5 ms·

Patient dies after ransomware attack reroutes her to remote hospital

43 points by furcyd 6y ago

ponker 6y ago
If the perpetrators are convicted they should get the electric chair. This is a felony murder plain and simple.
anotherman554 6y ago
Shouldn't the hospital have been able to treat the patient without networked computers?
- violetgarden 6y ago
  Darknet Diaries just did an episode about how Wannacry disabled the NHS on episode 73. The episode was way more descriptive of how the attack affected functions of the hospital, but basically, there’s a lot of overhead. Suddenly, you have to check everyone in by hand, you don’t know who their normal doctor is, you can’t look up medication, ransomware might be affecting specialized computers for the medical equipment. Some hospitals were able to pivot to pen and paper and still treat patients, but the attack was basically like an accident on the freeway. It just jams everything up.
- 8bitsrule 6y ago
  My first reaction as well. What, we can't treat people when they come in any more? The paperwork is more important than a life? And the terrible thing is, nowadays I truly think that's pretty much how it works. The fall of Rome must have looked much like this.
- btach 6y ago
  Short answer: yes. Realistic answer: it can be dreadfully complicated. In the ED where I work, there are many, many moving parts in a metaphorical fast, fluid dance. Computer systems: Pertinent patient medical history for most patients, including clinics/doctors/implanted device serial numbers, meds, past workups (both conclusive and inconclusive), etc. Very useful almost all the time, can get by if the patient is a good enough historian. I suppose there is a way to get paper-based printouts in a no-computer situation, but I am not familiar with it (all our system downtime where I work falls back to a read-only system, not a no-access system). Our systems also coordinate imaging/lab orders. Yes we can fax paper orders, call, and face-to-face with our teammates in different parts of the building -- but the higher the census/acuity, the more chaotic it is when we are not practiced with that method, and mistakes are much more likely to happen. Meds/procedures are also ordered and communicated on the system, and completion/administration is charted on the same. Patient exams too. Notes. Pertinent allergies or history the patient forgot to tell the doctor but told his/her nurse afterwards (then it is entered right there so when a certain med is ordered, a flag is raised to everyone who needs to see it). We are very, very used to being able to communicate centrally like that. Going to temporary paper charts is doable - just much slower. As we don't do it everyday, everytime we need to re-rehearse the system. Our rapid, fluid dance crashes and we're fumbling almost blindfolded, trying to get the same amount done/communicated/verified/double verified with our same patient load as before. Real life example: during a (seemingly) poorly-planned downtime of our charting system (maintenance), we got several simultaneous critical trauma patients involved in more than one unrelated MVA. As they arrived very close to each other, they went to CT for imaging as soon as primary/secondary evaluation was done. As there was more than one CT available, 2 went simultaneously. None of these patients were conscious and therefore couldn't verify their own identity. In the hurry to evaluate and stabilize them, two of them had their namebands switched (the namebands didn't use their actual names, just random computer-generated and obviously not belonging to a real person type names, for the sake of brevity (no time to hunt for IDs or make calls yet) so CT/labs/everything else can happen ASAP). Quite fortunately the error was found after the scans were completed but well before the neurosurgeon came to evaluate and do a life-prolonging invasive procedure the wrong (intubated trauma) patient. This seems like a simple thing to prevent, and it is, provided everyone remember to slow down and be mindful of these steps. Now I imagine the ED at that hospital at capacity with high acuity patients with a very full waiting room (as flow has slowed down considerably), and perhaps a decision was made to go on divert (EMS directed to take all incoming patients to the next closest appropriate hospital). If the physicians and nurses (and all other staff that keep the place from sinking into the mud at any given time) were all occupied with critical patients at the time this patient was to arrive, my experience tells me that there would likely be a high risk that somebody was going to have a bad outcome because the demand exceeded the resources. This is just my take on the situation given almost no data other than that computer systems were down and this patient was diverted to another hospital and died. I don't know the emergent medical condition nor do I know if it was due to lack of timely hospital resources that she passed. What I do know is that if that ED was at its max with critical patients (and metaphorically raining fire and brimstone sent from the vengeful ED gods because a non-superstitious staff person remarked how "quiet" it was that shift and superstitious coworkers became upset), she may not have had a good chance there either, or somebody already there may not have had a good chance. Who knows. I can only speculate.
panpanna 6y ago
The bitcoin addresses used by malware are monitored by different organizations. I wonder how hard it is to track the people behind this once you mention homicide to exchanges they use.
- vmception 6y ago
