Hospitals and Doctors' surgeries hit with ransomeware attack - Page 1
Forum section: electronics / general

author: Delta
author_rank: Super Contributor
timestamp: May 12, 2017, 11:29:28 pm
content: http://www.telegraph.co.uk/news/2017/05/12/nhs-hit-major-cyber-attack-hackers-demanding-ransom/Here in the UK the NHS has been hit with a ransomeware attack, GPs can't access patients' records, and phone systems have gone down.I understand that ransomeware could be executed by an end user on their desktop and encrypt their local data, but how the hell can it have affected database and VOIP servers?Secondly, where the hell are the backups?

author: helius
author_rank: Super Contributor
timestamp: May 13, 2017, 12:07:26 am
content: The bitlocker that was used does not require any user intervention, as would a trojan: it exploits services that listen on the network. A combination of buffer overflows and privilege escalation was evidently used to own the data servers.

author: Delta
author_rank: Super Contributor
timestamp: May 13, 2017, 12:28:55 am
content: Quote from: helius on May 13, 2017, 12:07:26 amAh, understood.Serves me right for listening to the MSM....

author: Rick Law
author_rank: Super Contributor
timestamp: May 13, 2017, 03:32:27 am
content: Hits the rail road in Germany as well!http://www.zerohedge.com/news/2017-05-12/massive-disturbances-german-rail-system-due-ransomware-attackAnd according to Wall Street Journal, even wider than Germay/UK..."Major Cyberattack Sweeps Globe, Hitting FedEx, U.K. Hospitals, Spanish Companies..."https://www.wsj.com/articles/english-hospitals-hit-by-suspected-cyberattack-1494603884

author: PartialDischarge
author_rank: Super Contributor
timestamp: May 13, 2017, 04:20:28 am
content: This worldwide hack stems from this,https://www.eevblog.com/forum/chat/nsa's-powerful-windows-hacking-tools-leaked-online/We should congrat NSA and microsoft for engineering together numerous backdoors

author: PartialDischarge
author_rank: Super Contributor
timestamp: May 13, 2017, 04:57:08 am
content: What I'm saying is that MS is responsible in many ways for their faulty software, not that they are directly in on the attack.https://www.forbes.com/sites/thomasbrewster/2017/05/12/nsa-exploit-used-by-wannacry-ransomware-in-global-explosionAlthough Ive read in this this forum that we apple users are sheep, idiots and fanboys, I feel much more safe with them and only that, besides many other features, is worth the extra pay. Of course W7 runs in my macs conveniently caged in VirtualBox

author: Halcyon
author_rank: Unknown
timestamp: May 13, 2017, 05:23:56 am
content: Quote from: MasterTech on May 13, 2017, 04:57:08 amAbsolute bollocks. Every operating system has its flaws and vulnerabilities. Microsoft patched this particular vulnerability earlier this year. If people didn't bother to apply critical security updates, then it's the user/network admins that are at fault. Just about every computer and "smart" device you own is vulnerable to exploits, attacks or has the ability to be turned into a listening device. If you think your Apple products are any more secure right out of the box, then you're sadly mistaken.This is the world we live in now.

author: PartialDischarge
author_rank: Super Contributor
timestamp: May 13, 2017, 05:35:32 am
content: QuoteYou are implying that because every OS has vulnerabilities (which is true), MS is no worse than others. And THAT reasoning is bollocks, besides than being so funny to hear

author: Halcyon
author_rank: Unknown
timestamp: May 13, 2017, 05:46:23 am
content: Quote from: MasterTech on May 13, 2017, 05:35:32 amMy rebuttal wasn't to point out that Microsoft OS's are any "better" or "worse" than another. I simply pointed out that your statement was incorrect. With the exception of a few awful versions, Microsoft hardly churn out "faulty" software. Users had since at least March to patch this particular vulnerability, if they chose not to, how can you blame the software?It really isn't a laughing matter, I've said it before and I'll say it again: Windows can be highly secure if you know what you're doing, same as any other operating system. Windows is in wide-spread use even on restricted networks (up to an including 'Top Secret'). I often find those that laugh are those that don't work in the industry or don't understand security and network design.

