4 ms·

You can do real damage even without this level of sophistication or physical access: my state's largest hospital system had a month-long computer outage because

You can do real damage even without this level of sophistication or physical access: my state's largest hospital system had a month-long computer outage because of a ransomware attack. It was traced back to an employee opening a malicious email attachment on a hospital-owned laptop while they were on vacation. It brought down the medical records systems and cost the hospital between $40 million and $50 million (mostly in lost revenue because they basically had to cancel non-emergency visits and procedures across multiple locations for a month). Quite an expensive email! https://vtdigger.org/2021/07/21/malware-on-employees-company-computer-led-to-cyber-attack-on-uvm-medical-center/ https://vtdigger.org/2021/07/21/malware-on-employees-company...

robocat 5y ago
> It was traced back to an employee opening a malicious email attachment on a hospital-owned laptop while they were on vacation. That is such a lame “cause”. What was the actual underlying cause - i.e. what was it that allowed a malicious email to pwn the laptop?
- deleted 5y ago
  [deleted]
- dmurray 5y ago
  Agreed - I don't like the way we've shifted responsibility to the hapless employee away from whoever wrote, purchased and approved the vulnerable piece of software that actually was exploited here.
- raxxorrax 5y ago
  This is most often the cause for ransomware and it mostly is just an executable. Exploits in PDF/Word/image viewer are quite rare.
  - robocat 5y ago
    How many employees need to be able to run executables from their email? If they somehow need to be able to do that, I presume there is normally some form of sandboxing?
mleonhard 5y ago
I disagree. The expensive choice was deciding not to hire skilled security engineers and not giving them political capital to do their jobs. The root cause of the attack is dysfunction in the organization.
- raxxorrax 5y ago
  Many companies actually have guys like this, but they work in internal IT and are chronically understaffed. Security isn't on the mind of people when they complain about a misbehaving printer.
raxxorrax 5y ago
Fake mail with infected attachment is still the usual way for ransomware if it isn't an inside job or a weakly protected service account from another compromised partner. Best defense is working backups with regular snapshots. Patient data would still be exposed and I think the only way to mitigate this is collecting the lowest amount of data possible. Ideally patient data is encrypted in a way that the patient himself would need to provide the password to access the information as just-in-time decryption.

robocat 5y ago

> It was traced back to an employee opening a malicious email attachment on a hospital-owned laptop while they were on vacation. That is such a lame “cause”. What was the actual underlying cause - i.e. what was it that allowed a malicious email to pwn the laptop?

deleted 5y ago
[deleted]
dmurray 5y ago
Agreed - I don't like the way we've shifted responsibility to the hapless employee away from whoever wrote, purchased and approved the vulnerable piece of software that actually was exploited here.
raxxorrax 5y ago
This is most often the cause for ransomware and it mostly is just an executable. Exploits in PDF/Word/image viewer are quite rare.
- robocat 5y ago
  How many employees need to be able to run executables from their email? If they somehow need to be able to do that, I presume there is normally some form of sandboxing?

mleonhard 5y ago

I disagree. The expensive choice was deciding not to hire skilled security engineers and not giving them political capital to do their jobs. The root cause of the attack is dysfunction in the organization.

raxxorrax 5y ago
Many companies actually have guys like this, but they work in internal IT and are chronically understaffed. Security isn't on the mind of people when they complain about a misbehaving printer.

raxxorrax 5y ago

Fake mail with infected attachment is still the usual way for ransomware if it isn't an inside job or a weakly protected service account from another compromised partner. Best defense is working backups with regular snapshots. Patient data would still be exposed and I think the only way to mitigate this is collecting the lowest amount of data possible. Ideally patient data is encrypted in a way that the patient himself would need to provide the password to access the information as just-in-time decryption.