7 ms·

Health-care cyberattack is worst in Canadian history, says expert

64 points by mmphosis 5y ago

tiahura 5y ago
https://www.msn.com/en-us/news/politics/lawmakers-call-on-biden-administration-to-take-further-steps-against-spyware-groups/ar-AAQnfK4?li=BBnbfcQ&ocid=DELLDHP https://www.msn.com/en-us/news/politics/lawmakers-call-on-bi...
tiahura 5y ago
If this is yet another Russian based attack, I would think it’s about time for political pressure to be applied to backbone operators to disconnect from any entity connecting to Russia.
- deleted 5y ago
  [deleted]
- willcipriano 5y ago
  I don't think a couple of cyrillic characters in a payload is sufficient evidence to cut a world power from the internet.
  - tiahura 5y ago
    Of course not. But at some point US leadership has to do a cost benefit analysis of allowing US network operators to maintain connections to Russia, and I’m not sure an objective analysis would be heavily in favor of keeping the tubes flowing.
  - sofixa 5y ago
    Not to mention there's more than one country that uses the Cyrillic alphabet.
intunderflow 5y ago
Anything thus far on how they got in? Was it phishing, zero day, etc?
chasil 5y ago
When you tell your management that they will fall like a house of cards, what else should you do? What else can you do? At least, for my systems, I found "Relax and Recover." As the project says, there is no excuse. http://relax-and-recover.org/ http://relax-and-recover.org/
- TedDoesntTalk 5y ago
  I’m trying to understand the problem this project solves but failing. Can you explain? Is this only for dedicated hardware?
  - chasil 5y ago
    Hundreds of Windows vulnerabilities, ssh holes that invite a semi trailer, and endless denial as corporate peers are taken. For now, we are immune.
    - sterlind 5y ago
      Where are you backing up to? Are you sure ransomware worms won't attack your backup machines too?
  - sterlind 5y ago
    It looks like it clones your drives and makes an .iso boot disk that you can stick in your computer and restore from snapshot. At least, that's what the demo video showed. The isos live on an NFS share, and I think there's a pxe-style bootloader that will fetch the latest iso for your machine from the share. Elegant and simple, but definitely not workable for restoring a large network of ransomwared hospitals. Also, I doubt this would stand up well to ransomware either.. worms target shares and then what will you do? It's turtles all the way down! (Unless you use data diodes or write to tape or something.)
Waterluvian 5y ago
Should we just fund and legalize government backed hacking to basically pentest entities whether they like it or not? What’s CSEC up to?
- usui 5y ago
  I like that idea, or at least contract a private company to do the pentest. That makes it government-sanctioned and pushes the responsibility back onto the people who run the services in question, so we never have to guess about whether it's negligence or ignorance. Are there any wider implications whete security doesn't get taken like we expect it to as a result?
- neom 5y ago
  Yah, for sure. Or maybe unify the provinces with the feds in terms of infrastructure, govcloud primitives with a cross functional cross provincial mandate?
- swiley 5y ago
  That's a pretty good idea actually. I'd get behind that.
- ethbr0 5y ago
  Yes. Although throwing red teams at the problem probably isn't the most efficient use of resources. Better would be constructing a system where government-paid appsec teams are granted access to cloud source control repos for all projects + ability to randomly pentest whatever they desire. If a breach is found (in release candidate stage or prod), the offender's contract is reduced by the prize amount, and that amount goes into the appsec team's budget. The only way to make people care about appsec is to (1) increase the likelihood and frequency of exploits & (2) ensure exploits have direct budgetary impact on the teams developing the software.
  - ludamad 5y ago
    If the exploits occurred due to under-funding doesn't this pose some issues?
woofcat 5y ago
I’m always amazed that these attacks work. Don’t they have off site backups, cloud backups etc. I get it being a disruption, and loss of privacy for citizens. However why are they stopping appointments.
- TedDoesntTalk 5y ago
  What if the ransomware infiltrated 3 months ago but was not activated until now? Restoring a 3-month old backup is not useful if the data changes significantly each day.
  - hulitu 5y ago
    I don't think the bad guys wait 3 months. Time is money. They have no advantage in waiting.
    - scohesc 5y ago
      On the contrary - If you have an incremental backup that goes as far back as say 14 days for example. No separate archived snapshots, etc. If you infiltrate the network and figure out this crucial bit of info - you just wait 14 days while you branch out and infect more PCs, more of the network. Once 14 days goes by, it's guaranteed that any data the victim tries to restore from is corrupted or potentially encrypted with ransomware.
