7 ms·

Illinois Hospital First to Shut Down After Ransomware Attack

54 points by xoa 3y ago

lockhouse 3y ago
Thanks cryptocurrency! What a useful technology. Wasting electricity, enabling wild financial speculation, and best of all shutting down critical public institutions like hospitals by enabling rampant cyber crime. Is there anything this miracle technology can’t do?
- scbrg 3y ago
  Basic transactions for regular purchases :-)
- fluoridation 3y ago
  Not to defend crypto, but I can replace the word "cryptocurrency" with, say, "computers" and your sentence is equally true. It's pointless to blame technology for how it's used. Why not blame the people who run randomware operations, or the hospital administrators who don't backup their data? If a ransomware attack is enough to cause the hospital to shut down, that means they were a bad glitch away for shutting down, anyway.
  - mjburgess 3y ago
    Computers have multiple use cases. So far, crypto only has fraud.
    - kayodelycaon 3y ago
      Crypto does have a valid case for paying people for work across country boundaries when financial systems to do this are unreliable or non-existent. (Or has prohibitive fees.) In some cases, doesn't event violate any laws! :)
      - lockhouse 3y ago
        The problem is that in practice a significant amount of this “work” is criminal activity with very real victims.
        kayodelycaon 3y ago
        Which would most likely be violating a law in the process. :)
      - mjburgess 3y ago
        Who are these people who have a bank card to use with a crypto exchange, yet do not have access to international banking? Oh, yes! Of course. Criminals.
        Turing_Machine 3y ago
        Or honest people who live in countries that have a lot of criminals and/or have a corrupt government. Life is extremely tough for legitimate businesses in countries such as Nigeria, due to the government's incompetence (some say active collusion) in dealing with fraud. Banks generally won't touch them, and even if they do, transactions are often delayed for weeks.
        mjburgess 3y ago
        Right... so how do they acquire cryptocurrency?
        Al0neStar 3y ago
        I enjoy your takes on AI/ML but as someone who lives in Iran if not for crypto i'd be homeless.
        mjburgess 3y ago
        Could you explain how you obtain crypto in iran? I guess you have a bank account, but your bank is under sanctions? How does that help you? I am interested in there actually being a use-case; but i've never actually encountered one which survives contact with reality.
    - justrealist 3y ago
      I mean it's actively used in countries with high inflation and bad currency management. Just because it's not used in your Wal-Mart doesn't mean it doesn't exist.
  - kayodelycaon 3y ago
    > If a ransomware attack is enough to cause the hospital to shut down, that means they were a bad glitch away for shutting down, anyway. I'm going to disagree here. A bad glitch isn't likely to encrypted entire systems and prevent any recovery of data. While a bad glitch could cause complete data loss, ransomware attacks are far more common.
    - fluoridation 3y ago
      You're not disagreeing with me. You've agreed that a glitch that leads to complete data loss is possible. If you still don't backup then you're gambling the operability of the hospital that such a glitch will never happen and that a ransomware attack will never happen.
      - xoa 3y ago
        >You've agreed that a glitch that leads to complete data loss is possible. Complete data loss of one instance (whether "instance" is a single computer or single site as in the case of a fire/flood). But random glitches, mistakes, or events without any intention behind them are very different from hostile actors. They don't work to spread everywhere. They don't actively work to hide themselves. Random glitches, mistakes, or events don't try to install rootkits and persist themselves. >If you still don't backup Ransomware operators aren't stupid either. We've long since passed the point where "just have a backup" naively is enough, ransomware outfits will actively go after backups if it can, trying to move laterally throughout the victim organization, as well as do things like keep a key around long after everything is encrypted so it can stay transparent for awhile. The idea being that even if backups it can't touch are happening, by the time the trigger is pulled and all keys deleted weeks/months of data will still have successfully locked up with the backup systems dutifully backing it up. For many people, individuals even not just businesses, "we can restore but everything for the past 1-2 months will be lost" represents major expense/pain. Particularly in a medical setting. It's not that there aren't solutions to that too, and yes I'd hope a big organization would cover it, but afaik it's not as easy as I wish it was. I don't think the challenge of malicious for-profit actors should be trivialized in the way you seem to have been doing. And the value function of computers vs crypto is astronomical, I don't think it's reasonable to equate the two as you originally did either.
