5 ms·

Oregon hospital shuts down computer system after ransomware attack

109 points by weinzierl 6y ago

blackbear_ 6y ago
Hopefully they will make the fundamental connection: "backdoors for the government are backdoors for everybody else too". I don't think they will.
stonepresto 6y ago
The hospital is still moving forward with scheduled procedures, although those requiring imaging services may be delayed, according to a Herald and News report. Misleading title EDIT: turns out lack of sleep is bad, mmmkay? Misread the title.
- scoot 6y ago
  Perhaps you misread the title? It says, "Oregon hospital shuts down computer system", not "Oregon hospital shuts down", so the title is not at odds with the content.
  - TeMPOraL 6y ago
    It depends whether you implicitly put "the" or "a" in between "down" and "computer".
  - stonepresto 6y ago
    Yes, my fault. I blame it on my lack of sleep and already shite morning.
xupybd 6y ago
I hope the scummy criminals behind this get their dues one day. This is horrible
- Rainymood 6y ago
  The only good thing from this is that hospitals are waking up to the dangers of having weak digital security. Sadly this is the only way of having people invest more in security...
  - whatatita 6y ago
    Unfortunately, so many of the effected hospitals and health practitioners don't really understand the implications of a ransomware attack, the correct public disclosure process, or how to improve their security afterwards. Many hospitals hire a "cyber security expert" to upgrade their system and end up paying a small fortune. There's a budding hospital cyber sales industry more than happy to fleece these institutions.
    - officialchicken 6y ago
      They understand fully well, and in fact purposefully do nothing. They've had over a decade of warning and similar incidents. Like all overpaid consultants, they exist as scapegoats for executives who make decisions with sub-optimal results.
  - tsujamin 6y ago
    I remember having a conversation with someone who worked in Health Cyber Security a few years ago. They pointed out their MRI machine depended on an Windows Server 2K3 machine, which they didn't patch, networked on the corporate network (to access/transmit results). I asked why they couldn't patch or upgrade it, to which they responded: > "Every time we change patch or change the software configuration we need to have it re-certified before we can use it on a patient, and that takes months and $10,000's" I really hope we'll see some movement in the health security space, maybe leveraging SDN/Micro-segmentation or Identity-Aware-Proxy software like Hashicorp Boundary, but these aren't (really) zero-cost and add friction/delays to accessing the information you need about your patient... Time will tell.
    - dman 6y ago
deleted 6y ago
[deleted]
maaaaattttt 6y ago
Could this be related to https://news.ycombinator.com/item?id=24925899 https://news.ycombinator.com/item?id=24925899 ?
- DrAwdeOccarim 6y ago
  I was just wondering the same thing
mrzool 6y ago
These pieces of shit need to leave hospitals alone. We already had one dead connected to a ransomware attack on a hospital[1]. I hope they get caught and prosecuted. [1]: https://news.ycombinator.com/item?id=24513820 https://news.ycombinator.com/item?id=24513820
- rocqua 6y ago
  On the Risky business podcast, they've been advocating for 'releasing the hounds'. That is, let the intelligence agencies and military cyber capabilities loose on these criminals. This shit is enough of an impact on national security to justify this imho, even though it is 'merely' criminal activity.
  - 05 6y ago
    Yeah, why not waste all those zero days on posturing, great idea!
hacker_9 6y ago
China Phase 2..
DyslexicAtheist 6y ago
Within the past 24 hours at least 5 ransomware attacks[0][1] happened on US hospitals. Apart from timing, the attacks don't seem to originate from the same source (which is leading speculation about potential coordination and premature attribution - at least in my social media bubble). "It would be the season to launch politically motivated attacks (so close to election)" is a weak argument because: It's a war crime to attack hospitals and the risks of escalation for nation state actors are not aligned with their incentives. Assuming it's only financially motivated (crime groups) but with coordination (because timing): Very unlikely because criminal gangs lend themselves poorly to orchestration / coordination. A combination of political+criminal (local political actor financing crime groups)? Occam's razor cuts deep here. Assume the human brain primed to recognize patterns is a weakness and apply Hanlon's razor. Then the "Timing" is just coincidence and cause is horrible healthcare IT. The combination of the pandemic, a politically charged climate (elections), technical-debt in healthcare, premature cyber-attribution, could create a perfect storm. The real lede buried among social media cyber fear-mongering: Discussion wouldn't take place if systems had been patched. [0] https://nitter.net/uuallan/status/1321477875648942086 https://nitter.net/uuallan/status/1321477875648942086 [1] https://nitter.net/ColdHandsMD/status/1321227783968796674 https://nitter.net/ColdHandsMD/status/1321227783968796674 [2] https://twitter.com/whitequark/status/1321625126841032705 https://twitter.com/whitequark/status/1321625126841032705 see also CISA advisory (pdf) https://us-cert.cisa.gov/sites/default/files/publications/AA20-302A_Ransomware%20_Activity_Targeting_the_Healthcare_and_Public_Health_Sector.pdf https://us-cert.cisa.gov/sites/default/files/publications/AA...
- jkilpatr 6y ago