    - PeterisP 5y ago
      I believe that forensics of major attacks does show that usually the bad guys have been in the network for weeks before triggering the ransomware, and it rarely happens on the same day as the initial attack. The expectation is that they will first spend the time and effort to look at your network to find out your backup process, and do/wait as much as is necessary to circumvent, disable or destroy your backups if it can be easily done.
- dreamcompiler 5y ago
  It's largely bad security practice. They always say "We have backups." But in reality, --The backups are not only not offsite; they are online and attackable. --Backups are not done every day on every machine. The machines on which backups are done most rigorously are the gift shop cash registers and the machine that runs the janitorial scheduling spreadsheet. The blood test results pub/sub system was last backed up in 2019. --The restore procedure is never tested. Not rarely, never. Because it would take machines out of service for an hour. Can't have that. --Joe who runs department X drags his feet about upgrading his organization's computers and getting on the corporate backup rotation. And if department X gets taken out, the whole company shuts down. --Bob in the basement is running a research network nobody knows about, and he puts it directly on the Internet so he can run his experiments from home. And of course it contains a bridge to the corporate intranet. It's just a clusterfuck everywhere. Good people busy getting their jobs done who see security procedures as obstacles to work around. The bad guys completely understand this organizational dynamic and they exploit it for profit.
TedDoesntTalk 5y ago
There’s little information in the article on how this is affecting patients and doctors.
- noughtme 5y ago
  According to CBC radio, all elective surgical procedures have been canceled and now everything has to be scheduled by hand on literal paper.
  - hulitu 5y ago
    And there are no lessons learmed. They restore the computers and when the next attack comes they are hit again.
aaron695 5y ago
It doesn't add up that it was ransomware but no one has claimed responsibility. Perhaps it was BlackMatter which has got shutdown this week. Perhaps it wasn't ransomware. Something seems odd.
lindseymysse 5y ago
Have we ever thought about going back to very manual processes as a matter of course? That maybe digital technology is great for immediate and ephemeral communication, but for long term secure communication perhaps pen and paper is best? This means we keep fewer, more important records on paper. This requires rethinking management which, lets be honest, needs to happen anyway. I was having asthma and went to the doctor in Cassis France. To get a ventolin inhaler and a round of prednisone only took two forms -- one at the doctor and the prescription -- and about $70 dollars. I look at the reams of documents Kaiser generates anyway, virtual and real even though I'm "paperless" and I wonder how much of the expense of my health care goes into schlepping all these documents around. There is a book by Derrida called Archive Fever that I read when I was a temp and I always think about the quote in it: "the archivist generates more archive, and so the archive is never closed" Maybe we need that big hack to finally take away the bottle. We don't have to record everything forever, and digital technology is bad at it, anyway.
- sofixa 5y ago
  For medical records? Are you insane? Every small little detail recorded by your doctor can be crucial to determine a timeline and help with treatment later. Or just to know your allergies and regular vital signs in case of a serious issue that requires emergency care, when you might not be able to give the information ( e.g. car crash, and you're allergic to penicillin or something in the usually used anesthetic or whatever). It can also be useful when you can just call a doctor to get a prescription, because they have your full medical records and know enough about you quickly. Paper is extremely impractical.
  - lindseymysse 5y ago
    Why do I keep on having to give my allergies to the doctor every time I'm there? My timeline is that it is too expensive and full of forms for me to go talk to my doctor. And I have to keep answering the same questions to my doctor about my allergies over and over and over anyway. I think all this paper work helps a parasitic managerial class, but I've never seen it help me.
ChrisArchitect 5y ago
"worst ever" seems overblown from random 'security expert' but definitely a shock to smaller province areas like Newfoundland to be knocked offline for so many days. Seems like will forever be problems like this when all it takes is a random email link click and whole networks of computers linked together can be tied up. They had backups but still missing weekend/recent days - typical. Question is, did they pay the ransom?