  - ceejayoz 3y ago
    > If a ransomware attack is enough to cause the hospital to shut down, that means they were a bad glitch away for shutting down, anyway. Someone competent intentionally doing as much damage as they possibly can is likely to exceed the damage from even the worst accidental fuckup.
    - nradov 3y ago
      Over a sufficiently long time scale, every organization will eventually have a disgruntled employee who intentionally tries to sabotage their systems out of spite or revenge or even as part of a criminal embezzlement scheme. Competent IT managers need to recognize and guard against that threat. Smaller hospitals may not have the scale or financial resources to hire such people so the only practical solution is to outsource their entire IT infrastructure to a larger vendor that can bring in the necessary competencies. It's sad that the situation has reached this point but we have to face the reality that IT security threats will only continue getting worse.
  - lockhouse 3y ago
    Hospitals are particularly vulnerable to ransom ware. I don’t think you grasp the hodgepodge of obsolete computer systems that are attached to computer networks to run lab equipment, MRI machines, process pharmacy prescriptions, and manage a patient’s chart. Keeping all of this secure and properly backed up is pretty much impossible. Seriously, I’ve seen machines in use running everything from ancient versions of Sun Solaris to Windows 95.
    - fluoridation 3y ago
      First, it's not impossible, it's just difficult. And however difficult it is, if those systems are necessary to maintain operation, then they're mission-critical and it's someone's job to make sure that they continue to operate. Second, a ransomware attack isn't going to attack stuff like medical equipment, which wouldn't hold any important files anyway. It's going to attack workstations and servers likely running some version of Windows. If your IT staff can't keep that stuff backed up then you don't have IT staff.
      - lockhouse 3y ago
        It’s impossible to patch systems that are out of support and the security patch literally doesn’t exist. In some situations the original vendor themselves don’t even exist anymore. Also regarding the servers and workstations, recovering from ransom ware isn’t as simple as just restoring from a backup. You’re still looking at days of effort restoring backups, reimaging workstations, and validating that everything works.
        fluoridation 3y ago
        A vulnerable system that can't be patched shouldn't be in a position where that vulnerability can be exploited, if it's mission-critical. If it's mission-critical, it's vulnerable and can't be patched, and has to be exposed, then it's not fit for purpose and has to be replaced, or have a replacement (i.e. a backup) on stand-by. Yes, restoring a backup requires effort. But surely less effort than losing the data altogether.
    - 3y ago
  - pevey 3y ago
    The “glitch” in most ransomeware and AP fraud attacks is an employee clicking on something or believing something they shouldn’t have. LinkedIn facilitates this, because it makes it easy to understand the org chart of a company and target newer employees with urgent, personalized requests from the “CEO.” One person at a place where I recently worked actually fell for it and was at a store buying a SECOND round of gift cards with his company card before he finally got a twinge and pinged someone to see if—perhaps—this might not be legit. Training can only do so much. People have no attention span these days, and all warnings go in one ear and out the other, even in they are well-intentioned people (as this employee was).
    - njovin 3y ago
      At this point I'm baffled that the entire world doesn't know that if somebody is asking you to buy them gift cards, you're being ripped off. Do we need to legislate having big "FRAUD WARNING" signs on every gift card display, just like we need "do not use in bathtub" labels on hair dryers?
      - toast0 3y ago
        > Do we need to legislate having big "FRAUD WARNING" signs on every gift card display, just like we need "do not use in bathtub" labels on hair dryers? The market has provided these without legislation, at least near me.
      - RajT88 3y ago
        Tales from infosec... Also the number of highly compensated tech workers who pirate software on the job. Guys, do not pirate shit at work! Also: Companies, buy your employees software! It is super hard to talk an employer into spending money on software for productivity.
  - deleted 3y ago
    [deleted]
  - anaganisk 3y ago