  if those people used any best practice, and also swapped to another blockchain without using an exchange then it would be very difficult and fruitless to track the people behind it, all of those different organizations and armchair blockchain detectives would just be following bitcoin across addresses and making maps with arrows like a crazy person, not even knowing that they are unable to tell that the owner of that bitcoin changed hands 20 transactions ago in every single path. all of those organizations just assume a person "on the run" is transferring to different addresses they own "trying to hide", and that they'll eventually hit a known exchange address and get nabbed. with that poor logic, someone might get nabbed. a lot of people don't use a single one of the default, best practices that have been on every bitcoin Wiki for an entire decade, so investigators have that going for them.
  - angrais 6y ago
    Do you have any recommended blog posts or literature to learn more about the best practices of using crypto I'm such a way, i.e. to evade tracking?
    - vmception 6y ago
      Avoid address reuse. Most wallets and most exchanges do not help with this, they completely neglect it. In UXTO blockchains like Bitcoin, a core feature is combining your “outputs”, immediately correlating otherwise separate addresses in the same wallet. The system supports transaction types that wallets may not show in the GUI. So you can choose to only send from a specific address. You may have to recreate you hierarchy of addresses in a more capable wallet, but you always can do that no matter where you normally use your bitcoin. Ultimately you want to unlink your transaction. Monero, a few smart contracts and some layer2 systems do that. “Coinjoin” systems do not do that, the advertisement of them is probably funded by adversaries. You have to get your transactions to the systems and currencies that let you unlink. So you have a series of bitcoin addresses that werent funded with an exchange or tied to your identity. For illustrative purposes lets say you cashed out of a gambling website to a virgin address and US institutions will freeze your accounts if you try to cash out. Nothing illegal for you, as the federal law is only against financial institutions. Just fire up Tor and hop over to Monero using Morphtoken.com and send them btc and get monero. (You dont need Tor for cashing out gambling withdrawals, but just get in the practice.) Now you have Monero, which is more analogous to cash. If that claim isnt comfortable enough for you, spend time researching that yourself. You have options now. Monero can just be a conduit for unlinking transactions as you go back into transparent blockchains in a few hours or days. Or it can be your desired currency and nest egg. Or you can sell it directly into fiat currency as several exchanges support it, as well as all OTC desks, as well as local in person markets. Monero is perfectly suited for exchanging for goods and services and many people use it for that despite merchants accepting bitcoin more prevalently, many bitcoin invoices are paid with Monero which trigger another service like Morphtoken to pay a merchant in bitcoin. Back to the conduit example, you can just generate a new hierarchy of addresses on whatever blockchain you like and convert the monero back into that cryptocurrency. You can also deposit that Monero on a crypto-only exchange and just trade it for something else and withdraw. This option has the caveat of whether you want to do this in Tor or not, whether the amounts trigger KYC or not, whether you want to use someone else’s KYC, whether you are patient enough to stay in the non-KYC’d withdrawal limits over many days and several accounts, etc. If you just used Monero to a crypto-only exchange under your identity and they got subpoena’d in the future, do you think you need a way to explain the source of funds? Anyway, thats not even necessary. In this gambling example there is no need to reintegrate, you just need to pass a chainanalysis filter so a US financial institution feels compliant. Unlinking solved, problem solved.
aaron695 6y ago
People die regularly when doctors and nurses don't wash their hands properly. In that hospital I'd be surprised if it's not at least once a week. So this isn't a big deal. We kill off patients all the time. If that worries you, perhaps you should stop frothing at the mouth because of "ransomware" and worry about all the other things that matter first. Another good example of people dying in medicine is the fact we over-engineer everything so much we lack equipment and access because it's just to hard. The re-routing here probably was for optics in part. The over engineering means by passing the buck to another hospital they can't get blamed for anything.
- nefitty 6y ago
  People die from other causes so we shouldn’t worry about ransomware? That doesn’t make any sense, and it’s an issue specifically relevant to HN because the a large amount of the demo is software engineers. Finally, what indication whatsoever did you find that there was deliberate blame-shifting? I don’t even understand where a cynical conclusion like that comes from. That might be one of the wildest and most tone-deaf comments I’ve ever read on HN.
  - aaron695 6y ago
    How did the patient die? How did the delay cause the death? There are tons of ransomware cases everyday we can look at. This has no info about the gang yet. It does have the exploit (CVE-2019-19871) which is good, but no real IT analysis yet. So this is about the death. Can you run me through the process of the death so we can talk about how to stop this again. Could the IT routers going down cause a similar issue? Why could they not see the severity of the case and stop the re-routing? Was this tied to the failed computer system? Why was the nearest hospital so far away? Here's a map - https://www.google.com.bz/maps/search/Duesseldorf+hospitals/@51.2162571,6.7792857,13z/data=!3m1!4b1 https://www.google.com.bz/maps/search/Duesseldorf+hospitals/... Why is sending people to other hospitals such a big deal? Is this unusual? What's the normal kill rate so we can gauge the severity? I'm happy to recover the thread, you think it has value. I just need the bits filled in, Thanks.
    - 6y ago