author: Ampera
author_rank: Super Contributor
timestamp: May 13, 2017, 05:48:00 am
content: I use Server 2016 and update regularly. I'm safe over here.and yes I use Server 2016 as a desktop operating system. It's one of the best operating systems I have used that can natively run Windows applications.

author: Ampera
author_rank: Super Contributor
timestamp: May 13, 2017, 06:32:08 am
content: Quote from: blueskull on May 13, 2017, 05:52:56 amI have it from Imagine (As I am a student) and I have to say it is the closest still in life operating system you can get to Windows 2000.There are still annoying things. Forced updates aren't a thing, but forced restarts are. However I don't disagree with Microsoft doing either. It is annoying when it shuts off somebody's stream, or cuts me off mid-game, but the amount of people f**ked over a chair because of not doing it is astonishing. You can't really blame them for doing the one thing that would stop maybe a third of all shit that goes down on computers world wide.Cortana is gone, and while I have heard that it's still in here, UWP apps and the store you buy them from aren't anywhere to be seen. Edge isn't there, but I myself don't want to use a web browser from Microsoft, the company I still firmly believe would make the world a better place if it up and died. It's bad enough I have to use their operating system to run half of my programs.In terms of the classic screw you I won't install because you're running server bullshit, I haven't seen it once. That being said I have not installed Avast or any other form of AV protection other than the built in one (Which works fine enough)It's just a plain old operating system with everything that you need, and for the most part, nothing that you don't.

author: TerraHertz
author_rank: Super Contributor
timestamp: May 13, 2017, 06:57:42 am
content: http://www.zerohedge.com/news/2017-05-12/massive-ransomware-attack-goes-global-huge"Worst-Ever Recorded" Ransomware Attack Strikes Over 57,000 Users Worldwide, Using NSA-Leaked Toolshttps://theintercept.com/2017/05/12/the-nsas-lost-digital-weapon-is-helping-hijack-computers-around-the-world/Leaked NSA Malware Is Helping Hijack Computers Around the WorldQuoteWell, to be more accurate, in April Shadowbrokers released the decryption key to an NSA tools bundle they had released about a year ago.Anyway, key point is, these tools were created by the NSA. Ransomware tools. Think about that.Here's someone else thinking about it. (The site does not have direct links)QuoteAnother point: Just because the NSA toolset was leaked, does not guarantee current attacks are being done by entities other than the NSA/CIA. There's still full access & control of the net backbone by intel agencies and groups like Comverse/Xura. Think about how such botnets remain possible, and who benefits.

author: GeorgeOfTheJungle
author_rank: Super Contributor
timestamp: May 13, 2017, 10:42:25 am
content: Telefónica has been hacked as well, 12 thousand employees' computers plus all the wifis were shutdown yesterday morning at the central offices in Madrid, until further notice. The panic msg "Urgente: apaga tu ordenador ya" was sent by email to each and every employee. It seems the on screen message asks for $300 "prompt payment" per pwned computer. Some say more if not "prompt", lol. And the backup servers today are under a self-inflicted DoS attack.

author: RGB255_0_0
author_rank: Frequent Contributor
timestamp: May 13, 2017, 10:55:40 am
content: Microsoft made public a patch 2 months ago:https://technet.microsoft.com/en-us/library/security/ms17-010.aspx?f=255&MSPPError=-2147217396The fact that companies did not test and roll out the patch since then is on their heads. Still using XP today is dumbfounding.

author: GeorgeOfTheJungle
author_rank: Super Contributor
timestamp: May 13, 2017, 11:17:48 am
content: Sure, Windows is well known for being malware proof, lol.

author: Halcyon
author_rank: Unknown
timestamp: May 13, 2017, 11:38:39 am
content: Quote from: GeorgeOfTheJungle on May 13, 2017, 11:17:48 amYou clearly haven't read this thread. Windows *can* be very secure. No less than Linux or Mac OS X.

