduced with massive cost overruns as hospitals were forced to buy them from a limited pool of vendors that were approved by deadline rather than by intrinsic need. How does this relate to the ransoms? Because if the EMRs were adopted organically, my guess is it would have happened more gradually, with more diversity of systems, more open source, more testing, and more emphasis on security, backup, and self-reliant reliability. It's hard to overemphasize the change in records infrastructure in hospitals due to mandated EMRs, and a lot of it has been for the worse. EMRs would have been implemented eventually without the mandates, but at lower cost and greater security probably. It's just another example of how overregulation in healthcare that sounds good but in practice ends up creating unnecessary costs and causing problems. It also once again doesn't get attention in healthcare price discussions, because it's structural, indirect, and removed from the immediate billing. I blame these types of ransomware attacks in part on EMR mandates and those who encouraged them. Should bthe federal gov, which encouraged this mess, pay the costs, either of the ransoms, or the cost of not paying?