3 ms·

Important fact not stated in the article: the ransomware in question entered the hospitals' system via the Citrix vulnerability from the beginning of 2020. This

Important fact not stated in the article: the ransomware in question entered the hospitals' system via the Citrix vulnerability from the beginning of 2020. This has been confirmed by the German BSI (the country's institution responsible for cyber security issues). So: a gaping security hole known for eight months has been left open. This is especially important to keep in mind because their lame excuse is that they hadn't had enough time to fix the hole.

swarnie_ 6y ago
Are we going to pretend that all our systems, software and service are 100% up to date and there are no known issues? 8 months isn't uncommon for a lot of companies I've consulted for. In fact i've patched things with year with CVEs published in 2012/2013.
- the8472 6y ago
  Do lives depend on those companies' infrastructure?
  - vkou 6y ago
    Indirectly, they might.
  - swarnie_ 6y ago
    Some would argue the opposite, our inf. being up probably contributes to more deaths then when its down.
    - the8472 6y ago
      Then I don't think the situation is comparable. The hospital should keep things up to date and your clients should run things into the ground.
    - apetresc 6y ago
      Well now I'm curious...
      - swarnie_ 6y ago
        "Defence" manufacturing.
- threentaway 6y ago
  In all seriousness, how does this happen? Security updates are typically just installed with an apt-get upgrade and you're looking at a few minutes of downtime if the services needs to be restarted. Containers are even easier.
  - Bombthecat 6y ago
    How? It cost money and there is a... Hmm delayed impact (or none) that's why. But : germany is bringing out a new law about important IT infrastructure where you need a soc/ siem etc. I think its called IT sig.
    - pjmlp 6y ago
      This is definitely the kind of thing we need, when there is law involved, maybe that C library isn't appealing any more, or the CI/CD with all sorts of static analysis finally get the green light for the necessary infrastructure.
  - saagarjha 6y ago
    There’s no way most hospitals are using containers and a package manager, or even Linux for that matter.
  - tstrimple 6y ago
    You mean you're just running apt-get upgrade on critical systems which are literally responsible for the life and death of people without extensive testing and roll back procedures?
- pjmlp 6y ago
  No, but if companies start getting liable for not ensuring up to date secured software, the priorities will certainly change.
KorfmannArno 6y ago
The Problem seems to be that the hackers planted a backdoor in early 2020. So, the security hole was actually patched shortly after release of the security patch. Edit: Source: https://www.heise.de/news/Cyber-Angriff-auf-Uniklinik-Duesseldorf-Shitrix-schlug-zu-4904979.html https://www.heise.de/news/Cyber-Angriff-auf-Uniklinik-Duesse...

swarnie_ 6y ago

Are we going to pretend that all our systems, software and service are 100% up to date and there are no known issues? 8 months isn't uncommon for a lot of companies I've consulted for. In fact i've patched things with year with CVEs published in 2012/2013.

the8472 6y ago
Do lives depend on those companies' infrastructure?
- vkou 6y ago
  Indirectly, they might.
- swarnie_ 6y ago
  Some would argue the opposite, our inf. being up probably contributes to more deaths then when its down.
  - the8472 6y ago
    Then I don't think the situation is comparable. The hospital should keep things up to date and your clients should run things into the ground.
  - apetresc 6y ago
    Well now I'm curious...
    - swarnie_ 6y ago
      "Defence" manufacturing.
threentaway 6y ago
In all seriousness, how does this happen? Security updates are typically just installed with an apt-get upgrade and you're looking at a few minutes of downtime if the services needs to be restarted. Containers are even easier.
- Bombthecat 6y ago
  How? It cost money and there is a... Hmm delayed impact (or none) that's why. But : germany is bringing out a new law about important IT infrastructure where you need a soc/ siem etc. I think its called IT sig.
  - pjmlp 6y ago
    This is definitely the kind of thing we need, when there is law involved, maybe that C library isn't appealing any more, or the CI/CD with all sorts of static analysis finally get the green light for the necessary infrastructure.
- saagarjha 6y ago
  There’s no way most hospitals are using containers and a package manager, or even Linux for that matter.
- tstrimple 6y ago
  You mean you're just running apt-get upgrade on critical systems which are literally responsible for the life and death of people without extensive testing and roll back procedures?
pjmlp 6y ago
No, but if companies start getting liable for not ensuring up to date secured software, the priorities will certainly change.

KorfmannArno 6y ago

The Problem seems to be that the hackers planted a backdoor in early 2020. So, the security hole was actually patched shortly after release of the security patch. Edit: Source: https://www.heise.de/news/Cyber-Angriff-auf-Uniklinik-Duesseldorf-Shitrix-schlug-zu-4904979.html https://www.heise.de/news/Cyber-Angriff-auf-Uniklinik-Duesse...