64 points by mmphosis 5y ago

https://www.msn.com/en-us/news/politics/lawmakers-call-on-biden-administration-to-take-further-steps-against-spyware-groups/ar-AAQnfK4?li=BBnbfcQ&ocid=DELLDHP https://www.msn.com/en-us/news/politics/lawmakers-call-on-bi...

tiahura 5y ago

If this is yet another Russian based attack, I would think it’s about time for political pressure to be applied to backbone operators to disconnect from any entity connecting to Russia.

deleted 5y ago
[deleted]
willcipriano 5y ago
I don't think a couple of cyrillic characters in a payload is sufficient evidence to cut a world power from the internet.
- tiahura 5y ago
  Of course not. But at some point US leadership has to do a cost benefit analysis of allowing US network operators to maintain connections to Russia, and I’m not sure an objective analysis would be heavily in favor of keeping the tubes flowing.
- sofixa 5y ago
  Not to mention there's more than one country that uses the Cyrillic alphabet.

intunderflow 5y ago

Anything thus far on how they got in? Was it phishing, zero day, etc?

chasil 5y ago

When you tell your management that they will fall like a house of cards, what else should you do? What else can you do? At least, for my systems, I found "Relax and Recover." As the project says, there is no excuse. http://relax-and-recover.org/ http://relax-and-recover.org/

TedDoesntTalk 5y ago
I’m trying to understand the problem this project solves but failing. Can you explain? Is this only for dedicated hardware?
- chasil 5y ago
  Hundreds of Windows vulnerabilities, ssh holes that invite a semi trailer, and endless denial as corporate peers are taken. For now, we are immune.
  - sterlind 5y ago
    Where are you backing up to? Are you sure ransomware worms won't attack your backup machines too?
- sterlind 5y ago
  It looks like it clones your drives and makes an .iso boot disk that you can stick in your computer and restore from snapshot. At least, that's what the demo video showed. The isos live on an NFS share, and I think there's a pxe-style bootloader that will fetch the latest iso for your machine from the share. Elegant and simple, but definitely not workable for restoring a large network of ransomwared hospitals. Also, I doubt this would stand up well to ransomware either.. worms target shares and then what will you do? It's turtles all the way down! (Unless you use data diodes or write to tape or something.)

Waterluvian 5y ago

Should we just fund and legalize government backed hacking to basically pentest entities whether they like it or not? What’s CSEC up to?

usui 5y ago
I like that idea, or at least contract a private company to do the pentest. That makes it government-sanctioned and pushes the responsibility back onto the people who run the services in question, so we never have to guess about whether it's negligence or ignorance. Are there any wider implications whete security doesn't get taken like we expect it to as a result?
neom 5y ago
Yah, for sure. Or maybe unify the provinces with the feds in terms of infrastructure, govcloud primitives with a cross functional cross provincial mandate?
swiley 5y ago
That's a pretty good idea actually. I'd get behind that.
ethbr0 5y ago
Yes. Although throwing red teams at the problem probably isn't the most efficient use of resources. Better would be constructing a system where government-paid appsec teams are granted access to cloud source control repos for all projects + ability to randomly pentest whatever they desire. If a breach is found (in release candidate stage or prod), the offender's contract is reduced by the prize amount, and that amount goes into the appsec team's budget. The only way to make people care about appsec is to (1) increase the likelihood and frequency of exploits & (2) ensure exploits have direct budgetary impact on the teams developing the software.
- ludamad 5y ago
  If the exploits occurred due to under-funding doesn't this pose some issues?

woofcat 5y ago

I’m always amazed that these attacks work. Don’t they have off site backups, cloud backups etc. I get it being a disruption, and loss of privacy for citizens. However why are they stopping appointments.

