22 ms·
FBI, DHS, HHS Warn of Imminent Ransomware Threat Against U.S. Hospitals
- shostack 6y agoHow similar does this sound to the NotPetya "digital nuke" Russia unleashed on Ukraine? https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/ https://www.wired.com/story/notpetya-cyberattack-ukraine-rus...
- throw_m239339 6y agoI guess it will be another "for decades we didn't care about security because no obvious short term profits, now we will have to pay a great price" moments. The article you linked is absolutely fascinating. Because network security improvements didn't grant higher ups "bonuses" they didn't make the slightest effort to do what engineered desperately asked. > The security revamp was green-lit and budgeted. But its success was never made a so-called key performance indicator for Maersk’s most senior IT overseers, so implementing it wouldn’t contribute to their bonuses. They never carried the security makeover forward. 10 billions of damages later...
- sacks2k 6y agoAll you need is a Russian IP address and you too can be Russian.
- vmception 6y agoYou get paid the ransom The Russian that owns the computer never gets framed because the subpoena fails and the public doesn't look for you and just maintains their antiquated Red Scare™ All because of ignorance and pride on our leaders to not admit they don't have a handle on this
- lame-robot-hoax 6y agoAh yes, I’m sure that’s all the evidence they have that points towards Russia/Eastern Europe.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- sieabahlpark 6y agoJust enough time to hide all the evidence related to covid. How convenient
- haswell 6y agoThis is not what we need in these final chapters of 2020 with COVID cases spiking. > Charles Carmakal, senior vice president for Mandiant, told Reuters that UNC1878 is one of most brazen, heartless, and disruptive threat actors he’s observed over the course of his career. This is what terrorism looks like in 2020. Horrifying, terrifying, disgusting.
- Larrikin 6y agoWhy the assumption that its terrorist and not a state sanctioned attack?
- sudosysgen 6y agoIf we're honest, it's neither. It's 1000% profit-orientated.
- Johnjonjoan 6y agoI think you just accurately described most of North Korea's cyber attacks. Not to say that they are the culprit; just that state sponsored and and money driven aren't necessarily exclusive.
- toomanybeersies 6y agoCyber attacks are probably the least interesting enterprise that North Korea is involved in [1] They're also involved quite heavily in the illegal drug trade and bootlegging cigarettes and alcohol, using their embassies and diplomats as a distribution network, as well as counterfeiting currency and pharmaceuticals, running an international restaurant chain [2], building statues for tinpot dictators [3], shipping citizens off to Russia as "contract workers", smuggling ivory, trafficking arms, and previously leased out embassy buildings in Berlin to a hostel [4] [1] https://en.wikipedia.org/wiki/North_Korea%27s_illicit_activities https://en.wikipedia.org/wiki/North_Korea%27s_illicit_activi... [2] https://en.wikipedia.org/wiki/Pyongyang_(restaurant_chain) https://en.wikipedia.org/wiki/Pyongyang_(restaurant_chain) [3] https://www.bbc.com/news/magazine-35569277 https://www.bbc.com/news/magazine-35569277 [4] https://en.wikipedia.org/wiki/Embassy_of_North_Korea,_Berlin https://en.wikipedia.org/wiki/Embassy_of_North_Korea,_Berlin
- vmception 6y agoThat's messed up if true, but why would a ransomware operator target them? I mean like, they don't really target, they just wait for people to install something right?
- dmix 6y agoProbably for initial infection it’s random but the negotiation for keys happens between real people. Thieves must be heartless to go after such desperate targets. But criminals always have ways of justifying things.
- closeparen 6y ago>but the negotiation for keys happens between real people I would be surprised if no one has written a smart contract for this yet - release the keys when X BTC are deposited to address Y.
- ncallaway 6y agoHow would the smart contract be able to validate that the 'keys' it releases are authentic before-hand?
- vmception 6y agoIt wouldn't. The smart contract would just wait for payment and the control server would watch for payments. the victim would still have to trust that this process was in place, but for operator can have it completely automated doesn't actually have to be a smart contract, just any address essentially. but a smart contract could allow for many more features, not sure if you'd really want that here
- closeparen 6y agoI'm imagining that "keep this value secret until payment is made" could be handled entirely on the blockchain, so that there is no C&C to shut down. But I'm not actually that familiar with the capabilities and limitations of smart contracts.
