3 ms·

Within the past 24 hours at least 5 ransomware attacks[0][1] happened on US hospitals. Apart from timing, the attacks don't seem to originate from the same sou

Within the past 24 hours at least 5 ransomware attacks[0][1] happened on US hospitals. Apart from timing, the attacks don't seem to originate from the same source (which is leading speculation about potential coordination and premature attribution - at least in my social media bubble). "It would be the season to launch politically motivated attacks (so close to election)" is a weak argument because: It's a war crime to attack hospitals and the risks of escalation for nation state actors are not aligned with their incentives. Assuming it's only financially motivated (crime groups) but with coordination (because timing): Very unlikely because criminal gangs lend themselves poorly to orchestration / coordination. A combination of political+criminal (local political actor financing crime groups)? Occam's razor cuts deep here. Assume the human brain primed to recognize patterns is a weakness and apply Hanlon's razor. Then the "Timing" is just coincidence and cause is horrible healthcare IT. The combination of the pandemic, a politically charged climate (elections), technical-debt in healthcare, premature cyber-attribution, could create a perfect storm. The real lede buried among social media cyber fear-mongering: Discussion wouldn't take place if systems had been patched. [0] https://nitter.net/uuallan/status/1321477875648942086 https://nitter.net/uuallan/status/1321477875648942086 [1] https://nitter.net/ColdHandsMD/status/1321227783968796674 https://nitter.net/ColdHandsMD/status/1321227783968796674 [2] https://twitter.com/whitequark/status/1321625126841032705 https://twitter.com/whitequark/status/1321625126841032705 see also CISA advisory (pdf) https://us-cert.cisa.gov/sites/default/files/publications/AA20-302A_Ransomware%20_Activity_Targeting_the_Healthcare_and_Public_Health_Sector.pdf https://us-cert.cisa.gov/sites/default/files/publications/AA...

jkilpatr 6y ago
> It's a war crime to attack hospitals and the risks of escalation for nation state actors are not aligned with their incentives. The primary point of nation-state cybercrime is that individual citizens have not yet established at any large scale if they would support a physical response to a cyber attack. If you have a physical attack political leadership can be pretty sure the people will support them in retaliating. But with cybercrime, without big pictures on the TV of death and destruction that support does not seem to exist. Combine this with an opposing party willing to capitalize on public doubt and inaction is a political certainty.
hooande 6y ago
is there a source for five attacks, other than this nitter post?
- DyslexicAtheist 6y ago
  other than the post by this Threat Intel Analyst working at RecordedFuture and who has written 5 Security books and tweets under his real name? no. this one has 3: https://www.wwnytv.com/2020/10/27/gouverneur-canton-potsdam-hospitals-dealing-with-computer-problems/ https://www.wwnytv.com/2020/10/27/gouverneur-canton-potsdam-... this is 1x https://www.beckershospitalreview.com/cybersecurity/oregon-hospital-shuts-down-computer-system-after-ransomware-attack-4-notes.html https://www.beckershospitalreview.com/cybersecurity/oregon-h... Reuters says dozens: https://mobile.reuters.com/article/amp/idUSKBN27E0EP https://mobile.reuters.com/article/amp/idUSKBN27E0EP note/edit: nitter is just a shadow platform for twitter that removes tracking and useless javascript bloat. (it seems HN doesn't like it because any submissions pointing to nitter can not be engaged with. but nitter is more user-friendly and privacy respecting than twitter though. no need for a subscription and no errors when visiting links as common on twitter)
ElDji 6y ago
> It's a war crime to attack hospitals Bombing an hospital is a war crime. Letting some malware find it's way into misconfigured Microsoft computers is not.
- meowface 6y ago
  >Letting some malware find it's way into misconfigured Microsoft computers is not. Especially more recently, ransomware gangs have been deliberately targeting specific organizations. It's not necessarily just a matter of malware spreading rampantly and it happening to land on a hospital system before encrypting all their shares automatically. I'm sure that still occurs, but a lot of them are now picking organizations ahead of time and doing more sophisticated, hand-tailored things to try to get in and encrypt as many files across the network as possible, then explicitly setting and negotiating a hefty ransom based on what they think the organization is able to pay.
- JumpCrisscross 6y ago
  > Letting some malware find it's way into misconfigured Microsoft computers is not I believe it is. And if a nation were found to be attacking or knowingly permitting the attack of American hospitals in the midst of a pandemic, a physical strike against their military assets (though not personnel) would be proportional. But this has to be made clear ex ante, which it hasn’t been.
  - babuskov 6y ago
    > a physical strike against their military assets though not personnel would be proportional. What if that other country has nuclear weapons? Would WWIII start with cyber attacks first?
    - raverbashing 6y ago
      Well, you might ask that of the attacking country yourself But apparently they know that people are hesitant in retaliating As I have said before, paying ransoms and not retaliating is a good way to keep being attacked and asked for even more ransoms
baq 6y ago
these might be separate groups closing positions almost simultaneously after learning that they weren't first to maximize their chance of not getting bulldozed out of compromised systems by coordinated fed and/or private IT security actions in the aftermath of the initial attack.
simias 6y ago
Do all 5 attacks share some common vector? If so it could be that some zero-day or vulnerable target list has been shared within the past few days on some seedy underbelly of the darknet and a few opportunists decided to act on it?