  > It's a war crime to attack hospitals and the risks of escalation for nation state actors are not aligned with their incentives. The primary point of nation-state cybercrime is that individual citizens have not yet established at any large scale if they would support a physical response to a cyber attack. If you have a physical attack political leadership can be pretty sure the people will support them in retaliating. But with cybercrime, without big pictures on the TV of death and destruction that support does not seem to exist. Combine this with an opposing party willing to capitalize on public doubt and inaction is a political certainty.
- 6y ago
griffoa 6y ago
I foresee see blitz build up of troops within the next week in eastern Fujian.
amenod 6y ago
How is it possible that in the time where filesystems with history exist (btrfs, I think ZFS?), this kind of attacks are still possible? It is just software... I would assume it would take OS vendors waaaay less money to implement foolproof protection against such attacks than it takes the victims to pay for data restoration. Sure, storage use would go up, but is this even a problem? I would assume most files are write-once, and there could be sensible exceptions made for the files that update frequently.
- deleted 6y ago
  [deleted]
- SteveNuts 6y ago
  Usually the infected computers are running Windows, which doesn't have full filesystem snapshot capability. Storage servers/SANs will have snapshot capability but it takes a long time to roll back and bring things back up. Also, a lot of companies don't plan for the fact that restoring that snapshot effectively doubles the required amount of storage. I've heard of storage vendors sending huge amounts of new shelves of disk to customers so they have enough space to expand their snapshots.
  - gerdesj 6y ago
    Windows has "previous versions" or shadow copies. Often, one of the first things ransomeware does is disable that function and delete them. Then it goes after your backups.
  - lostmsu 6y ago
    Let's not put undue blame on Windows here. Not only it is factually incorrect (Windows System Restore has been around for ages, and File History is on by default on recent versions), Windows nags users to set up backup to an external storage, which, for example, Ubuntu does not even suggest.
    - SteveNuts 6y ago
      Windows restore doesn't help if your entire data store is encrypted and the OS is offline.
waihtis 6y ago
Whether or not it is correct by definition, ransomware attacks aimed at healthcare institutes should be labelled 'cyber terrorism' to create the right mental picture in the head of the general public.
- turbinerneiter 6y ago
  OK, but then not patching your shit, having root/root as your db password, exposing data to the internet that does not need to be exposed and collecting data that does not need to be collected also has to be treated like a crime. We called it "computer virus" for a reason. This stuff is just part of the environment. We yell at people for not vaccinating, we condemn people who are not wearing mask and follow social distancing protocols. Also, if we call this cyber terrorism, we also have to call the NSA and similar terrorist organisations and shut them down: they find vulnerabilities and keep them secret to use them themselves, and they buy exploits, funnelling money into the black market. Just imagines: a hospital shuts down after being hit by an exploit, that was developed with NSA money and they didn't tell the public about.
  - bollu 6y ago
    I'm sure it will be called "cyber preparedness", just as biological warfare was dubbed "biopreparat" by the USSR...
  - waihtis 6y ago
    In some cases they should, but the chain of responsibility does not end with the technical staff. Technical staff needs resources from management and may own/inherit a well-organized network or a complete clusterf*ck depending on the organization. Management deploys resources to a level to not annoy owners / investors. This level is influenced by external forces, like regulation. So regulators need to step their game way up, but are also time & resource-constrained. How do regulators pull the needed resources? Tax money. How to justify tax money? Have a public that is informed of the danger and criticality of having hospitals operated in the way they are right now. This is of course a big simplification, but the chain goes much further than just "IT that doesn't patch."
coldcode 6y ago
If security costs money, and you get paid to make money, then security is not important until it's too late. I've seen my share of "security" executives for whom actual security leadership consisted of dogs and ponies and lots of hand waving which was cheap and made them popular with the other execs. It's like being a general with no war around; then when you get a real war you find out the general has no clue how to fight a war.
swiley 6y ago
Today we learn that basic Computer Security practices aren't a joke. Just like washing your hands, patching your software and checking occasionally to make sure it's not doing something stupid is, in fact, critically important.
- jiveturkey 6y ago
  Don't we learn that almost every day? No, we are not learning.
JohnCClarke 6y ago
InsurTechnix's founders experienced the effects of cyber attacks on multiple hospitals at our previous start up. That's one of the reasons we founded InsurTechnix. Here's an introduction to our ransomware report: https://youtu.be/2yDqp34JN9k https://youtu.be/2yDqp34JN9k If any hospital CISO and/or IT admin would like a three month free trial - even just to get over the current attacks - please reach out.

