NHS cyber attack: Hospitals warn patients to stay away from A&E as ransomware cripples systems

[LeftishBrit]

The NHS faces a weekend of chaos after an unprecedented cyber-attack forced hospitals to cancel and delay treatment for patients.

Thousands of patients across England and Scotland are stuck in limbo after A&E wards, GP surgeries and other vital services across the NHS were infected with a virus based on hacking tools developed by US cyber-warfare agents.

Non-emergency patients have been advised to use health facilities frugally, while those who are critically ill have had to be diverted to unaffected hospitals as computer systems failed in A&E units....



At least 30 health service organisations are said to have been infiltrated by the malicious software, while many others shut down servers as a precautionary measure, meaning all systems were offline and hospitals were unable to accept incoming calls. Staff had to carry out work with pen and paper and without access to any digital files...



http://www.independent.co.uk/news/uk/home-news/nhs-weekend-chaos-cyber-attack-a7733791.html

[LeftishBrit]

1. What sort of SCUM make a cyber-attack on the NHS???

Last edited Sat May 13, 2017, 11:56 AM - Edit history (1)

Presumably the answer is organized crime - but this is horrible even by the standards of organized crime.

And yes, IT security should have been better.

ETA: I know it wasn't JUST on the NHS, but they must have known that important organizations for vulnerable people would be affected.

[Denzil_DC]

2. It wasn't specifically targeted at the NHS.

It was very widespread and scattergun, and some NHS systems got caught up in it:

NHS cyberattack is 'biggest ransomware outbreak in history'

The NHS cyberattack that hit hospitals across the UK is said to have been part of the biggest ransomware outbreak in history, according to Mikko Hypponen from F-Secure.

Commenting on the news, Hypponen said the Wanna Decryptor attack was unprecedented, while cyber security expert Varun Badwhar said it gave a glimpse of what a "cyber-apocalypse" would look like.

"We've never seen something spread this quickly in a 24-hour period across this many countries and continents," explained Badwhar. "So it's definitely one of those things we've always heard about that could happen and now we're seeing it play out."

The NHS hack is said to be “creeping” across the UK with reports of the ransomware attack hitting a range of other organisations in as many as 99 countries. In a statement, NHS Digital confirmed a number of NHS organisations had been affected by a ransomware attack. “The investigation is at an early stage but we believe the malware variant is Wanna Decryptor,” a spokesperson said.

http://www.wired.co.uk/article/nhs-cyberattack-ransomware-security

A lot of damage has already been done, but there is one glimmer of sunshine:

'Accidental hero' finds kill switch to stop spread of ransomware cyber-attack

An “accidental hero” has halted the global spread of the WannaCry ransomware, reportedly by spending a few dollars on registering a domain name hidden in the malware.

The ransomware has wreaked havoc on organizations including FedEx and Telefonica, as well as the UK’s National Health Service (NHS), where operations were cancelled, x-rays, test results and patient records became unavailable and phones did not work.

However, a UK cybersecurity researcher tweeting as @malwaretechblog, with the help of Darien Huss from security firm Proofpoint, found and activated a “kill switch” in the malicious software.

The switch was hardcoded into the malware in case the creator wanted to stop it spreading. This involved a very long nonsensical domain name that the malware makes a request to – just as if it was looking up any website – and if the request comes back and shows that the domain is live, the kill switch takes effect and the malware stops spreading.

https://www.theguardian.com/technology/2017/may/13/accidental-hero-finds-kill-switch-to-stop-spread-of-ransomware-cyber-attack

Huss simply paid a tenner to buy the domain and made it visible online (pointing to an online honeypot), and the spread stopped.

This doesn't help those already infected, though, nor does it mean that a future outbreak of a variant can be avoided while there are so many unpatched systems out there and people insist on clicking on links in emails they shouldn't.

[muriel_volestrangler]

3. It wasn't aimed at the NHS - about 100 countries worldwide affected

It tends to hit organisations that have large internal networks that haven't been kept up to date with security patches. Renault and Nissan, Telefonica in Spain, and several Russian government departments have all been hit as well. If one person follows a dodgy link in their email, their PC is infected, and it then finds it easier to get to other PCs on the same network.

https://www.theguardian.com/technology/2017/may/12/nhs-ransomware-cyber-attack-what-is-wanacrypt0r-20

This is a side effect of the NHS paring its budget down to the minimum - still running Windows XP in many places, which was no longer in service (and so not issuing regular security fixes, though I think Microsoft has now issued one specifically for this), or with no system in place to regularly update software with fixes.

[LeftishBrit]

4. Fair enough, but it was still a horrible action

Yes, still running Windows XP is fairly inefficient in all sorts of ways.

[Denzil_DC]

5. My understanding is that the NHS has a corporate licence for XP,

and hence paid an extra fee for an extended period of support, including security patches and updates.

More recent versions of Windows are similarly vulnerable to this particular worm unless patched, so it's not OS-specific.

It seems that some IT managers didn't apply the XP patch issued earlier this year that would have safeguarded against this attack (perhaps because it's been rare for an XP security patch to be significantly important for most users for a number of years now). Given the dispersed nature of the systems (though some of them will need to tap in to central systems), that's unfortunate, but probably inevitable. I know up here in Scotland, health boards have been reported as infected even if it's just a number of individual GP surgeries that have been affected.