    I generally disagree with your popular comparison with, There is building a knife, and there is building a knife that is optimized to cut human flesh, with supportive ergonomics.
  - et-al 3y ago
    If cryptocurrency didn't exist, how would you ask to be paid if you were the one holding a hospital ransom?
- DoItToMe81 3y ago
  I'm sorry, but if you think cryptocurrency invented crime, I have no idea what to say. Ransomware existed welllll before widespread adoption of cryptocurrency, and some of the big ones still use the old infrastructure. Like Moneypak. Even Cryptolocker was mostly paid through vouchers.
- zapdrive 3y ago
  Thank you cars for killing 1.35 million people every year!
- dang 3y ago
  Can you please not post generic flamewar comments to HN? Regardless of who's right or wrong, the millionth variation of this snarky dismissal is exactly what we're not going for here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
freitzkriesler2 3y ago
If you look at the details of the post, it wasn't the hospital but the billing department that was shut down. Rest of the hospital was fine. So in theory the hospital could have operated but they couldnt bill insurers or government entities. I'm looking forward to the day that AI replaces the meatsacks in these departments for how awful and poorly run they typically are.
- AndrewKemendo 3y ago
  >it wasn't the hospital but the billing department that was shut down. Rest of the hospital was fine. So in theory the hospital could have operated but they couldnt bill insurers or government entities. Distinction without difference
  - Turing_Machine 3y ago
    > Distinction without difference Not at all. Not being able to send bills means potential financial trouble days/weeks/months down the line. Not being able to perform surgeries means that people will die. Today.
    - scbrg 3y ago
      TFA: A ransomware attack hit SMP Health in 2021. The attack halted the hospital’s ability to submit claims to insurers, Medicare or Medicaid for months, sending it into a financial spiral, Burt said. So, they struggled to handle this for two years before they finally shut down.
    - AndrewKemendo 3y ago
      Well Today they do zero surgeries because their financial trouble shut them down So again, distinction without difference
      - Turing_Machine 3y ago
        > Well Today they do zero surgeries because their financial trouble shut them down You are ignoring all the lives they saved in the intervening two years. > So again, distinction without difference Nonsense.
trompetenaccoun 3y ago
It's interesting that most do not seem to be much worried about the insane vulnerabilities and general lack of security in a lot of our critical infrastructure. You'd think people should be happy about ransomware attacks exposing how weak it all is, because that's concerning and needs to be worked on. These guys are financially incentivized to pen test even companies and institutions who don't take security seriously. Which includes a lot of public ones too. What a Russian ransomware firm can do, sophisticated state actors manage with ease.
some_random 3y ago
Damn you all are all in on victim blaming. Don't get me wrong, they clearly should have invested more in security, backups, etc, but a fucking hospital is closing come on.
xoa 3y ago
FWIW, I don't work in a hospital, but I have relatively recently taken on as a client a small rural practice (8-15 employee range) and it's helped further open my eyes and give me more perspective. Big places should at least have dependably competent teams in principle, even if they have tons of expensive legacy, lots more strain/demand, and more perverse incentives and so on. But I think these challenges go up and down the stack in the medical world, and I don't think the available options are as friendly or as good as they should be. This place still only has quite limited internet options (though at long last fiber may come in the next few years), having everything be cloud-based isn't realistic on an unreliable 10 Mbps DSL connection. They had no "IT", just random locals (like us in fairness), which can be decent but also can be... less optimal (one set of intermittent issues they'd been having for years I traced to the previous guys who installed their ethernet not bothering to actually qualify it). And what the doctor had been able to figure out himself. It's a bunch of practitioners and then one front desk person who does all the billing and such and that's it. There was a mixture of windows 7/vista and Mac OS 10.10/10.11. But also a $30k panoramic Xray machine and a bunch of other smaller but still expensive systems that obviously they needed to have work and can't just "oh yeah just buy a new one!" This is a critical local resource in an area where there are towns with a total population of as little as 65. It was doable on a budget