Hospitals across England hit by large-scale cyber-attack

After 20 years in IT, listening to all the bullshit by &quot;Management&quot; about &quot;Audits&quot; and &quot;accepting the risk&quot;, &quot;lessons learned&quot; and whatnot.<p>Honestly, I would be glad if a high impact issue like this, would change any of that for the better. I am unfortunately also a cynic (after 20 years in, well anywhere really) so I doubt it will. This means it will only negatively impact people who need the healthcare, and a bunch of consultants will make millions on sweeping up the mess, and creating the next failure-to-be.<p>I&#x27;m making popcorn.

According to Spain&#x27;s CCN-CERT it&#x27;s spreading through a remote code execution vulnerability in Windows&#x27; SMB Server, affecting pretty much all versions of Windows.<p><a href="https:&#x2F;&#x2F;www.ccn-cert.cni.es&#x2F;seguridad-al-dia&#x2F;comunicados-ccn-cert&#x2F;4464-ataque-masivo-de-ransomware-que-afecta-a-un-elevado-numero-de-organizaciones-espanolas.html" rel="nofollow">https:&#x2F;&#x2F;www.ccn-cert.cni.es&#x2F;seguridad-al-dia&#x2F;comunicados-ccn...</a><p><a href="https:&#x2F;&#x2F;technet.microsoft.com&#x2F;en-us&#x2F;library&#x2F;security&#x2F;ms17-010.aspx" rel="nofollow">https:&#x2F;&#x2F;technet.microsoft.com&#x2F;en-us&#x2F;library&#x2F;security&#x2F;ms17-01...</a><p>IIUC the security updates have been available since March. I can understand bureaucratic entities having shitty security policies, but Telefónica? It&#x27;s just... wow.

The ransom from the address in the screenshot appears to have been paid: <a href="https:&#x2F;&#x2F;blockchain.info&#x2F;address&#x2F;12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw" rel="nofollow">https:&#x2F;&#x2F;blockchain.info&#x2F;address&#x2F;12t9YDPgwueZ9NyMgw519p7AA8is...</a><p>Here&#x27;s another screenshot, with a different address: <a href="https:&#x2F;&#x2F;img.jes.xxx&#x2F;1472" rel="nofollow">https:&#x2F;&#x2F;img.jes.xxx&#x2F;1472</a><p>Also appears to be paid: <a href="https:&#x2F;&#x2F;blockchain.info&#x2F;address&#x2F;115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn" rel="nofollow">https:&#x2F;&#x2F;blockchain.info&#x2F;address&#x2F;115p7UMMngoj1pMvkpHijcRdfJNX...</a>

Friend of mine who works for the NHS sent me the following email:<p><i>All of NHS PCs and hospital systems have gone down from a ransomware trojan!<p>I have a full clinic this afternoon, and no way to look at my patients&#x27; histories, or meds. It&#x27;s a damned disgrace.‎<p>The Trojan is demanding some bitcoins be paid, else they&#x27;ll lose the boxen.<p>The entire NHS is penetrated.</i><p>I can&#x27;t vouch for &quot;the entire NHS is penetrated&quot;

Seems like non-targeted ransomware - <a href="https:&#x2F;&#x2F;twitter.com&#x2F;ShaunLintern&#x2F;status&#x2F;863032223469056004" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;ShaunLintern&#x2F;status&#x2F;863032223469056004</a> - based on the modest $300 request.<p>Note: I&#x27;ve zero idea if that screenshot is legit but it&#x27;s posted on The Health Care Journal website so it likely is.<p>Edit:<p>- Earliest Google result for &quot;WanaDecryptor&quot; is from Aug 2015 (All other search results are from today):<p>&gt; <i>almost all of the files on the D drive is encrypted. C is not touched by the disc. file found is in the ProgramData folder, there is a hidden folder, the virus in it. When you delete a folder that is created again and the process starts again.</i><p><a href="http:&#x2F;&#x2F;www.cyberforum.ru&#x2F;viruses&#x2F;thread1979411.html" rel="nofollow">http:&#x2F;&#x2F;www.cyberforum.ru&#x2F;viruses&#x2F;thread1979411.html</a><p><a href="http:&#x2F;&#x2F;www.cyberforum.ru&#x2F;viruses&#x2F;thread1979358.html" rel="nofollow">http:&#x2F;&#x2F;www.cyberforum.ru&#x2F;viruses&#x2F;thread1979358.html</a><p>- Discussion from today mentioning it infecting Spanish Telecoms: <a href="http:&#x2F;&#x2F;gta-trinity.ru&#x2F;forum&#x2F;index.php?&#x2F;topic&#x2F;57671-novejshij-virus-na-pk&#x2F;" rel="nofollow">http:&#x2F;&#x2F;gta-trinity.ru&#x2F;forum&#x2F;index.php?&#x2F;topic&#x2F;57671-novejshij...</a>.