43 points by furcyd 6y ago

ponker 6y ago

If the perpetrators are convicted they should get the electric chair. This is a felony murder plain and simple.

anotherman554 6y ago

Shouldn't the hospital have been able to treat the patient without networked computers?

violetgarden 6y ago
Darknet Diaries just did an episode about how Wannacry disabled the NHS on episode 73. The episode was way more descriptive of how the attack affected functions of the hospital, but basically, there’s a lot of overhead. Suddenly, you have to check everyone in by hand, you don’t know who their normal doctor is, you can’t look up medication, ransomware might be affecting specialized computers for the medical equipment. Some hospitals were able to pivot to pen and paper and still treat patients, but the attack was basically like an accident on the freeway. It just jams everything up.
8bitsrule 6y ago
My first reaction as well. What, we can't treat people when they come in any more? The paperwork is more important than a life? And the terrible thing is, nowadays I truly think that's pretty much how it works. The fall of Rome must have looked much like this.
btach 6y ago
Short answer: yes. Realistic answer: it can be dreadfully complicated. In the ED where I work, there are many, many moving parts in a metaphorical fast, fluid dance. Computer systems: Pertinent patient medical history for most patients, including clinics/doctors/implanted device serial numbers, meds, past workups (both conclusive and inconclusive), etc. Very useful almost all the time, can get by if the patient is a good enough historian. I suppose there is a way to get paper-based printouts in a no-computer situation, but I am not familiar with it (all our system downtime where I work falls back to a read-only system, not a no-access system). Our systems also coordinate imaging/lab orders. Yes we can fax paper orders, call, and face-to-face with our teammates in different parts of the building -- but the higher the census/acuity, the more chaotic it is when we are not practiced with that method, and mistakes are much more likely to happen. Meds/procedures are also ordered and communicated on the system, and completion/administration is charted on the same. Patient exams too. Notes. Pertinent allergies or history the patient forgot to tell the doctor but told his/her nurse afterwards (then it is entered right there so when a certain med is ordered, a flag is raised to everyone who needs to see it). We are very, very used to being able to communicate centrally like that. Going to temporary paper charts is doable - just much slower. As we don't do it everyday, everytime we need to re-rehearse the system. Our rapid, fluid dance crashes and we're fumbling almost blindfolded, trying to get the same amount done/communicated/verified/double verified with our same patient load as before. Real life example: during a (seemingly) poorly-planned downtime of our charting system (maintenance), we got several simultaneous critical trauma patients involved in more than one unrelated MVA. As they arrived very close to each other, they went to CT for imaging as soon as primary/secondary evaluation was done. As there was more than one CT available, 2 went simultaneously. None of these patients were conscious and therefore couldn't verify their own identity. In the hurry to evaluate and stabilize them, two of them had their namebands switched (the namebands didn't use their actual names, just random computer-generated and obviously not belonging to a real person type names, for the sake of brevity (no time to hunt for IDs or make calls yet) so CT/labs/everything else can happen ASAP). Quite fortunately the error was found after the scans were completed but well before the neurosurgeon came to evaluate and do a life-prolonging invasive procedure the wrong (intubated trauma) patient. This seems like a simple thing to prevent, and it is, provided everyone remember to slow down and be mindful of these steps. Now I imagine the ED at that hospital at capacity with high acuity patients with a very full waiting room (as flow has slowed down considerably), and perhaps a decision was made to go on divert (EMS directed to take all incoming patients to the next closest appropriate hospital). If the physicians and nurses (and all other staff that keep the place from sinking into the mud at any given time) were all occupied with critical patients at the time this patient was to arrive, my experience tells me that there would likely be a high risk that somebody was going to have a bad outcome because the demand exceeded the resources. This is just my take on the situation given almost no data other than that computer systems were down and this patient was diverted to another hospital and died. I don't know the emergent medical condition nor do I know if it was due to lack of timely hospital resources that she passed. What I do know is that if that ED was at its max with critical patients (and metaphorically raining fire and brimstone sent from the vengeful ED gods because a non-superstitious staff person remarked how "quiet" it was that shift and superstitious coworkers became upset), she may not have had a good chance there either, or somebody already there may not have had a good chance. Who knows. I can only speculate.

panpanna 6y ago

The bitcoin addresses used by malware are monitored by different organizations. I wonder how hard it is to track the people behind this once you mention homicide to exchanges they use.