with some work to put together a vastly improved setup for them with data going to a ZFS system with constant snapshotting and then that too getting further backups in a few ways to off site, but it took way more technical knowledge/metaknowledge then it should have. If I think about all the various components, this could and should be a lot easier. And even with what we went with I still can't say I'm truly satisfied. Like, why don't TrueNAS or everyone else in the space long since have watch dogs for signs of ransomware? Encrypted files are readily discernible from unencrypted files by computers, so why isn't there just a GUI option to "alert on threshold of change in encrypted files|filesystem entropy"? Or even "radical deviation in snapshot size"? The key thing about ransomware is deviation from norms, by definition it must suddenly make changes to a massive set of files in a way totally different from typical patterns. If all of a sudden a NAS/SAN observes any hints of that why in 2023 isn't that universally a red alert? Why is Webauthn not everywhere for admin pages? Hiding everything behind an internal VPN is good practice, but further layers would be good too. Etc etc, no doubt endless stuff I'm not even thinking of or don't know myself. It's a huge societal drain to lose medical services over such events and fantastically inefficient. The cost to ensure everyone has at least some final fallback WORM recovery or the like, even if a month old, has to be a tiny fraction of the damage that even a single hospital shutdown (or slowdown even) causes. Somehow it's not getting priced in and responded to in a uniform manner. I really feel like I should be long since 100% out of a job on this sort of thing because there should be easy options for non-technical types, and that government should have universal help and guides for all medical providers from sole practitioner on up nationwide to get into a known good state.
efitz 3y ago
A Modest Proposal Sometimes investigators know the actual actors involved with such attacks. 15 years ago I worked for Microsoft and went to a security presentation where the team had done some brilliant work and collaborated with law enforcement over months and had specifically identified an individual associated with a cyber attack. The individual was out of reach because of weak computer crime laws in the attacker’s country and poor diplomatic relations. The FBI was co-presenting and touting the staggering amounts of manpower and funds dedicated to this investigation. I leaned over to a friend of mine and said something to the effect of “with the state of organized crime in that country we could spend a few tens of thousands of dollars for a permanent solution”. I always think back to that comment. Attribution in computer crime is hard, but attackers get away with impunity because they either hide behind anonymity or behind jurisdictional issues. Should we just let that go or use more pragmatic solutions?
- kramerger 3y ago
  [flagged]
  - et-al 3y ago
    They did start with "A Modest Proposal".... But folks are probably doing this because of terrible job prospects in their country. If you pay their government to off this one person, you'd probably need to off five more next week.
  - nradov 3y ago
    China actually does the same thing to us. Organ harvesting sensationalism aside, they do operate illegal "police stations" inside the US. https://www.justice.gov/opa/pr/two-arrested-operating-illegal-overseas-police-station-chinese-government https://www.justice.gov/opa/pr/two-arrested-operating-illega... https://thehill.com/opinion/national-security/4008817-crack-down-on-illegal-chinese-police-stations-in-the-u-s/ https://thehill.com/opinion/national-security/4008817-crack-...
  - Jiro 3y ago
    >Now, what if they do the same thing to you? If they're going to do the same thing to us, they're going to do it to us anyway, regardless of whether we do it to them first or not.
908B64B197 3y ago
It's interesting to see how IT is perceived as a cost-center and not essential to the business in healthcare; yet everything crumbles and collapses when there's an IT outage. These organizations might not be culturally accustomed to have IT at the core of their business/mission, but it very much is. They might not value engineering skills and people in IT, but they have evolved an absolute dependency on those over the years. The issue here is cultural, not technical. These ransomware attacks, breaches and outages are completely self-imposed. They can end anytime as soon as the hospital wants it. All they have to do is value and acknowledge IT as a fundamental pillar of their organization, comp it appropriately and make sure to run on hardware that's patched and safe to use. Really no different than washing hands before a procedure to stop infections. Else the cycle will endlessly repeat itself.