author: daqq
author_rank: Super Contributor
timestamp: May 13, 2017, 11:39:00 am
content: QuoteWell, backups are awesome things, but:1. Not everyone does them, let alone properly.2. A mass rollback of a large amount of PCs is not a simple thing - assuming 1000 PCs get hit in an organization, this means that the IT people need to visit 1000 PCs*. So, even if backups exist and are properly kept, a mass rollback is not as simple as clicking a button.3. Even though having backups of the data is great, you still need to exorcise the crap from the machine. Putting the data back on a infected PC will only cause the same problem in the future. This is at the very least running some specialized tool, more properly doing a whole fresh reinstall.So, how many such procedures (per PC: exorcise/reinstall, patch, configure, upload data from backup) could an IT dept. of 10 people do per day?Essentially, even if all backups are up to date, properly stored and no long term data loss is done, such a situation can paralyze an organization for quite a long time.* - in addition to preventing the shitstorm from spreading, and managing a load of chaos.

author: Halcyon
author_rank: Unknown
timestamp: May 13, 2017, 11:43:28 am
content: Quote from: daqq on May 13, 2017, 11:39:00 amIf they have their systems set up properly, one can image and rebuild a machine from scratch complete with drivers and applications using network booting in 30 minutes. This can even be done by the end user without requiring someone with domain admin privileges. Long gone are the days where someone from IT needed to go around to each machine with a boot disc or a RIS image.F12 to boot to PXE then an  or click to start imaging. Walk away and come back a short time later, you're at the Windows 7 login screen, all standard applications pre-installed, ready for the end-user to start using the machine.

author: daqq
author_rank: Super Contributor
timestamp: May 13, 2017, 11:56:03 am
content: QuoteThe key word here isproperly. Yes, when everything is properly set up, and the infrastructure (both software, hardware and organizational) is in place, such a thing (mass infection in this case) would not even happen, or its effect would be a minor annoyance.Since this is apparently not the case (unpatched/ancient PCs, with XP or older, low/no budget IT dept.) people are screwed.

author: TerraHertz
author_rank: Super Contributor
timestamp: May 13, 2017, 12:22:47 pm
content: Talking about restoring machines from backups... check the references in that timeline I attached above. Stuff in that NSA toolkit includes the ability to inject itself into the hard disk FIRMWARE, which then provides hidden disk sectors that can ONLY be accessed via the kit's API. So wiping the disk and reinstalling the OS etc, isn't enough. It takes smashing the drive and getting a new one.I haven't read anything about this current ransomware outbreak doing that. But I think that's the kind of charming stuff we can look forward to.

author: GeorgeOfTheJungle
author_rank: Super Contributor
timestamp: May 13, 2017, 01:29:28 pm
content: Quote from: Halcyon on May 13, 2017, 11:38:39 amRight, there are literally hundreds of tools to help with that.

author: Kalvin
author_rank: Super Contributor
timestamp: May 13, 2017, 01:51:27 pm
content: Wasn't there a recent virus which exploited the vulnerability in the Windows Defender. For example the Windows machine could get infected when someone sent a malicious email containing the virus, the email-client fetched the infected email from the server, and the Windows Defender got goofed infecting the computer while scanning the incoming email.Yes, here is a link to Arstechnica article:https://arstechnica.com/information-technology/2017/05/windows-defender-nscript-remote-vulnerability/

author: vodka
author_rank: Frequent Contributor
timestamp: May 13, 2017, 03:10:37 pm
content: Quote from: GeorgeOfTheJungle on May 13, 2017, 10:42:25 amBut "Telefonica" hired a hacker for avoiding these kind of threats. The result : TOTAL FAIL

author: GeorgeOfTheJungle
author_rank: Super Contributor
timestamp: May 13, 2017, 03:40:49 pm
content: Es que ese tío es un impresentable.

author: RGB255_0_0
author_rank: Frequent Contributor
timestamp: May 13, 2017, 03:50:34 pm
content: Quote from: vodka on May 13, 2017, 03:10:37 pmThe guy that found some exploit in Excel to get a Command Prompt?