109 points by weinzierl 6y ago

Hopefully they will make the fundamental connection: "backdoors for the government are backdoors for everybody else too". I don't think they will.

stonepresto 6y ago

The hospital is still moving forward with scheduled procedures, although those requiring imaging services may be delayed, according to a Herald and News report. Misleading title EDIT: turns out lack of sleep is bad, mmmkay? Misread the title.

scoot 6y ago
Perhaps you misread the title? It says, "Oregon hospital shuts down computer system", not "Oregon hospital shuts down", so the title is not at odds with the content.
- TeMPOraL 6y ago
  It depends whether you implicitly put "the" or "a" in between "down" and "computer".
- stonepresto 6y ago
  Yes, my fault. I blame it on my lack of sleep and already shite morning.

xupybd 6y ago

I hope the scummy criminals behind this get their dues one day. This is horrible

Rainymood 6y ago
The only good thing from this is that hospitals are waking up to the dangers of having weak digital security. Sadly this is the only way of having people invest more in security...
- whatatita 6y ago
  Unfortunately, so many of the effected hospitals and health practitioners don't really understand the implications of a ransomware attack, the correct public disclosure process, or how to improve their security afterwards. Many hospitals hire a "cyber security expert" to upgrade their system and end up paying a small fortune. There's a budding hospital cyber sales industry more than happy to fleece these institutions.
  - officialchicken 6y ago
    They understand fully well, and in fact purposefully do nothing. They've had over a decade of warning and similar incidents. Like all overpaid consultants, they exist as scapegoats for executives who make decisions with sub-optimal results.
- tsujamin 6y ago
  I remember having a conversation with someone who worked in Health Cyber Security a few years ago. They pointed out their MRI machine depended on an Windows Server 2K3 machine, which they didn't patch, networked on the corporate network (to access/transmit results). I asked why they couldn't patch or upgrade it, to which they responded: > "Every time we change patch or change the software configuration we need to have it re-certified before we can use it on a patient, and that takes months and $10,000's" I really hope we'll see some movement in the health security space, maybe leveraging SDN/Micro-segmentation or Identity-Aware-Proxy software like Hashicorp Boundary, but these aren't (really) zero-cost and add friction/delays to accessing the information you need about your patient... Time will tell.
  - dman 6y ago

deleted 6y ago

[deleted]

maaaaattttt 6y ago

Could this be related to https://news.ycombinator.com/item?id=24925899 https://news.ycombinator.com/item?id=24925899 ?

DrAwdeOccarim 6y ago
I was just wondering the same thing

mrzool 6y ago

These pieces of shit need to leave hospitals alone. We already had one dead connected to a ransomware attack on a hospital[1]. I hope they get caught and prosecuted. [1]: https://news.ycombinator.com/item?id=24513820 https://news.ycombinator.com/item?id=24513820

rocqua 6y ago
On the Risky business podcast, they've been advocating for 'releasing the hounds'. That is, let the intelligence agencies and military cyber capabilities loose on these criminals. This shit is enough of an impact on national security to justify this imho, even though it is 'merely' criminal activity.
- 05 6y ago
  Yeah, why not waste all those zero days on posturing, great idea!

hacker_9 6y ago

China Phase 2..

DyslexicAtheist 6y ago

Within the past 24 hours at least 5 ransomware attacks[0][1] happened on US hospitals. Apart from timing, the attacks don't seem to originate from the same source (which is leading speculation about potential coordination and premature attribution - at least in my social media bubble). "It would be the season to launch politically motivated attacks (so close to election)" is a weak argument because: It's a war crime to attack hospitals and the risks of escalation for nation state actors are not aligned with their incentives. Assuming it's only financially motivated (crime groups) but with coordination (because timing): Very unlikely because criminal gangs lend themselves poorly to orchestration / coordination. A combination of political+criminal (local political actor financing crime groups)? Occam's razor cuts deep here. Assume the human brain primed to recognize patterns is a weakness and apply Hanlon's razor. Then the "Timing" is just coincidence and cause is horrible healthcare IT. The combination of the pandemic, a politically charged climate (elections), technical-debt in healthcare, premature cyber-attribution, could create a perfect storm. The real lede buried among social media cyber fear-mongering: Discussion wouldn't take place if systems had been patched. [0] https://nitter.net/uuallan/status/1321477875648942086 https://nitter.net/uuallan/status/1321477875648942086 [1] https://nitter.net/ColdHandsMD/status/1321227783968796674 https://nitter.net/ColdHandsMD/status/1321227783968796674 [2] https://twitter.com/whitequark/status/1321625126841032705 https://twitter.com/whitequark/status/1321625126841032705 see also CISA advisory (pdf) https://us-cert.cisa.gov/sites/default/files/publications/AA20-302A_Ransomware%20_Activity_Targeting_the_Healthcare_and_Public_Health_Sector.pdf https://us-cert.cisa.gov/sites/default/files/publications/AA...