54 points by xoa 3y ago

Thanks cryptocurrency! What a useful technology. Wasting electricity, enabling wild financial speculation, and best of all shutting down critical public institutions like hospitals by enabling rampant cyber crime. Is there anything this miracle technology can’t do?

scbrg 3y ago
Basic transactions for regular purchases :-)
fluoridation 3y ago
Not to defend crypto, but I can replace the word "cryptocurrency" with, say, "computers" and your sentence is equally true. It's pointless to blame technology for how it's used. Why not blame the people who run randomware operations, or the hospital administrators who don't backup their data? If a ransomware attack is enough to cause the hospital to shut down, that means they were a bad glitch away for shutting down, anyway.
- mjburgess 3y ago
  Computers have multiple use cases. So far, crypto only has fraud.
  - kayodelycaon 3y ago
    Crypto does have a valid case for paying people for work across country boundaries when financial systems to do this are unreliable or non-existent. (Or has prohibitive fees.) In some cases, doesn't event violate any laws! :)
    - lockhouse 3y ago
      The problem is that in practice a significant amount of this “work” is criminal activity with very real victims.
      - kayodelycaon 3y ago
        Which would most likely be violating a law in the process. :)
    - mjburgess 3y ago
      Who are these people who have a bank card to use with a crypto exchange, yet do not have access to international banking? Oh, yes! Of course. Criminals.
      - Turing_Machine 3y ago
        Or honest people who live in countries that have a lot of criminals and/or have a corrupt government. Life is extremely tough for legitimate businesses in countries such as Nigeria, due to the government's incompetence (some say active collusion) in dealing with fraud. Banks generally won't touch them, and even if they do, transactions are often delayed for weeks.
        mjburgess 3y ago
        Right... so how do they acquire cryptocurrency?
        Al0neStar 3y ago
        I enjoy your takes on AI/ML but as someone who lives in Iran if not for crypto i'd be homeless.
        mjburgess 3y ago
        Could you explain how you obtain crypto in iran? I guess you have a bank account, but your bank is under sanctions? How does that help you? I am interested in there actually being a use-case; but i've never actually encountered one which survives contact with reality.
  - justrealist 3y ago
    I mean it's actively used in countries with high inflation and bad currency management. Just because it's not used in your Wal-Mart doesn't mean it doesn't exist.
- kayodelycaon 3y ago
  > If a ransomware attack is enough to cause the hospital to shut down, that means they were a bad glitch away for shutting down, anyway. I'm going to disagree here. A bad glitch isn't likely to encrypted entire systems and prevent any recovery of data. While a bad glitch could cause complete data loss, ransomware attacks are far more common.
  - fluoridation 3y ago
    You're not disagreeing with me. You've agreed that a glitch that leads to complete data loss is possible. If you still don't backup then you're gambling the operability of the hospital that such a glitch will never happen and that a ransomware attack will never happen.
    - xoa 3y ago
      >You've agreed that a glitch that leads to complete data loss is possible. Complete data loss of one instance (whether "instance" is a single computer or single site as in the case of a fire/flood). But random glitches, mistakes, or events without any intention behind them are very different from hostile actors. They don't work to spread everywhere. They don't actively work to hide themselves. Random glitches, mistakes, or events don't try to install rootkits and persist themselves. >If you still don't backup Ransomware operators aren't stupid either. We've long since passed the point where "just have a backup" naively is enough, ransomware outfits will actively go after backups if it can, trying to move laterally throughout the victim organization, as well as do things like keep a key around long after everything is encrypted so it can stay transparent for awhile. The idea being that even if backups it can't touch are happening, by the time the trigger is pulled and all keys deleted weeks/months of data will still have successfully locked up with the backup systems dutifully backing it up. For many people, individuals even not just businesses, "we can restore but everything for the past 1-2 months will be lost" represents major expense/pain. Particularly in a medical setting. It's not that there aren't solutions to that too, and yes I'd hope a big organization would cover it, but afaik it's not as easy as I wish it was. I don't think the challenge of malicious for-profit actors should be trivialized in the way you seem to have been doing. And the value function of computers vs crypto is astronomical, I don't think it's reasonable to equate the two as you originally did either.
- ceejayoz 3y ago
  > If a ransomware attack is enough to cause the hospital to shut down, that means they were a bad glitch away for shutting down, anyway. Someone competent intentionally doing as much damage as they possibly can is likely to exceed the damage from even the worst accidental fuckup.