Existing discussion thread: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=14324129" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=14324129</a><p>---------<p>Shutting <i>everything</i> down seems like a really rash response, especially when these systems seem to be used for critical communication e.g. the phones too. The Twitter messages seem to suggest that doctors are seeing this on their personal machines, but why would this impact the phone system? Are they not separated out?<p>I&#x27;m also really curious as to how this started. The article mentions a &quot;bug&quot; in the IT systems - some sort of novel zero day in the software they&#x27;re using that was exploited remotely? Or is it more likely someone screwed up and ran something without thinking?<p>There are reports on twitter that this is impacting X-rays, pagers as well as the phone system. This is ridiculous if true and suggests there have been some major failings when putting this infrastructure in place. Perhaps underinvestment in IT is to blame.

This is apparently part of coordinated ransomware campaign targeting large corporations in Europe, only a few of which are making the news at this time. Some other links:<p><a href="https:&#x2F;&#x2F;www.ft.com&#x2F;content&#x2F;74c666ec-8dc7-3b20-b573-245bc0e9d935" rel="nofollow">https:&#x2F;&#x2F;www.ft.com&#x2F;content&#x2F;74c666ec-8dc7-3b20-b573-245bc0e9d...</a><p><a href="http:&#x2F;&#x2F;www.impala.pt&#x2F;noticias&#x2F;pt-alvo-ataque-informatico&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.impala.pt&#x2F;noticias&#x2F;pt-alvo-ataque-informatico&#x2F;</a> [PT]

Caught wind of this earlier today with a European client. We were advised to not connect to their network via VPN. Looks like it&#x27;s a large scale attack that&#x27;s affecting more than just hospitals in England.<p>These could be a coincidence though.<p>Here is a source article talking about a Spanish TelCo: <a href="https:&#x2F;&#x2F;www.usnews.com&#x2F;news&#x2F;technology&#x2F;articles&#x2F;2017-05-12&#x2F;spanish-companies-hit-by-ransomware-cyber-attack" rel="nofollow">https:&#x2F;&#x2F;www.usnews.com&#x2F;news&#x2F;technology&#x2F;articles&#x2F;2017-05-12&#x2F;s...</a>

This is really fun to see two ransom threads on top of HN.<p>This one asking for $300 to the NHS and the other one asking for $600 000 to a phone provider.<p>Either the criminals have no idea what the NHS is or $300 is the limit of what middle managers can pay without much approval.

NHS systems are remarkably un-integrated. Communication, especially between trusts and external organisations like GPs, is often by email. I&#x27;ll be surprised if this isn&#x27;t an email worm.

NHS Digital have released a comment: <a href="https:&#x2F;&#x2F;www.digital.nhs.uk&#x2F;article&#x2F;1491&#x2F;Statement-on-reported-NHS-cyber-attack" rel="nofollow">https:&#x2F;&#x2F;www.digital.nhs.uk&#x2F;article&#x2F;1491&#x2F;Statement-on-reporte...</a><p>===begin quote===<p>A number of NHS organisations have reported to NHS Digital that they have been affected by a ransomware attack which is affecting a number of different organisations.<p>The investigation is at an early stage but we believe the malware variant is Wanna Decryptor.<p>At this stage we do not have any evidence that patient data has been accessed. We will continue to work with affected organisations to confirm this.<p>NHS Digital is working closely with the National Cyber Security Centre, the Department of Health and NHS England to support affected organisations and to recommend appropriate mitigations.<p>This attack was not specifically targeted at the NHS and is affecting organisations from across a range of sectors.<p>Our focus is on supporting organisations to manage the incident swiftly and decisively, but we will continue to communicate with NHS colleagues and will share more information as it becomes available.<p>Notes to editors As at 15.30, 16 NHS organisations had reported that they were affected by this issue.<p>===end quote===<p>I&#x27;d be interested to know how many patients are under the care of those 16 organisations.