author: PartialDischarge
author_rank: Super Contributor
timestamp: May 13, 2017, 03:56:30 pm
content: Quote from: GeorgeOfTheJungle on May 13, 2017, 03:40:49 pmTranslation: "That guy is a d**khead"Quote from: RGB255_0_0 on May 13, 2017, 03:50:34 pmHe hasn't done much, I'm my opinion he's average, be he's so cool that seldom shaves and always wears a beanie like he is something special

author: PartialDischarge
author_rank: Super Contributor
timestamp: May 13, 2017, 04:26:22 pm
content: Now, this is worthy of a prize:https://www.theguardian.com/technology/2017/may/13/accidental-hero-finds-kill-switch-to-stop-spread-of-ransomware-cyber-attack

author: GeorgeOfTheJungle
author_rank: Super Contributor
timestamp: May 13, 2017, 04:56:57 pm
content: "Our decryption service"

author: stj
author_rank: Super Contributor
timestamp: May 13, 2017, 05:04:16 pm
content: time to kill "microsoft in the workplace" once and for all.did they have off-machine backups every 24 hours? i do - and that's just a home machine.

author: RGB255_0_0
author_rank: Frequent Contributor
timestamp: May 13, 2017, 05:15:24 pm
content: Quote from: stj on May 13, 2017, 05:04:16 pmRemind me how long IBM knew about Dirty Cow?

author: mtdoc
author_rank: Super Contributor
timestamp: May 13, 2017, 07:42:29 pm
content: This guy stopped it.

author: rdl
author_rank: Super Contributor
timestamp: May 13, 2017, 07:50:49 pm
content: A story has appeared saying:Quotehttps://www.theverge.com/2017/5/13/15635006/microsoft-windows-xp-security-patch-wannacry-ransomware-attack

author: mtdoc
author_rank: Super Contributor
timestamp: May 13, 2017, 08:05:52 pm
content: It's true.https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

author: Marco
author_rank: Super Contributor
timestamp: May 13, 2017, 08:16:27 pm
content: I don't understand why any computer in any safety critical environment would ever need SMB, or indeed why any computer/VM able to read email or the web would ever be connected to the same network it's on. Or hell I don't understand why you would even allow any connection of external storage to a computer/VM on that network without paper forms being signed.That's why I'm not in IT I guess, I could never correctly balance annoyance vs. billions worth of damages (and lives in this case). Less annoyance until the inevitable clusterfuck is supposedly the better decision every time, that's modern IT. Full retard.

author: rdl
author_rank: Super Contributor
timestamp: May 13, 2017, 08:41:17 pm
content: Isn't SMB how Windows computers communicate over a network? How could it not be used?

author: stj
author_rank: Super Contributor
timestamp: May 13, 2017, 09:17:38 pm
content: Quote from: rdl on May 13, 2017, 08:41:17 pmthere are other protocols that arent so open to scumware abuse.ftp or sftp for a start.

author: RGB255_0_0
author_rank: Frequent Contributor
timestamp: May 13, 2017, 09:43:57 pm
content: Quote from: stj on May 13, 2017, 09:17:38 pmFTP? And you're saying SMB has issues?

author: stj
author_rank: Super Contributor
timestamp: May 13, 2017, 09:50:49 pm
content: ftp needs a password that can be machine-specific and not known to the o.s. - only the applications.it's a start and no "discovery" pings related to it either.also, not using standard port numbers would help

author: Marco
author_rank: Super Contributor
timestamp: May 13, 2017, 09:52:14 pm
content: Quote from: rdl on May 13, 2017, 08:41:17 pmPut it in a tightly locked down VM, which is simply reloaded fresh every so often. With the application(s) only able to communicate with the data servers across a couple of ports with input sanitizers server side. If you have to use windows in a hospital for anything critical that's about as far as I would trust it.I certainly would not open a SMB port serviced with a huge multi-decade old codebase with a gazillion backwards compatibility hacks to the whole intranet, which is itself open to the internet through e-mail and the web (proxies and virus detectors are not sufficient). I know it's standard practice and necessary for the normal way windows is used in IT (Active Directory etc). As I said, full retard.PS. all of this would only be slightly less true for Linux. Extreme paranoia is the only sensible way to deal with long tail risks, because our instincts will always underestimate their costs.