  - nradov 3y ago
    Over a sufficiently long time scale, every organization will eventually have a disgruntled employee who intentionally tries to sabotage their systems out of spite or revenge or even as part of a criminal embezzlement scheme. Competent IT managers need to recognize and guard against that threat. Smaller hospitals may not have the scale or financial resources to hire such people so the only practical solution is to outsource their entire IT infrastructure to a larger vendor that can bring in the necessary competencies. It's sad that the situation has reached this point but we have to face the reality that IT security threats will only continue getting worse.
- lockhouse 3y ago
  Hospitals are particularly vulnerable to ransom ware. I don’t think you grasp the hodgepodge of obsolete computer systems that are attached to computer networks to run lab equipment, MRI machines, process pharmacy prescriptions, and manage a patient’s chart. Keeping all of this secure and properly backed up is pretty much impossible. Seriously, I’ve seen machines in use running everything from ancient versions of Sun Solaris to Windows 95.
  - fluoridation 3y ago
    First, it's not impossible, it's just difficult. And however difficult it is, if those systems are necessary to maintain operation, then they're mission-critical and it's someone's job to make sure that they continue to operate. Second, a ransomware attack isn't going to attack stuff like medical equipment, which wouldn't hold any important files anyway. It's going to attack workstations and servers likely running some version of Windows. If your IT staff can't keep that stuff backed up then you don't have IT staff.
    - lockhouse 3y ago
      It’s impossible to patch systems that are out of support and the security patch literally doesn’t exist. In some situations the original vendor themselves don’t even exist anymore. Also regarding the servers and workstations, recovering from ransom ware isn’t as simple as just restoring from a backup. You’re still looking at days of effort restoring backups, reimaging workstations, and validating that everything works.
      - fluoridation 3y ago
        A vulnerable system that can't be patched shouldn't be in a position where that vulnerability can be exploited, if it's mission-critical. If it's mission-critical, it's vulnerable and can't be patched, and has to be exposed, then it's not fit for purpose and has to be replaced, or have a replacement (i.e. a backup) on stand-by. Yes, restoring a backup requires effort. But surely less effort than losing the data altogether.
  - 3y ago
- pevey 3y ago
  The “glitch” in most ransomeware and AP fraud attacks is an employee clicking on something or believing something they shouldn’t have. LinkedIn facilitates this, because it makes it easy to understand the org chart of a company and target newer employees with urgent, personalized requests from the “CEO.” One person at a place where I recently worked actually fell for it and was at a store buying a SECOND round of gift cards with his company card before he finally got a twinge and pinged someone to see if—perhaps—this might not be legit. Training can only do so much. People have no attention span these days, and all warnings go in one ear and out the other, even in they are well-intentioned people (as this employee was).
  - njovin 3y ago
    At this point I'm baffled that the entire world doesn't know that if somebody is asking you to buy them gift cards, you're being ripped off. Do we need to legislate having big "FRAUD WARNING" signs on every gift card display, just like we need "do not use in bathtub" labels on hair dryers?
    - toast0 3y ago
      > Do we need to legislate having big "FRAUD WARNING" signs on every gift card display, just like we need "do not use in bathtub" labels on hair dryers? The market has provided these without legislation, at least near me.
    - RajT88 3y ago
      Tales from infosec... Also the number of highly compensated tech workers who pirate software on the job. Guys, do not pirate shit at work! Also: Companies, buy your employees software! It is super hard to talk an employer into spending money on software for productivity.
- deleted 3y ago
  [deleted]
- anaganisk 3y ago
  I generally disagree with your popular comparison with, There is building a knife, and there is building a knife that is optimized to cut human flesh, with supportive ergonomics.
- et-al 3y ago
  If cryptocurrency didn't exist, how would you ask to be paid if you were the one holding a hospital ransom?
DoItToMe81 3y ago
I'm sorry, but if you think cryptocurrency invented crime, I have no idea what to say. Ransomware existed welllll before widespread adoption of cryptocurrency, and some of the big ones still use the old infrastructure. Like Moneypak. Even Cryptolocker was mostly paid through vouchers.
zapdrive 3y ago
Thank you cars for killing 1.35 million people every year!
dang 3y ago
Can you please not post generic flamewar comments to HN? Regardless of who's right or wrong, the millionth variation of this snarky dismissal is exactly what we're not going for here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