Bitcoin address transactions<p><a href="https:&#x2F;&#x2F;blockchain.info&#x2F;address&#x2F;115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn" rel="nofollow">https:&#x2F;&#x2F;blockchain.info&#x2F;address&#x2F;115p7UMMngoj1pMvkpHijcRdfJNX...</a><p><a href="https:&#x2F;&#x2F;blockchain.info&#x2F;address&#x2F;1QAc9S5EmycqjzzWDc1yiWzr9jJLC8sLiY" rel="nofollow">https:&#x2F;&#x2F;blockchain.info&#x2F;address&#x2F;1QAc9S5EmycqjzzWDc1yiWzr9jJL...</a><p><a href="https:&#x2F;&#x2F;blockchain.info&#x2F;address&#x2F;13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94" rel="nofollow">https:&#x2F;&#x2F;blockchain.info&#x2F;address&#x2F;13AM4VW2dhxYgXeQepoHkHSQuy6N...</a>

NHS IT is, of course, vastly under-funded compared to even modest startups, and entangled in bureaucracy of upgrades. I used to work with someone who was one of two sysadmins for a hospital of several thousand staff.

Two weeks ago I contacted my Congressman explaining how important encryption and general IT security is. While he said he agreed with me in principle, he said that terrorism is such a huge problem that things like back doors, weaker encryption, etc. are more important than strong encryption and general IT security. His reply was lengthy, but didn&#x27;t say what I wanted to hear.

For $300, even per machine, it seems like a cheap &quot;mind your backup&#x2F;restore system&quot; lesson.

Ransomware is doing a good job of partitioning sensitive data from those that should not be (mis)managing it.

Like the NHS didn&#x27;t have enough problems with unhappy staff, unfilled positions and Brexit looming... very uncool.

The NHS is notorious for using outdated software, so I&#x27;m surprised it&#x27;s taken so long. We build websites for third-sector organisations who often deal with the NHS and we&#x27;re only just now persuading them to drop support for Windows XP &#x2F; IE8.

This must be a new virus. It is hitting Spanish and Portugese Telecoms.<a href="https:&#x2F;&#x2F;www.usnews.com&#x2F;news&#x2F;technology&#x2F;articles&#x2F;2017-05-12&#x2F;spanish-companies-hit-by-ransomware-cyber-attack" rel="nofollow">https:&#x2F;&#x2F;www.usnews.com&#x2F;news&#x2F;technology&#x2F;articles&#x2F;2017-05-12&#x2F;s...</a><p><a href="http:&#x2F;&#x2F;sicnoticias.sapo.pt&#x2F;pais&#x2F;2017-05-12-PT-Vodafone-EDP-e-KPMG-alvo-de-ataque-informatico" rel="nofollow">http:&#x2F;&#x2F;sicnoticias.sapo.pt&#x2F;pais&#x2F;2017-05-12-PT-Vodafone-EDP-e...</a> (Portuguese)<p>The worrying part is distribution and essencial companies and services

<i>lol</i><p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;GCHQ&#x2F;status&#x2F;863039131399663618" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;GCHQ&#x2F;status&#x2F;863039131399663618</a>

A Dutch news article is claiming that ransomware can be fixed by &quot;big IT security companies&quot;. [1] I thought there was no fix to these cyber-attacks unless you have a backup. I am interested how any fixes are possible?<p>[1] <a href="http:&#x2F;&#x2F;nos.nl&#x2F;artikel&#x2F;2172840-waarschuwing-voor-grote-internationale-gijzelsoftware-campagne.html" rel="nofollow">http:&#x2F;&#x2F;nos.nl&#x2F;artikel&#x2F;2172840-waarschuwing-voor-grote-intern...</a>

Telefónica, the main telecommunications provider in Spain, is also hit. Employees were instructed to shut down their PC&#x27;s and go home.

Does it not make sense to have a &quot;sub-layer&quot; a local network of files rather than files being accessible by outside. I guess once &quot;something&quot; is in, like that Iran Stuxnet PLC attack, then it&#x27;s inside and can execute from within.<p>Unless it&#x27;s like a local attack whether by a worker or something like found a thumb drive outside, plugged it into my work computer.<p>not my field

I wonder how many of these systems have already been exploited (silently) in order to extract things like patient details? Scary.

It seems like for that amount of money, you could have tried doing a bug bounty instead :&#x2F;<p>I get that this is probably social hacking&#x2F;phishing, so not really analogous -- but I wonder if there&#x27;s a way to apply that kind of mentality to good. I wonder if there&#x27;s white hat phishing (though I guess that might be oxymoronic).