author: rdl
author_rank: Super Contributor
timestamp: May 13, 2017, 10:07:35 pm
content: Quote from: Marco on May 13, 2017, 09:52:14 pmOkay, I see now that you are referring to a relatively special case situation and not to using Windows as an average person or even as most businesses would need to use it.

author: Marco
author_rank: Super Contributor
timestamp: May 13, 2017, 10:12:38 pm
content: Quote from: rdl on May 13, 2017, 10:07:35 pmBeing full of government employees the NHS will probably harder to reform, but I think Telefonica will have a really hard think about how much they really "need" to use windows in the way most businesses use it. Hopefully with enough massive economic impacts and a few more decades IT will evolve to only slightly retarded.

author: Bud
author_rank: Super Contributor
timestamp: May 13, 2017, 11:49:09 pm
content: Quote from: stj on May 13, 2017, 09:17:38 pmFTP is not point to point. You need a FTP server on the target machine. It is not built-in in Windows. This is a separate 3rd party product. So now:- you need to purchase it- you need to maintain it- you need to administer it- you may need to schedule scripts/job files around it, e.g. for file transfer to minimize replication time- you will need to monitor the above scripts/job files to ensure they did not fail- you may need to monitor the above monitoring job to ensure the monitoring job did not fail, if currency of the files is critical to the target consuming application- in big organizations questions will be asked:+ who will pay for it+ who will be supporting it+ who will be administering it+ who will be managing SSH keys+ do we have a company approved supplier that we can purchase the software from* if not, we need to find one and onboard them into our supplier management system, that will take ~6 monthsNow, SMB which is built-in to Windows OS all of a sudden makes sense.No this is not hypothetical, this was a real case I worked on a few years back. I will let you guess the result.

author: Marco
author_rank: Super Contributor
timestamp: May 14, 2017, 01:36:32 am
content: My problem isn't so much with using SMB as a network file system. My problem is allowing inbound SMB connections by full retards, ie. anyone in IT who can't at least keep the servers and their remote management computers secure, or by people who have no business accessing the SMB port on those machines. Which is to say normal users, who should be relied upon to do almost anything (unintentially) to make their computers insecure ... which is why they should not be allowed near the web, non text emails or an USB port on any computer/VM doing anything important.

author: X
author_rank: Regular Contributor
timestamp: May 14, 2017, 03:39:52 am
content: Quote from: stj on May 13, 2017, 09:17:38 pmFTP is a dog's breakfast. I've had a lot of trouble with FTP access through a firewall that blocks most of the outgoing TCP/UDP ports other than ones I specify. Put simply, FTP enjoys opening up multiple ports at random in order to communicate. Then you have to deal with "active" vs "passive" mode.SFTP is a lot more sane, and is a clean file transfer layer on top of SSH, so only one port has to be open.Quote from: Marco on May 13, 2017, 10:12:38 pmI won't be holding my breath for this. The companies making these products are busy working on features nobody needs, and "smart"/IoT/connected (and vulnerable) junk, that nobody needs at all, but these companies will peddle it as if you really do need it because it's oh so cool, you get to be connected, you're more productive, easier to be in touch with "friends" and all that. Marketing 102: if there isn't a problem, invent one, then make the solution.If computing remained strictly in the hands of geeks/nerds/techies/eggheads/dweebs/whatever, none of this mess would have occurred. Too late now I suppose, the planet's fucked. Nobody learned from Blaster/Sasser/Mydoom/etc back in the early 2000's, nobody learned from the Snowden leaks of 2013, nobody learned from the various iOS/Android/Windows malware over the years, so any future economic damage is unlikely to teach anybody a lesson.

author: donotdespisethesnake
author_rank: Super Contributor
timestamp: May 14, 2017, 01:27:11 pm
content: Quote from: X on May 14, 2017, 03:39:52 amSurely everyone knows how people work by now:1. Ignore everything that doesn't directly impact you, if other people are seeking help, complain about using your taxes for people wanting handouts.2. When the issue does hit you, blame everyone else for not having "done something". Demand free handouts.QuoteThere's a school of thought that says that happened when humans discovered agriculture. Up to then, the hunter/gatherer lifestyle had a fairly benign impact on ecosystems, or at least it was limited by the low population density allowed by h/g. To be honest, now we got here, we may as well carry on. No one wants to give up their smartphone to go live in a forest.

