4 ms·

A friend of mine is an MD at a major hospital in the midwest. As I've understood it this is standard practice for them. Their computers freeze up, and the messa

A friend of mine is an MD at a major hospital in the midwest. As I've understood it this is standard practice for them. Their computers freeze up, and the message - my friend has sent me screen shots - will say something like "Hi <hospital name>, the computer is encrypted, please contact the IT department", IT department pays the ransom and the computers kick back on. From a financial POV, as long as the ransom costs per year is lower than the cost to replace their Cerner systems, it makes sense to simply see it as the cost of operations I guess?

JumpCrisscross 7y ago
> as long as the ransom costs per year is lower than the cost to replace their Cerner systems, it makes sense to simply see it as the cost of operations I guess? Sort of. Unless the cost and frequency of ransomware incidents are absurdly low, it makes sense to borrow to upgrade. Putting aside the moral hazard of being a compliant mark, there is the risk that the next attack won't be as cheap. Their vendor ought to figure out the hospital's mean annual ransom payment, and come up with financing for an upgraded system that comes out to that amount. Now the cost is locked in, while the variance is sharply reduced. (No risk ever goes to zero.)
- jakewins 7y ago
  Excellent comment, and indeed this seems like a much saner approach. I guess one complicating factor is the risk that an upgraded system remains vulnerable, which you'd need to account for in some manner.
  - JumpCrisscross 7y ago
    > one complicating factor is the risk that an upgraded system remains vulnerable, which you'd need to account for in some manner Bundle the financing with cybersecurity insurance.
user5994461 7y ago
That makes me wonder whether the usual malware came from phishing or vulnerabilities. If it's phishing, typical staff clicking suspicious emails and opening URLs and attachments, there isn't a lot the hospital can do to stop it. A bit of blocking around external emails and shady attachments will help, but people will still fall for it quite often. If it's remote vulnerabilities, probably some unpatched systems, it's risky because that could parallelize the whole hospital anytime, but as long as the vulnerability is patched by the ransomware it's still cheaper than doing the maintenance.
- wcip 7y ago
  >If it's phishing, typical staff clicking every suspicious email uncarefully opening URLs and attachments, there isn't a lot the hospital can do. Not give typical staff the user permissions required to encrypt all the databases and delete the backups? Too bad info sec is so full of snake oil salesmen, obvious practical solutions exist for these type of problems they just generally don't involve spending six figures on a product so nobody is interested in them.
- nradov 7y ago
  The impact of staff clicking suspicious emails can be almost entirely eliminated by severely restricting user permissions. Only a special set of administrator accounts should be allowed to execute untrusted binaries. Regular users can only run trusted whitelisted applications.
alistairSH 7y ago
Perhaps a dumb question... How does ransomware propagate from end-user PCs to the servers that host critical applications and data? Surely, they don't allow end-users to run email or access the web from "secure" servers?
- jakewins 7y ago
  I'm not sure how the terminals are organized in terms of how locked down they are, but it's specifically occurring on the terminals they use for accessing patient data; they all freeze up simultaneously. It stops the entire hospital from operating each time until IT pays the bill.
- PeterisP 7y ago
  IIRC the modus operandi for at least a few of these large ransomware attacks was that the initial attackers who succeed in phishing or whatever would install a remote backdoor there and sell the access for something like $2-10k to professional teams who have the infrastructure and capacity to handle it "properly" - use that foothold to spread across all the workstations, gain user credentials to access servers and destroy backups, and then trigger ransomware everywhere at once perhaps a week after the initial infection, transforming it from a driveby nuisance to a targeted attack that's hard to recover from and that can justify a big payout. Some of the victims had reasonable backups, but they were intended for disaster recovery, not malicious action; so they were accessible from the compromised machines and thus could be disabled or destroyed. An automated attack that manages to hit a random workstation can extract a ransom of a couple hundred dollars; but if they invest a couple day's hacker labor to move deeper, then there are many public cases of $50 000 - $500 000 ransoms paid, and multiple cases such as Baltimore city and Atlanta city which suffered losses in excess of $10m as a result of not paying the ransoms.
- technion 7y ago
  Unfortunately many of the applications in this space basically operate by placing the "database" on a file share that people have access to. This also involves heavy use of OpLocks, causing you to be required to neglect security advise to disable SMBv1. Even without without malware gaining RCE on the server, the end result is encrypted server data.
KingMachiavelli 7y ago
Redesigning your environment is hard and expensive so it's easy to see why hospitals and similar industries are so behind and vulnerable. BUT, given that important data needs to be backed up anyway, most commodity backup software and commodity storage platforms are sufficient to restore encrypted data. Even Windows shadow copying feature (which lots of storage platforms will expose snapshots/revisions as) is pretty sufficient to prevent significant data loss. So unless the ransom cost is cheaper than an IT tech reimaging/rebuilding the machine + compliance costs, it doesn't really make sense.
- deleted 7y ago
  [deleted]
joe_the_user 7y ago
Normalizing cyber crime like this seems incredibly bad. Just think when stealing patient and financial information becomes more profitable than what regular ransom ware demands net. Even more, perhaps targeted assassination based on screwing up data? Demanding silence and cooperation for whatever the cyber-criminal do?
nradov 7y ago
It's not really fair to bring Cerner into this. The security vulnerabilities that enable these malware attacks are unlikely to be in Cerner applications. Instead it's usually an OS or email problem.
- SkyPuncher 7y ago
  Seconded this. My wife is a resident. Nearly every EMR she's used, has been either Citrix or Remote Desktop based.