- blendo 6y agoBad health IT is a public health issue. Perhaps it’s time for hospitals to regularly report their OS versions and patch levels to our local health departments.
- samename 6y agoMy hospital offline for a whole week because they got hit by a ransomware attack, and they use Epic. I asked someone I knew at Epic what she knew about it, and confirmed that my hospital was up-to-date on the latest version of their software and following most of their security protocols. My initial thought was they had weak IT security and now I’m not so sure.
- Scoundreller 6y agoThe EMR probably wasn't the vulnerability, but rather the OS, etc. that was running it.
- resfirestar 6y agoDoesn’t matter if their Epic servers are up to date if the attacker got a domain admin account somewhere else and can just log in normally to run the ransomware.
- rayhendricks 6y agoYup just spearfish one of the employees with a password reset email. People including educated developers and MDs are in general very lax about security. But also you have windows 7 legacy systems running specialized equipment that has been validated for that OS and software version number. There is really no way around this, if a country wants to kill Americans right now IMO it is most effective to disable EPIC servers in ND/SD/WI/MT that would cause way too much chaos and people would die. But also what are we doing running life-critical software on Microsoft-made OS? This is idiotic, it is great for gaming and excel but not hospitals. Microsoft could make another OS based on Linux or BSD and it could not be hot garbage. But that would eat into profits and take...effort. Linux and ChromeOS + 2FA is much better although not perfect.
- latchkey 6y agohttps://www.nytimes.com/2020/10/28/us/hospitals-cyberattacks-coronavirus.html https://www.nytimes.com/2020/10/28/us/hospitals-cyberattacks...
- coolspot 6y agohttps://archive.is/Cs6RR https://archive.is/Cs6RR
- Dahoon 6y agoSomeone should ransomware Krebs and force him to get a mobile friendly site.
- wills_forward 6y agoLOL’d
- Stierlitz 6y agoSeriously HR admins, if you care anything about your reputation, you should cease re-posting this kind of neocon disinformation.
- MattGaiser 6y agoYou are on a site where there are thousands of people who have personally encountered ransomware. Are we all neocons to you?
- Stierlitz 6y agoIf you run your infrastructure on a “computer” directly connected to the Internet such that it puts hospitals and power grids in danger, then maybe you're in the wrong profession.
- rlt 6y agoThat’s a naive position to take. Hospitals employ actual people who need to access information from mobile devices, home, etc. They should, however, require those devices are locked down and connected via secure means.
- coldpie 6y agoIf you're putting the words "secure" and "computer" in the same sentence, you've already lost. There is no such thing as computer security.
- Stierlitz 6y ago@coldpie: ‘If you're putting the words "secure" and "computer" in the same sentence, you've already lost. There is no such thing as computer security.’ We should borrow an idea from nature and not create a monoculture. That way when a ‘computer virus’ comes along, it won't run rampant through the ecosystem.
- FpUser 6y ago
- milquetoastaf 6y agoWonder if this is related to the recent breach of psychological patient data
- enahs-sf 6y agoI'm not sure how, but somehow, I suspect that my health insurance premiums are about to increase.
- lotsofpulp 6y agoHealth insurance premiums are just total healthcare costs for the insured lives plus x% for operations of the health insurance company. If all hospitals have to raise prices to meet IT costs, then presumably the total cost of healthcare for the insured lives goes up, and hence the health insurance premium has to go up. So yes, typically if your vendor's suppliers increase price, then your vendor will increase their price too. If your vendor has big margins and you have the ability to switch to a different vendor, then maybe the vendor will eat the cost, but health insurance is already a low margin business, so that's not likely.
- proggy 6y ago> health insurance is already a low margin business I’d like to know much, much more about this statement.
- supertrope 6y agoBy the ACA law health insurance companies have to pay out at least 80% of premiums on claims. The cost of running the company and any profit has to come out of the other 20%. 5% of billions of dollars is huge in absolute figures but as a percentage falls in line with other industries.