[muriel_volestrangler]

6. Are you sure they have the support? The New York Times doesn't seem to think so

It seemed that Shadow Brokers had acquired tools the National Security Agency had used to break into computers. Realizing these tools were stolen, the N.S.A. had warned affected companies like Microsoft and Cisco so they could fix the vulnerabilities. Users were protected if they had applied the patches that were released, but with a catch: If an institution still used an older Microsoft operating system, it did not receive this patch unless it paid for an expensive “custom” support agreement.

The cash-strapped National Health Service in Britain, which provides health care to more than 50 million people, and whose hospitals still use Windows XP widely, was not among those that signed up to purchase the custom support from Microsoft.

https://www.nytimes.com/2017/05/13/opinion/the-world-is-getting-hacked-why-dont-we-do-more-to-stop-it.html?&_r=0

Via https://www.democraticunderground.com/1016185124

[Denzil_DC]

7. No, I'm not sure (I did say "My understanding is ..."), and I stand ready to be corrected.

But from the digging I've done, the situation's far from clear (given the standard of tech coverage in the MSM, that's not a surprise).

I've found a number of stories repeating the line that the NHS didn't pay for extended coverage, but they could stem from a common press agency source or plain old copying others' work.

I did find this on my travels, which might support your assumption (warning: direct PDF link; bold in original), but nothing to indicate whether the situation changed after it was written (since the mass upgrades to NHS systems evidently haven't happened):

https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/314721/DHandCabinetOfficeMicrosoftXPupdate8April14.pdf

08 April 2014

Dear Colleague,

URGENT ACTION REQUIRED FOR THOSE NHS ORGANISATIONS THAT HAVE NOT MIGRATED AWAY FROM MICROSOFT XP

The Department of Health (DH) and Crown Commercial Services (CCS) have now concluded a new agreement with Microsoft. This makes Custom Support for Windows XPSP3, Office 2003SP3 and Exchange 2003 SP2 available to any NHS Organisation that require it until 14 April 2015; whilst migration away from Microsoft XP is undertaken.

Please note, if you have not migrated away from Windows XP, Security Patch downloads will only become available to organisations once you have put a Premier Services Agreement (PSA) in place with Microsoft. To be clear, having a PSA in place is a prerequisite to accessing Custom Support. Further information on how to access this is detailed below.

A PSA must be in place prior to the first full patch release on Tuesday 13 May to ensure continued access to Security Patch Downloads.

To note that NHS organisations should be aware that if you have less than 250 devices requiring Custom Support (i.e. 250 devices still using Windows XP) this will be at nil additional cost. However you still need to register; see below.

Mitigating the risk: registering with Microsoft

It is imperative that your organisation clearly understands the risk that is placed on it should the decision be not to take out a PSA.
Integral to this is considering your current status with regard to your migration roadmap from Windows XP and identify risk exposure and timeframes.

If you have not migrated away from Microsoft XP then you must urgently take out a PSA to continue to access critical and important security updates beyond 8 April 2014 for XP, Office 2003 and Exchange 2003 by completing and submitting the attached Form at the earliest opportunity and submit to psstall@ microsoft. com

Funding of Custom Support

DH will centrally fund the provision of Custom Support for 12 months until 14 April 2015.

It is important to note that there are no plans to negotiate a further national extension of XP support beyond April 2015. It is therefore essential that all NHS organisations put in place robust plans to migrate away from Windows XP, Office 2003 and Exchange 2003 by that date if you have not already done so.

...

Nevertheless, the security issue isn't OS-specific. I also wouldn't be surprised if automatic updates was turned off for later versions of Windows in a hospital setting - you can't afford to have an unscheduled update popping up during procedures, I'd have thought.

[Denzil_DC]

11. An aside to this discussion, apart from the question of what countermeasures

the government and health boards took (it looks more and more like the government passed the buck to individual boards to upgrade, and find the money to do so from wherever), I thought this was interesting:

Almost all WannaCry victims were running Windows 7

One week after it first hit, researchers are getting a better handle on how the WannaCry ransomware spread so quickly — and judging from the early figures, the story seems to be almost entirely about Windows 7.

According to data released today by Kaspersky Lab, roughly 98 percent of the computers affected by the ransomware were running some version of Windows 7, with less than one in a thousand running Windows XP. 2008 R2 Server clients were also hit hard, making up just over 1 percent of infections.

Windows 7 is still by far the most common version of Windows, running on roughly four times as many computers as Windows 10 worldwide. Since more recent versions of Windows aren’t vulnerable to WannaCry, it makes sense that most of the infections would hit computers running 7. Still, the stark disparity emphasizes how small of a role Windows XP seems to have played in spreading the infection, despite early concerns about the outdated operating system.

https://www.theverge.com/2017/5/19/15665488/wannacry-windows-7-version-xp-patched-victim-statistics

So it sounds like the health boards that took the government advice and upgraded from XP to Windows 7 or 8 (but not 10) but didn't keep their systems up to date with patches ended up more vulnerable than those that stuck with XP!

Microsoft article about WannaCrypt, including links to patches for a range of Windows systems, including XP: https://blogs.technet.microsoft.com/mmpc/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/

[Donald Ian Rankin]

8. "They hurt lots of other people too, not just the NHS!" is not really a mitigating factor... N.T.

[muriel_volestrangler]

9. The point is that it wasn't *aimed* at the NHS

Yes, people who design and spread ransomware are awful, and the practical effects can include hurting good organisations as well as individuals. But it wasn't designed as "an attack on the NHS".

[Denzil_DC]

10. Last I heard, these arseholes had only made about 2,000 pounds so far from this vast attack.

I don't give much for anybody's chances of tracking them down, but I'm keeping my fingers crossed.