jkilpatr 6y ago

> It's a war crime to attack hospitals and the risks of escalation for nation state actors are not aligned with their incentives. The primary point of nation-state cybercrime is that individual citizens have not yet established at any large scale if they would support a physical response to a cyber attack. If you have a physical attack political leadership can be pretty sure the people will support them in retaliating. But with cybercrime, without big pictures on the TV of death and destruction that support does not seem to exist. Combine this with an opposing party willing to capitalize on public doubt and inaction is a political certainty.

hooande 6y ago

is there a source for five attacks, other than this nitter post?

DyslexicAtheist 6y ago
other than the post by this Threat Intel Analyst working at RecordedFuture and who has written 5 Security books and tweets under his real name? no. this one has 3: https://www.wwnytv.com/2020/10/27/gouverneur-canton-potsdam-hospitals-dealing-with-computer-problems/ https://www.wwnytv.com/2020/10/27/gouverneur-canton-potsdam-... this is 1x https://www.beckershospitalreview.com/cybersecurity/oregon-hospital-shuts-down-computer-system-after-ransomware-attack-4-notes.html https://www.beckershospitalreview.com/cybersecurity/oregon-h... Reuters says dozens: https://mobile.reuters.com/article/amp/idUSKBN27E0EP https://mobile.reuters.com/article/amp/idUSKBN27E0EP note/edit: nitter is just a shadow platform for twitter that removes tracking and useless javascript bloat. (it seems HN doesn't like it because any submissions pointing to nitter can not be engaged with. but nitter is more user-friendly and privacy respecting than twitter though. no need for a subscription and no errors when visiting links as common on twitter)

ElDji 6y ago

> It's a war crime to attack hospitals Bombing an hospital is a war crime. Letting some malware find it's way into misconfigured Microsoft computers is not.

meowface 6y ago
>Letting some malware find it's way into misconfigured Microsoft computers is not. Especially more recently, ransomware gangs have been deliberately targeting specific organizations. It's not necessarily just a matter of malware spreading rampantly and it happening to land on a hospital system before encrypting all their shares automatically. I'm sure that still occurs, but a lot of them are now picking organizations ahead of time and doing more sophisticated, hand-tailored things to try to get in and encrypt as many files across the network as possible, then explicitly setting and negotiating a hefty ransom based on what they think the organization is able to pay.
JumpCrisscross 6y ago
> Letting some malware find it's way into misconfigured Microsoft computers is not I believe it is. And if a nation were found to be attacking or knowingly permitting the attack of American hospitals in the midst of a pandemic, a physical strike against their military assets (though not personnel) would be proportional. But this has to be made clear ex ante, which it hasn’t been.
- babuskov 6y ago
  > a physical strike against their military assets though not personnel would be proportional. What if that other country has nuclear weapons? Would WWIII start with cyber attacks first?
  - raverbashing 6y ago
    Well, you might ask that of the attacking country yourself But apparently they know that people are hesitant in retaliating As I have said before, paying ransoms and not retaliating is a good way to keep being attacked and asked for even more ransoms

baq 6y ago

these might be separate groups closing positions almost simultaneously after learning that they weren't first to maximize their chance of not getting bulldozed out of compromised systems by coordinated fed and/or private IT security actions in the aftermath of the initial attack.

simias 6y ago

Do all 5 attacks share some common vector? If so it could be that some zero-day or vulnerable target list has been shared within the past few days on some seedy underbelly of the darknet and a few opportunists decided to act on it?