vmception 6y ago
if those people used any best practice, and also swapped to another blockchain without using an exchange then it would be very difficult and fruitless to track the people behind it, all of those different organizations and armchair blockchain detectives would just be following bitcoin across addresses and making maps with arrows like a crazy person, not even knowing that they are unable to tell that the owner of that bitcoin changed hands 20 transactions ago in every single path. all of those organizations just assume a person "on the run" is transferring to different addresses they own "trying to hide", and that they'll eventually hit a known exchange address and get nabbed. with that poor logic, someone might get nabbed. a lot of people don't use a single one of the default, best practices that have been on every bitcoin Wiki for an entire decade, so investigators have that going for them.
- angrais 6y ago
  Do you have any recommended blog posts or literature to learn more about the best practices of using crypto I'm such a way, i.e. to evade tracking?
  - vmception 6y ago
    Avoid address reuse. Most wallets and most exchanges do not help with this, they completely neglect it. In UXTO blockchains like Bitcoin, a core feature is combining your “outputs”, immediately correlating otherwise separate addresses in the same wallet. The system supports transaction types that wallets may not show in the GUI. So you can choose to only send from a specific address. You may have to recreate you hierarchy of addresses in a more capable wallet, but you always can do that no matter where you normally use your bitcoin. Ultimately you want to unlink your transaction. Monero, a few smart contracts and some layer2 systems do that. “Coinjoin” systems do not do that, the advertisement of them is probably funded by adversaries. You have to get your transactions to the systems and currencies that let you unlink. So you have a series of bitcoin addresses that werent funded with an exchange or tied to your identity. For illustrative purposes lets say you cashed out of a gambling website to a virgin address and US institutions will freeze your accounts if you try to cash out. Nothing illegal for you, as the federal law is only against financial institutions. Just fire up Tor and hop over to Monero using Morphtoken.com and send them btc and get monero. (You dont need Tor for cashing out gambling withdrawals, but just get in the practice.) Now you have Monero, which is more analogous to cash. If that claim isnt comfortable enough for you, spend time researching that yourself. You have options now. Monero can just be a conduit for unlinking transactions as you go back into transparent blockchains in a few hours or days. Or it can be your desired currency and nest egg. Or you can sell it directly into fiat currency as several exchanges support it, as well as all OTC desks, as well as local in person markets. Monero is perfectly suited for exchanging for goods and services and many people use it for that despite merchants accepting bitcoin more prevalently, many bitcoin invoices are paid with Monero which trigger another service like Morphtoken to pay a merchant in bitcoin. Back to the conduit example, you can just generate a new hierarchy of addresses on whatever blockchain you like and convert the monero back into that cryptocurrency. You can also deposit that Monero on a crypto-only exchange and just trade it for something else and withdraw. This option has the caveat of whether you want to do this in Tor or not, whether the amounts trigger KYC or not, whether you want to use someone else’s KYC, whether you are patient enough to stay in the non-KYC’d withdrawal limits over many days and several accounts, etc. If you just used Monero to a crypto-only exchange under your identity and they got subpoena’d in the future, do you think you need a way to explain the source of funds? Anyway, thats not even necessary. In this gambling example there is no need to reintegrate, you just need to pass a chainanalysis filter so a US financial institution feels compliant. Unlinking solved, problem solved.

aaron695 6y ago

People die regularly when doctors and nurses don't wash their hands properly. In that hospital I'd be surprised if it's not at least once a week. So this isn't a big deal. We kill off patients all the time. If that worries you, perhaps you should stop frothing at the mouth because of "ransomware" and worry about all the other things that matter first. Another good example of people dying in medicine is the fact we over-engineer everything so much we lack equipment and access because it's just to hard. The re-routing here probably was for optics in part. The over engineering means by passing the buck to another hospital they can't get blamed for anything.

nefitty 6y ago
People die from other causes so we shouldn’t worry about ransomware? That doesn’t make any sense, and it’s an issue specifically relevant to HN because the a large amount of the demo is software engineers. Finally, what indication whatsoever did you find that there was deliberate blame-shifting? I don’t even understand where a cynical conclusion like that comes from. That might be one of the wildest and most tone-deaf comments I’ve ever read on HN.
- aaron695 6y ago
  How did the patient die? How did the delay cause the death? There are tons of ransomware cases everyday we can look at. This has no info about the gang yet. It does have the exploit (CVE-2019-19871) which is good, but no real IT analysis yet. So this is about the death. Can you run me through the process of the death so we can talk about how to stop this again. Could the IT routers going down cause a similar issue? Why could they not see the severity of the case and stop the re-routing? Was this tied to the failed computer system? Why was the nearest hospital so far away? Here's a map - https://www.google.com.bz/maps/search/Duesseldorf+hospitals/@51.2162571,6.7792857,13z/data=!3m1!4b1 https://www.google.com.bz/maps/search/Duesseldorf+hospitals/... Why is sending people to other hospitals such a big deal? Is this unusual? What's the normal kill rate so we can gauge the severity? I'm happy to recover the thread, you think it has value. I just need the bits filled in, Thanks.
  - 6y ago