jkilpatr 6y ago
> It's a war crime to attack hospitals and the risks of escalation for nation state actors are not aligned with their incentives. The primary point of nation-state cybercrime is that individual citizens have not yet established at any large scale if they would support a physical response to a cyber attack. If you have a physical attack political leadership can be pretty sure the people will support them in retaliating. But with cybercrime, without big pictures on the TV of death and destruction that support does not seem to exist. Combine this with an opposing party willing to capitalize on public doubt and inaction is a political certainty.
6y ago

griffoa 6y ago

I foresee see blitz build up of troops within the next week in eastern Fujian.

amenod 6y ago

How is it possible that in the time where filesystems with history exist (btrfs, I think ZFS?), this kind of attacks are still possible? It is just software... I would assume it would take OS vendors waaaay less money to implement foolproof protection against such attacks than it takes the victims to pay for data restoration. Sure, storage use would go up, but is this even a problem? I would assume most files are write-once, and there could be sensible exceptions made for the files that update frequently.

deleted 6y ago
[deleted]
SteveNuts 6y ago
Usually the infected computers are running Windows, which doesn't have full filesystem snapshot capability. Storage servers/SANs will have snapshot capability but it takes a long time to roll back and bring things back up. Also, a lot of companies don't plan for the fact that restoring that snapshot effectively doubles the required amount of storage. I've heard of storage vendors sending huge amounts of new shelves of disk to customers so they have enough space to expand their snapshots.
- gerdesj 6y ago
  Windows has "previous versions" or shadow copies. Often, one of the first things ransomeware does is disable that function and delete them. Then it goes after your backups.
- lostmsu 6y ago
  Let's not put undue blame on Windows here. Not only it is factually incorrect (Windows System Restore has been around for ages, and File History is on by default on recent versions), Windows nags users to set up backup to an external storage, which, for example, Ubuntu does not even suggest.
  - SteveNuts 6y ago
    Windows restore doesn't help if your entire data store is encrypted and the OS is offline.

waihtis 6y ago

Whether or not it is correct by definition, ransomware attacks aimed at healthcare institutes should be labelled 'cyber terrorism' to create the right mental picture in the head of the general public.

turbinerneiter 6y ago
OK, but then not patching your shit, having root/root as your db password, exposing data to the internet that does not need to be exposed and collecting data that does not need to be collected also has to be treated like a crime. We called it "computer virus" for a reason. This stuff is just part of the environment. We yell at people for not vaccinating, we condemn people who are not wearing mask and follow social distancing protocols. Also, if we call this cyber terrorism, we also have to call the NSA and similar terrorist organisations and shut them down: they find vulnerabilities and keep them secret to use them themselves, and they buy exploits, funnelling money into the black market. Just imagines: a hospital shuts down after being hit by an exploit, that was developed with NSA money and they didn't tell the public about.
- bollu 6y ago
  I'm sure it will be called "cyber preparedness", just as biological warfare was dubbed "biopreparat" by the USSR...
- waihtis 6y ago
  In some cases they should, but the chain of responsibility does not end with the technical staff. Technical staff needs resources from management and may own/inherit a well-organized network or a complete clusterf*ck depending on the organization. Management deploys resources to a level to not annoy owners / investors. This level is influenced by external forces, like regulation. So regulators need to step their game way up, but are also time & resource-constrained. How do regulators pull the needed resources? Tax money. How to justify tax money? Have a public that is informed of the danger and criticality of having hospitals operated in the way they are right now. This is of course a big simplification, but the chain goes much further than just "IT that doesn't patch."

coldcode 6y ago

If security costs money, and you get paid to make money, then security is not important until it's too late. I've seen my share of "security" executives for whom actual security leadership consisted of dogs and ponies and lots of hand waving which was cheap and made them popular with the other execs. It's like being a general with no war around; then when you get a real war you find out the general has no clue how to fight a war.

swiley 6y ago

Today we learn that basic Computer Security practices aren't a joke. Just like washing your hands, patching your software and checking occasionally to make sure it's not doing something stupid is, in fact, critically important.

jiveturkey 6y ago
Don't we learn that almost every day? No, we are not learning.

JohnCClarke 6y ago

InsurTechnix's founders experienced the effects of cyber attacks on multiple hospitals at our previous start up. That's one of the reasons we founded InsurTechnix. Here's an introduction to our ransomware report: https://youtu.be/2yDqp34JN9k https://youtu.be/2yDqp34JN9k If any hospital CISO and/or IT admin would like a three month free trial - even just to get over the current attacks - please reach out.