Spanish biggest telecom and others had been hit too: <a href="http:&#x2F;&#x2F;www.elmundo.es&#x2F;tecnologia&#x2F;2017&#x2F;05&#x2F;12&#x2F;59158a8ce5fdea194f8b4616.html" rel="nofollow">http:&#x2F;&#x2F;www.elmundo.es&#x2F;tecnologia&#x2F;2017&#x2F;05&#x2F;12&#x2F;59158a8ce5fdea19...</a><p>WannaCry ramsoware is the culprit.

Shutting <i>everything</i> down seems like a really rash response, especially when these systems seem to be used for critical communication e.g. the phones too. The Twitter messages seem to suggest that doctors are seeing this on their personal machines, but why would this impact the phone system? Are they not separated out?<p>I&#x27;m also really curious as to how this started. The article mentions a &quot;bug&quot; in the IT systems - some sort of novel zero day in the software they&#x27;re using that was exploited remotely? Or is it more likely someone screwed up and ran something without thinking?<p>Edit: There are reports on twitter that this is impacting X-rays, pagers as well as the phone system. This is ridiculous if true and suggests there have been some major failings when putting this infrastructure in place.

This recently happened to a hospital in Buffalo NY: <a href="http:&#x2F;&#x2F;www.wgrz.com&#x2F;news&#x2F;local&#x2F;ecmc-still-fixing-computer-system-problems&#x2F;431724954" rel="nofollow">http:&#x2F;&#x2F;www.wgrz.com&#x2F;news&#x2F;local&#x2F;ecmc-still-fixing-computer-sy...</a>

If only intelligence agencies spent as much money and effort on securing its critical systems as they invest in sabotaging other countries&#x27; infrastructure. Maybe putting defense first would be helpful, especially considering how easy the proliferation of offensive tools is.

Something like this (though I don&#x27;t know if it was targeted or a combination of luck+poor procedures) took down &gt; 400 medical practices hosted by Greenway a few weeks ago. Some were down for as much as 9 days, and at day 11 I know of one that still didn&#x27;t have access to their scanned documents.<p>Greenway had backup procedures in place, but they were file-based - backing up databases, transaction logs, files, etc. and able to restore them onto a new server image as required. The problem arose when they had to do that for hundreds of customer servers at once.<p>One of my customers knew there was a big problem when she signed onto their server (Intergy On Demand, hosted by Greenway, accessed via RDP) and saw ransom icons on the server desktop.

I would be interesting in finding a medical doctor&#x27;s or a biologist&#x27;s perspective on this. Suppose we consider the NHS to be a body, in the greater environment of the internet&#x2F;economy&#x2F;government. What traits of that environment led to the evolution of this ransomware pathogen? Now that we have had a massive, but not lethal exposure to it, how can we build up an immunity? What changes to the environment would eliminate the refuges of this pathogen?

&quot;There is no evidence patient data has been compromised, NHS Digital has said.&quot;<p>Um, doesn&#x27;t &quot;encrypted beyond your reach&quot; fall somewhere under &quot;compromised?&quot;

The parent article does not use the word &quot;Microsoft&quot;.

It says the attack hit multiple sites simultaneously. A worker said that the ransomware came through on the computers around 2pm.<p>This doesn&#x27;t sound like a spread by phishing or attachment.<p>How could such an attach be co-ordinated?<p>I can think of two possibilities:<p>1) The attack has been spreading over days or weeks with a trigger date for activation. 2) The ransomware has been distributed through the desktop update system.<p>Any other ideas?

This is affecting pretty much all Europe. We are shutting down everything here: France, UK, Italy, Spain, Sweden, ...

The BMJ published an article recently about hackers targeting hospitals, &quot;The hackers holding hospitals to ransom&quot;: <a href="http:&#x2F;&#x2F;www.bmj.com&#x2F;content&#x2F;357&#x2F;bmj.j2214" rel="nofollow">http:&#x2F;&#x2F;www.bmj.com&#x2F;content&#x2F;357&#x2F;bmj.j2214</a>

Kaspersky Lab&#x27;s Analysis:<p><a href="https:&#x2F;&#x2F;securelist.com&#x2F;blog&#x2F;incidents&#x2F;78351&#x2F;wannacry-ransomware-used-in-widespread-attacks-all-over-the-world&#x2F;" rel="nofollow">https:&#x2F;&#x2F;securelist.com&#x2F;blog&#x2F;incidents&#x2F;78351&#x2F;wannacry-ransomw...</a>

Maybe related to the cyber attack on Telefonica? <a href="http:&#x2F;&#x2F;www.elmundo.es&#x2F;tecnologia&#x2F;2017&#x2F;05&#x2F;12&#x2F;59158a8ce5fdea194f8b4616.html" rel="nofollow">http:&#x2F;&#x2F;www.elmundo.es&#x2F;tecnologia&#x2F;2017&#x2F;05&#x2F;12&#x2F;59158a8ce5fdea19...</a>

I think the most interesting aspect of all this is that it&#x27;s a clear evidence that even machines possessing highly sensitive data (like NHS computers) are super vulnerable to any remote penetration. The request for a ransom may just be the tip of the iceberg here.