- supertrope 6y agoTo fix medical service affordability we need to bring down the cost of the services instead of expecting significantly more efficient insurance plans. We can’t insure away high costs. They just pass through the costs via premium and deductible increases. Even if health insurers were nonprofits that would only directly save us 5%. High deductibles encouraging shopping around but price discovery is very limited as even doctors don’t know how much a service costs. Focusing on price alone is an issue as people don’t know medicine and are unable to evaluate quality so they end up giving five stars for having a private room or suck up staff. What ends up happening is the not well off or frugal avoid care until there’s an undeniable problem. Others consider consuming medical services a dignity not a price and will never give up their low co-pay plans.
- flattone 6y agoIs the US ransom-ware-ing Russia? Or anything similar?
- yuskii 6y agoI don't see any specific details on this.
- djsumdog 6y agoYea, there's very little .. evidence listed.
- TameAntelope 6y agohttps://gist.github.com/aaronst/6aa7f61246f53a8dd4befea86e832456 https://gist.github.com/aaronst/6aa7f61246f53a8dd4befea86e83... That's got a list of some info, my understanding is that you can take information like that and look at other attack to start to see if there are elements in common to give you more overall information about the group possibly responsible, and how to detect the group again more quickly next time, to possibly jump in and deal with the problem before it leads to exfiltration or destruction or whatever bad thing you're trying to avoid. https://www.youtube.com/watch?v=BhjQ6zsCVSc https://www.youtube.com/watch?v=BhjQ6zsCVSc talks a bit about how to detect UNC1878. It sounds, specifically, like Hold Security is monitoring criminal communication and picked up a reference to this campaign ahead of the execution. Combined with the subsequent follow-through, it would be pretty straightforward to attribute the folks who said, "We're going to do this thing soon" as the folks who then ended up doing exactly that thing. For what it's worth, I know nothing more about this than what was presented in the article.
- mullingitover 6y agoInteresting that DHS's public twitter has no word of this, and instead is a full-time campaign ad for the border fence. It's also ironic that for all the pervasive government surveillance of the internet, this stuff just flies right under the radar. I thought the whole point of this surveillance was for our protection?
- deleted 6y ago[deleted]
- vmchale 6y agoDHS is a shitshow, Chad Wolf isn't even legally supposed to be running the thing.
- btc2020 6y agoThanks, Bitcoin. This is your legacy.
- the_resistence 6y agoThe world's security services have to put a full court press on this clear and present danger.
- EQYV 6y agoIf this attack results in actual loss of life, I firmly believe the US should ensure that there are real-world physical consequences for these criminals. They cannot be described as anything less than the worst humanity has to offer. A failure to respond with meaningful and severe consequences for those responsible (assuming this is attack can be confidently attributed to a particular threat actor) opens the floodgates. Time to find out how seriously the US takes its own cyber doctrine. https://www.reuters.com/article/us-usa-defense-cybersecurity-idUSTRE7AF02Y20111116 https://www.reuters.com/article/us-usa-defense-cybersecurity...
- xvector 6y agoIf US citizens die due to this, I am 100% down with bringing the full might of our military down on the state/group that did this. No mercy.
- fnord77 6y agowhat if the state actor who did this has nuclear weapons?
- ardit33 6y agotreat them as terrorist, and eliminate some of the leaders until they get the message
- irjustin 6y agoI mean that sounds simple and all.. But historically that hasn't worked well for us long term.
- asdfasgasdgasdg 6y agoIt's true. Attacking random countries that follow the same religions as a particular bad guy is not a recipe for long term prosperity.
- 6y ago
- therockspush 6y agoAs diabolical as this is, you wouldn't really need state level actions to take down hospitals. Anyone who has been to one in the last year, pre-covid even, understands the ferris wheel of nurses and doctors that churn through the butter of what goes on there. These weren't exactly hardened targets to begin with.