TedDoesntTalk 5y ago
What if the ransomware infiltrated 3 months ago but was not activated until now? Restoring a 3-month old backup is not useful if the data changes significantly each day.
- hulitu 5y ago
  I don't think the bad guys wait 3 months. Time is money. They have no advantage in waiting.
  - scohesc 5y ago
    On the contrary - If you have an incremental backup that goes as far back as say 14 days for example. No separate archived snapshots, etc. If you infiltrate the network and figure out this crucial bit of info - you just wait 14 days while you branch out and infect more PCs, more of the network. Once 14 days goes by, it's guaranteed that any data the victim tries to restore from is corrupted or potentially encrypted with ransomware.
  - PeterisP 5y ago
    I believe that forensics of major attacks does show that usually the bad guys have been in the network for weeks before triggering the ransomware, and it rarely happens on the same day as the initial attack. The expectation is that they will first spend the time and effort to look at your network to find out your backup process, and do/wait as much as is necessary to circumvent, disable or destroy your backups if it can be easily done.
dreamcompiler 5y ago
It's largely bad security practice. They always say "We have backups." But in reality, --The backups are not only not offsite; they are online and attackable. --Backups are not done every day on every machine. The machines on which backups are done most rigorously are the gift shop cash registers and the machine that runs the janitorial scheduling spreadsheet. The blood test results pub/sub system was last backed up in 2019. --The restore procedure is never tested. Not rarely, never. Because it would take machines out of service for an hour. Can't have that. --Joe who runs department X drags his feet about upgrading his organization's computers and getting on the corporate backup rotation. And if department X gets taken out, the whole company shuts down. --Bob in the basement is running a research network nobody knows about, and he puts it directly on the Internet so he can run his experiments from home. And of course it contains a bridge to the corporate intranet. It's just a clusterfuck everywhere. Good people busy getting their jobs done who see security procedures as obstacles to work around. The bad guys completely understand this organizational dynamic and they exploit it for profit.

TedDoesntTalk 5y ago

There’s little information in the article on how this is affecting patients and doctors.

noughtme 5y ago
According to CBC radio, all elective surgical procedures have been canceled and now everything has to be scheduled by hand on literal paper.
- hulitu 5y ago
  And there are no lessons learmed. They restore the computers and when the next attack comes they are hit again.

aaron695 5y ago

It doesn't add up that it was ransomware but no one has claimed responsibility. Perhaps it was BlackMatter which has got shutdown this week. Perhaps it wasn't ransomware. Something seems odd.

lindseymysse 5y ago

Have we ever thought about going back to very manual processes as a matter of course? That maybe digital technology is great for immediate and ephemeral communication, but for long term secure communication perhaps pen and paper is best? This means we keep fewer, more important records on paper. This requires rethinking management which, lets be honest, needs to happen anyway. I was having asthma and went to the doctor in Cassis France. To get a ventolin inhaler and a round of prednisone only took two forms -- one at the doctor and the prescription -- and about $70 dollars. I look at the reams of documents Kaiser generates anyway, virtual and real even though I'm "paperless" and I wonder how much of the expense of my health care goes into schlepping all these documents around. There is a book by Derrida called Archive Fever that I read when I was a temp and I always think about the quote in it: "the archivist generates more archive, and so the archive is never closed" Maybe we need that big hack to finally take away the bottle. We don't have to record everything forever, and digital technology is bad at it, anyway.

sofixa 5y ago
For medical records? Are you insane? Every small little detail recorded by your doctor can be crucial to determine a timeline and help with treatment later. Or just to know your allergies and regular vital signs in case of a serious issue that requires emergency care, when you might not be able to give the information ( e.g. car crash, and you're allergic to penicillin or something in the usually used anesthetic or whatever). It can also be useful when you can just call a doctor to get a prescription, because they have your full medical records and know enough about you quickly. Paper is extremely impractical.
- lindseymysse 5y ago
  Why do I keep on having to give my allergies to the doctor every time I'm there? My timeline is that it is too expensive and full of forms for me to go talk to my doctor. And I have to keep answering the same questions to my doctor about my allergies over and over and over anyway. I think all this paper work helps a parasitic managerial class, but I've never seen it help me.

ChrisArchitect 5y ago

"worst ever" seems overblown from random 'security expert' but definitely a shock to smaller province areas like Newfoundland to be knocked offline for so many days. Seems like will forever be problems like this when all it takes is a random email link click and whole networks of computers linked together can be tied up. They had backups but still missing weekend/recent days - typical. Question is, did they pay the ransom?