freitzkriesler2 3y ago

If you look at the details of the post, it wasn't the hospital but the billing department that was shut down. Rest of the hospital was fine. So in theory the hospital could have operated but they couldnt bill insurers or government entities. I'm looking forward to the day that AI replaces the meatsacks in these departments for how awful and poorly run they typically are.

AndrewKemendo 3y ago
>it wasn't the hospital but the billing department that was shut down. Rest of the hospital was fine. So in theory the hospital could have operated but they couldnt bill insurers or government entities. Distinction without difference
- Turing_Machine 3y ago
  > Distinction without difference Not at all. Not being able to send bills means potential financial trouble days/weeks/months down the line. Not being able to perform surgeries means that people will die. Today.
  - scbrg 3y ago
    TFA: A ransomware attack hit SMP Health in 2021. The attack halted the hospital’s ability to submit claims to insurers, Medicare or Medicaid for months, sending it into a financial spiral, Burt said. So, they struggled to handle this for two years before they finally shut down.
  - AndrewKemendo 3y ago
    Well Today they do zero surgeries because their financial trouble shut them down So again, distinction without difference
    - Turing_Machine 3y ago
      > Well Today they do zero surgeries because their financial trouble shut them down You are ignoring all the lives they saved in the intervening two years. > So again, distinction without difference Nonsense.

trompetenaccoun 3y ago

It's interesting that most do not seem to be much worried about the insane vulnerabilities and general lack of security in a lot of our critical infrastructure. You'd think people should be happy about ransomware attacks exposing how weak it all is, because that's concerning and needs to be worked on. These guys are financially incentivized to pen test even companies and institutions who don't take security seriously. Which includes a lot of public ones too. What a Russian ransomware firm can do, sophisticated state actors manage with ease.

some_random 3y ago

Damn you all are all in on victim blaming. Don't get me wrong, they clearly should have invested more in security, backups, etc, but a fucking hospital is closing come on.