- ardit33 6y agoIt is happening: https://www.bloomberg.com/amp/news/articles/2020-10-28/u-s-hospitals-hit-by-coordinated-ransomware-attack-firm-says https://www.bloomberg.com/amp/news/articles/2020-10-28/u-s-h... Patients are being turned away: Wyckoff Hospital hit by computer virus https://www.reddit.com/r/nyc/comments/jju0rp/wyckoff_hospital_hit_by_computer_virus/ https://www.reddit.com/r/nyc/comments/jju0rp/wyckoff_hospita...
- deleted 6y ago[deleted]
- doublerabbit 6y agonon-amp https://www.bloomberg.com/news/articles/2020-10-28/u-s-hospitals-hit-by-coordinated-ransomware-attack-firm-says https://www.bloomberg.com/news/articles/2020-10-28/u-s-hospi...
- rlt 6y agoI assume/hope hospitals have contingency plans for if their network goes down? It would certainly make them less efficient and result in more errors, but hopefully they wouldn’t grind to a complete halt.
- RcouF1uZ4gsC 6y agoThe simplest solution is to ban Bitcoin and the other cryptocurrency. Crypto currency is what enables this.
- nomercy400 6y agoConsider a hospital like a person's body. If you don't nurture a wound, you'll get an infection. If you don't clean your hands before eating or you eat something foul, you get diarrhea. The outside world is a dangerous place, and if you wish to interact with it, you should have your defences in order and take necessary precautions. And then still bad actors will get through, such as the yearly flu, so you must deal with that as well. You won't defeat the outside world with offense, there's just too much out there, adapting too fast.
- ificanhelp 6y agoThis is truly appalling per se, even more so during a global pandemic. If I can be of any help to stop this, disrupt these guys or whatever I'm ready to give a few of my days and nights to it. Contact email in my about. I'm a professional developper with a dormant interest in ethical hacking. Been following EH courses, done some CTFs ranging from basic web pen testing to crypto and assembly debugging and been reading/watching keenly everything I saw on cyber-security in the past 5-6 years.
- hrgiger 6y agoThere is still an opportunity from the lessons learned. You can regulate your hospital systems as you regulate financial institutions and certificate them. I was also thinking a network setup on a sub-pub system separating trusted and untrusted networks using computer vision via optical sensors or camera&monitor in an old fashion using ocr,classification or even barkod /optimized qr code that client picks task id and id from queue and shows on a device and server reads via sensor or camera. Maybe problem is not the we are lack of solution but the systems just old.
- deleted 6y ago[deleted]
- aitchnyu 6y agoIs there an analysis of the stack (OS, apps) used by victim orgs and the holes in their systems? I'm guessing its always EOLed Windows versions.
- Beached 6y agoit is definitely not always eol windows, most ransomware I have seen rune on modern os, fully patched with you to date av. it is not hard to creat or distribute or to mutate and keep active. it is not just windows either, I have seen it for osx and ubuntu, even cloud services like office365, Dropbox, etc. 99% of the time the hole in the system is the phishing email that the employee clicks on. you will be amazed how many link clicks, redirects warning messages and notices people will just click through because "hr" needs to verify you payroll information or other nonsense that doesn't even make sense.
- naveen99 6y agoMaybe hospitals should escrow their data with NSA. Append only backups. Get ransomware, restore from NSA backup. Make all that storage capacity useful.
- jcadam 6y agoTime to de-digitize, BSG-style. Back to paper records for anything remotely sensitive. And no networked computers for processing anything important.
- marketingPro 6y agoUS hospitals are ripe to attack. They make huge profits and use extremely outdated tech or use new (untested) software. I take this opportunity to complain about regulatory capture and the medical cartels. Their constant irresponsibility (opioid epidemic, coronavirus response) affects everyone. Yet they still are paid more than any other industry.
- LinuxBender 6y agoDo all these hospitals have backups that ransomware and automation can not tamper with? Is anti-tampering a requirement in their audits, or just detection? Have any hospitals started implementing secured workstations in kiosk mode? i.e. Windows 10 LTSC with all the hardening options enabled and AD permissions locked down and treating workstations as ephemeral devices.
- CompuHacker 6y agoIt is my experience that hospital(s) do not have the budget for Windows 10 across their entire network.