JumpCrisscross 7y ago

> as long as the ransom costs per year is lower than the cost to replace their Cerner systems, it makes sense to simply see it as the cost of operations I guess? Sort of. Unless the cost and frequency of ransomware incidents are absurdly low, it makes sense to borrow to upgrade. Putting aside the moral hazard of being a compliant mark, there is the risk that the next attack won't be as cheap. Their vendor ought to figure out the hospital's mean annual ransom payment, and come up with financing for an upgraded system that comes out to that amount. Now the cost is locked in, while the variance is sharply reduced. (No risk ever goes to zero.)

jakewins 7y ago
Excellent comment, and indeed this seems like a much saner approach. I guess one complicating factor is the risk that an upgraded system remains vulnerable, which you'd need to account for in some manner.
- JumpCrisscross 7y ago
  > one complicating factor is the risk that an upgraded system remains vulnerable, which you'd need to account for in some manner Bundle the financing with cybersecurity insurance.

user5994461 7y ago

That makes me wonder whether the usual malware came from phishing or vulnerabilities. If it's phishing, typical staff clicking suspicious emails and opening URLs and attachments, there isn't a lot the hospital can do to stop it. A bit of blocking around external emails and shady attachments will help, but people will still fall for it quite often. If it's remote vulnerabilities, probably some unpatched systems, it's risky because that could parallelize the whole hospital anytime, but as long as the vulnerability is patched by the ransomware it's still cheaper than doing the maintenance.

wcip 7y ago
>If it's phishing, typical staff clicking every suspicious email uncarefully opening URLs and attachments, there isn't a lot the hospital can do. Not give typical staff the user permissions required to encrypt all the databases and delete the backups? Too bad info sec is so full of snake oil salesmen, obvious practical solutions exist for these type of problems they just generally don't involve spending six figures on a product so nobody is interested in them.
nradov 7y ago
The impact of staff clicking suspicious emails can be almost entirely eliminated by severely restricting user permissions. Only a special set of administrator accounts should be allowed to execute untrusted binaries. Regular users can only run trusted whitelisted applications.

alistairSH 7y ago

Perhaps a dumb question... How does ransomware propagate from end-user PCs to the servers that host critical applications and data? Surely, they don't allow end-users to run email or access the web from "secure" servers?

jakewins 7y ago
I'm not sure how the terminals are organized in terms of how locked down they are, but it's specifically occurring on the terminals they use for accessing patient data; they all freeze up simultaneously. It stops the entire hospital from operating each time until IT pays the bill.
PeterisP 7y ago
IIRC the modus operandi for at least a few of these large ransomware attacks was that the initial attackers who succeed in phishing or whatever would install a remote backdoor there and sell the access for something like $2-10k to professional teams who have the infrastructure and capacity to handle it "properly" - use that foothold to spread across all the workstations, gain user credentials to access servers and destroy backups, and then trigger ransomware everywhere at once perhaps a week after the initial infection, transforming it from a driveby nuisance to a targeted attack that's hard to recover from and that can justify a big payout. Some of the victims had reasonable backups, but they were intended for disaster recovery, not malicious action; so they were accessible from the compromised machines and thus could be disabled or destroyed. An automated attack that manages to hit a random workstation can extract a ransom of a couple hundred dollars; but if they invest a couple day's hacker labor to move deeper, then there are many public cases of $50 000 - $500 000 ransoms paid, and multiple cases such as Baltimore city and Atlanta city which suffered losses in excess of $10m as a result of not paying the ransoms.
technion 7y ago
Unfortunately many of the applications in this space basically operate by placing the "database" on a file share that people have access to. This also involves heavy use of OpLocks, causing you to be required to neglect security advise to disable SMBv1. Even without without malware gaining RCE on the server, the end result is encrypted server data.

KingMachiavelli 7y ago

Redesigning your environment is hard and expensive so it's easy to see why hospitals and similar industries are so behind and vulnerable. BUT, given that important data needs to be backed up anyway, most commodity backup software and commodity storage platforms are sufficient to restore encrypted data. Even Windows shadow copying feature (which lots of storage platforms will expose snapshots/revisions as) is pretty sufficient to prevent significant data loss. So unless the ransom cost is cheaper than an IT tech reimaging/rebuilding the machine + compliance costs, it doesn't really make sense.

deleted 7y ago
[deleted]

joe_the_user 7y ago

Normalizing cyber crime like this seems incredibly bad. Just think when stealing patient and financial information becomes more profitable than what regular ransom ware demands net. Even more, perhaps targeted assassination based on screwing up data? Demanding silence and cooperation for whatever the cyber-criminal do?

nradov 7y ago

It's not really fair to bring Cerner into this. The security vulnerabilities that enable these malware attacks are unlikely to be in Cerner applications. Instead it's usually an OS or email problem.

SkyPuncher 7y ago
Seconded this. My wife is a resident. Nearly every EMR she's used, has been either Citrix or Remote Desktop based.