xoa 3y ago

FWIW, I don't work in a hospital, but I have relatively recently taken on as a client a small rural practice (8-15 employee range) and it's helped further open my eyes and give me more perspective. Big places should at least have dependably competent teams in principle, even if they have tons of expensive legacy, lots more strain/demand, and more perverse incentives and so on. But I think these challenges go up and down the stack in the medical world, and I don't think the available options are as friendly or as good as they should be. This place still only has quite limited internet options (though at long last fiber may come in the next few years), having everything be cloud-based isn't realistic on an unreliable 10 Mbps DSL connection. They had no "IT", just random locals (like us in fairness), which can be decent but also can be... less optimal (one set of intermittent issues they'd been having for years I traced to the previous guys who installed their ethernet not bothering to actually qualify it). And what the doctor had been able to figure out himself. It's a bunch of practitioners and then one front desk person who does all the billing and such and that's it. There was a mixture of windows 7/vista and Mac OS 10.10/10.11. But also a $30k panoramic Xray machine and a bunch of other smaller but still expensive systems that obviously they needed to have work and can't just "oh yeah just buy a new one!" This is a critical local resource in an area where there are towns with a total population of as little as 65. It was doable on a budget with some work to put together a vastly improved setup for them with data going to a ZFS system with constant snapshotting and then that too getting further backups in a few ways to off site, but it took way more technical knowledge/metaknowledge then it should have. If I think about all the various components, this could and should be a lot easier. And even with what we went with I still can't say I'm truly satisfied. Like, why don't TrueNAS or everyone else in the space long since have watch dogs for signs of ransomware? Encrypted files are readily discernible from unencrypted files by computers, so why isn't there just a GUI option to "alert on threshold of change in encrypted files|filesystem entropy"? Or even "radical deviation in snapshot size"? The key thing about ransomware is deviation from norms, by definition it must suddenly make changes to a massive set of files in a way totally different from typical patterns. If all of a sudden a NAS/SAN observes any hints of that why in 2023 isn't that universally a red alert? Why is Webauthn not everywhere for admin pages? Hiding everything behind an internal VPN is good practice, but further layers would be good too. Etc etc, no doubt endless stuff I'm not even thinking of or don't know myself. It's a huge societal drain to lose medical services over such events and fantastically inefficient. The cost to ensure everyone has at least some final fallback WORM recovery or the like, even if a month old, has to be a tiny fraction of the damage that even a single hospital shutdown (or slowdown even) causes. Somehow it's not getting priced in and responded to in a uniform manner. I really feel like I should be long since 100% out of a job on this sort of thing because there should be easy options for non-technical types, and that government should have universal help and guides for all medical providers from sole practitioner on up nationwide to get into a known good state.

efitz 3y ago

A Modest Proposal Sometimes investigators know the actual actors involved with such attacks. 15 years ago I worked for Microsoft and went to a security presentation where the team had done some brilliant work and collaborated with law enforcement over months and had specifically identified an individual associated with a cyber attack. The individual was out of reach because of weak computer crime laws in the attacker’s country and poor diplomatic relations. The FBI was co-presenting and touting the staggering amounts of manpower and funds dedicated to this investigation. I leaned over to a friend of mine and said something to the effect of “with the state of organized crime in that country we could spend a few tens of thousands of dollars for a permanent solution”. I always think back to that comment. Attribution in computer crime is hard, but attackers get away with impunity because they either hide behind anonymity or behind jurisdictional issues. Should we just let that go or use more pragmatic solutions?

kramerger 3y ago
[flagged]
- et-al 3y ago
  They did start with "A Modest Proposal".... But folks are probably doing this because of terrible job prospects in their country. If you pay their government to off this one person, you'd probably need to off five more next week.
- nradov 3y ago
  China actually does the same thing to us. Organ harvesting sensationalism aside, they do operate illegal "police stations" inside the US. https://www.justice.gov/opa/pr/two-arrested-operating-illegal-overseas-police-station-chinese-government https://www.justice.gov/opa/pr/two-arrested-operating-illega... https://thehill.com/opinion/national-security/4008817-crack-down-on-illegal-chinese-police-stations-in-the-u-s/ https://thehill.com/opinion/national-security/4008817-crack-...
- Jiro 3y ago
  >Now, what if they do the same thing to you? If they're going to do the same thing to us, they're going to do it to us anyway, regardless of whether we do it to them first or not.

908B64B197 3y ago

It's interesting to see how IT is perceived as a cost-center and not essential to the business in healthcare; yet everything crumbles and collapses when there's an IT outage. These organizations might not be culturally accustomed to have IT at the core of their business/mission, but it very much is. They might not value engineering skills and people in IT, but they have evolved an absolute dependency on those over the years. The issue here is cultural, not technical. These ransomware attacks, breaches and outages are completely self-imposed. They can end anytime as soon as the hospital wants it. All they have to do is value and acknowledge IT as a fundamental pillar of their organization, comp it appropriately and make sure to run on hardware that's patched and safe to use. Really no different than washing hands before a procedure to stop infections. Else the cycle will endlessly repeat itself.