- LinuxBender 6y agoIn that case, my proposal would be that hospital customers should be able to opt into a program that allows them to buy a thumb drive from the hospital that has their records in an encrypted file, with images exported into an open lossless standard such as PNG. What size thumb drive would most patients individual records fit onto?
- hated 6y agoI registered an account to comment because this made me laugh. One does not simply export images from medical systems. It takes a ton of effort and clicking to get patient images out of most PACS systems IF YOU ARE LUCKY. DICOM images are often high bit-depth JPEG2000 and are hard to get access to because of the way PACS systems and medical devices store data. Screen scraping DICOMs would take ages as each DICOM can have any number of slices. You don't want to lose the original bit-depth either as radiologists use contrast enhancement techniques which don't work with images encoded in 8-bits like screen scrapes. The PACS tech industry is simply painful to deal with.
- LinuxBender 6y agoThat sounds challenging to deal with. What you are describing reminds me of proprietary backend banking, military systems and most internet-of-things that have custom firmware. Maybe I was hoping too much for hospitals to have pushed for more compatible standards. Do you have a theory as to why they have not evolved? Lack of vendor competition due to certification costs?
- easton_s 6y agoMy local hospital was hit with ransonware. They had backups but it took almost 5 months to get back to normal.
- shp0ngle 6y agoFinally a usecase for Bitcoin
- deleted 6y ago[deleted]
- ch4s3 6y agoIt's interesting that this topic was much talked about when I was working with hospitals 3-5 years ago. They've seen it coming, but have largely squandered the opportunity. Most hospitals store their data and run systems on-prem and are hyper-allergic to anything cloud based. They often have sloppy if extant back-up policies, and I've never heard of a hospital practicing a restore from backups. They also all seem to have terrible policies around passwords that cause most of their staff to iterate passwords every few months by simply incrementing a number at the end. You're also quite likely to find passwords on post it notes under half the keyboards in a given facility. Security certifications are kind of a joke and mostly conducted by lawyers and compliance officers who have no technical background, let-alone info sec training. TL;DR this has been a ticking time bomb for a decade and everyone involved knew it.
- IndySun 6y agoCould this be related to repealing ACA in some way? Would information stolen help one side or the other? Or is there no connection? & How would one know anyway? Non-American (but not ignorant of USA) wondering why this is happening now.
- JohnCClarke 6y agoInsurTechnix's founders experienced the effects of cyber attacks on multiple hospitals at our previous start up. That's one of the reasons we founded InsurTechnix. Here's an introduction to our ransomware report: https://youtu.be/2yDqp34JN9k https://youtu.be/2yDqp34JN9k If any hospital CISO and/or IT admin would like a three month free trial - even just to get through the current attacks - please reach out.
- buzzert 6y agoMikko Hypponen and F-Secure will get revenge. > Public message to ransomware gangs: Stay the f away from medical organizations. If you target hospital computer systems during the pandemic, we will use all of our resources to hunt you down. https://nitter.net/mikko/status/1240225603565105152?lang=en https://nitter.net/mikko/status/1240225603565105152?lang=en
- alexvoich 6y agoRussian hacker here (or "Criminal" I'm more honest than QC computing or anti virus scammers etc). The report is accurate but I told my fellas to stop attacking Hospitals. Brain is great. He gives me ideas for crime. My other friends just hate him.
- garfieldnate 6y agoWhy are hospital systems connected to the public internet, anyway? Wouldn't it make more sense to have all of the life-or-death stuff on its own secure network?
- deepsun 6y agoVery expensive to put and maintain separate cables, kinda separate internet.
- TheBobinator 6y agoThe actors responsable are doing an all out attack to maximize profits as US Large corps and military are currently targeting their networks to prevent election tampering. These botnet networks have prooven difficult to disrupt even fort hem. This is a profit maximization effort for them and probably one they'll do right before folding and disappearing as the last time hosptials and police were directly targeted national governments began disappearing the perpitrators. What'd be heartless is if the malware, such as the ryuk ransomware in December of 2019, had a bug in it that prevented the decryption key from working and all it did was garble and trash data. Be forwarned, a few groups deploying ransomware are on sanctions lists which carries direct liability if you pay them. If you're the IT staff, make the CFO\CEO pay them and wash your hands of it.