author: stj
author_rank: Super Contributor
timestamp: May 14, 2017, 01:32:31 pm
content: the real problem is hardware & software company's working with government to make damned sure there is no real security for the user.if you repair laptops, you may have noticed that the internal camera often runs on the 5v/3v standby supply instead of the general one!!i leave it to you to work out why they did that!!!!!!!!!!!

author: madires
author_rank: Super Contributor
timestamp: May 14, 2017, 02:58:21 pm
content: Hospitals and medical care are sometimes forced to use an outated OS for compliance. DICOM and PACS are such an example. The software is certified together with specific Hardware (PC models), OS and software setup. If the hospital's IT staff would change anything major, like the OS, it would invalid the system's certification. In the case of DICOM/PACS the PC may not be used for diagnosing x-ray/CT/MRT images any more. And since the whole certification process is quite slow, an up-to-date system might run an older OS version. The only thing the IT staff can do is building separated networks for those systems.

author: LaserSteve
author_rank: Super Contributor
timestamp: May 14, 2017, 03:37:57 pm
content: I'm old enough to remember pre-internet days. I'd love to go back. Books worked good enough, land line phone worked well, and I'd no longer need a cell phone. Ham radio phone patches were good enough for car accidents etc A modem at 56 Kbaud was enough for most tasks.Honey, I'm sorry I'm late was good enough!. People spoke back then, now my coworkers text people who are setting 20 feet away in the same room. "We are Borg".I can't wait to see if the convoluted commercial security software saved my "at work" laptop tomorrow. Redoing every computer on a 22,000 person campus would be a disaster. I'm sure every technology person on campus, including me, would instantly be seconded to IT Services.Steve

author: Darren
author_rank: Newbie
timestamp: May 14, 2017, 04:03:25 pm
content: I'm puzzled why these client systems are all listening for SMB packets. I haven't been in IT admin for quite a few years now but when I was an IT manager all PC's were configured with all unnecessary services removed or disabled. Peer to Peer file sharing was disabled, files had to be saved on properly managed file servers that have proper backups in place and individual computers were essentially disposable as they contained no user data that was not also held on the servers. Each local network had a firewall system that connected it to the internet and to other networks. The remote networks were not assumed to be safe so only a subset of required ports were open between remote office locations including SMB packets restricted to accessing defined file servers in those locations.You can never stop bad things getting on your network as there will always be someone who falls for malware message or who does something silly without thinking about it. The trick is to limit the damage by ensuring access to essential systems in strictly controlled and that people who should know what they are doing (less likely to click some spam link) are managing the critical systems. It just seems like obvious precautions to take. Not saying this wouldn't have caught us out in someway but I'm confident that with these basic procedures in place the damage would be limited and the recovery straight forward.

author: GeorgeOfTheJungle
author_rank: Super Contributor
timestamp: May 14, 2017, 04:43:37 pm
content: The problem is to encrypt your own files you don't need admin privileges, and there's no way to distinguish a tetris the user has downloaded from a (yet unknown) malware, so... in theory this one may work just as well on Windows as on Linux or Mac OSX or whatever except iOS where apps are sandboxed and can in theory touch only their own data.

author: vodka
author_rank: Frequent Contributor
timestamp: May 14, 2017, 05:46:19 pm
content: Quote from: GeorgeOfTheJungle on May 14, 2017, 04:43:37 pmI follow thought that encrypting all data of one or various harddisk of 1 or 2 terabytes without that the computer without doing a deadlock,really is a impossible. The people haven't patience and they will reset the PC. Do you imagine that the worm encriypts with AES a folder full videos of size 20GB?

author: perieanuo
author_rank: Frequent Contributor
timestamp: May 14, 2017, 06:16:38 pm
content: Quote from: Halcyon on May 13, 2017, 11:43:28 amDid you really DID this for let's say 1200-1500 pc's in a company with 3-10servers ,2 dhcp ones and 100mhz nics ?get real mrEnvoyé de mon iPad en utilisant Tapatalk