Maltracker entry: <a href="https:&#x2F;&#x2F;maltracker.net&#x2F;analysis&#x2F;file&#x2F;ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa&#x2F;" rel="nofollow">https:&#x2F;&#x2F;maltracker.net&#x2F;analysis&#x2F;file&#x2F;ed01ebfbc9eb5bbea545af4...</a>

Here&#x27;s a list of the trusts &#x2F; etc that are affected.<p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;ShaunLintern&#x2F;status&#x2F;863116822228422656" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;ShaunLintern&#x2F;status&#x2F;863116822228422656</a>

Strange question but why is this data in file-systems and not on SQL&#x2F;Cloud systems?

I wonder what the odds are that an attack on infrastructure like this could kill someone?

And this is the reason why you don&#x27;t centralize <i>critical</i> infrastructure and don&#x27;t put yourself in vendor lock-ins.<p>Makes me wonder how many of those infected machines didn&#x27;t have to be connected to the internet in the first place.

Sounds like ransomeware <a href="https:&#x2F;&#x2F;twitter.com&#x2F;asystoly&#x2F;status&#x2F;863027172453351424" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;asystoly&#x2F;status&#x2F;863027172453351424</a>

If I were CEO of one of the big companies I would fire the CIO for not tracking critical patching and I would later resign for not making him&#x2F;her accountable until now.

How is this attack being distributed? It can&#x27;t take much user involvement, or it wouldn&#x27;t be hitting large numbers of systems that only run in-house applications.

Something like this also happened at Carleton University, but they did not pay the ransom. I assume they just used backups. They have really good (and super nice) IT people.

How do these things decrypt?<p>Couldn&#x27;t someone take the &quot;already paid&quot; bitchain address from someone else, put it in and click &quot;paid&quot; with that to unlock it?

How can I protect myself from these NSA level attacks (not attacks by NSA, but by criminals who now have these tool)? Is keeping Windows up to date enough?

Is it not a form of malpractice by these hospitals to be running medically critical services on obsolete unsupported devices?

Spanish big companies like Telefonica, Inditex, Iberdrola, Endesa... are being attacked too.<p>Seems serious.

This is probably the first major hacking incident that will cause multiple deaths.

So we should build backdoors into encryption to prevent this, right? &#x2F;s

I guess it&#x27;s only a matter of time until patient records are available.

Surely just a coincidence that BTC reached a new all time high today ?

On the other hand, $300 sounds like a bargain.

It&#x27;s a large scale attack impacting many companies. We are under attack and are shutting down everything here: France, Spain, Italy, UK, Sweden, ...

Why the hell do they need thick Windows boxes to handle patient records, would a dumb terminal not do and be far more resistant to this kind of problem.

How long until paying ransom for a cyber attack becomes a crime ?

the same is happening in spain <a href="https:&#x2F;&#x2F;www.ccn-cert.cni.es&#x2F;seguridad-al-dia&#x2F;comunicados-ccn-cert&#x2F;4464-ataque-masivo-de-ransomware-que-afecta-a-un-elevado-numero-de-organizaciones-espanolas.html" rel="nofollow">https:&#x2F;&#x2F;www.ccn-cert.cni.es&#x2F;seguridad-al-dia&#x2F;comunicados-ccn...</a>

look at what is happening in spain Telefonica giant

I&#x27;m sure some secret agency has backups of that data.

And I thought the tories were tech illiterates... they sure have improved!

<i>NHS in England hit by &#x27;cyber-attack&#x27; with ransomware demanding $300 in Bitcoin</i><p>Excuse us but we just found out that you&#x27;re NHS. Please make it $300,000 or else.<p>Asking for just a little is a pretty good tactic, used by these guys, patent trolls and the mafia for protection money.

In the aftermath I wonder if we&#x27;ll ever find out how the attack was enabled. As in, who opened the attachment. My hunch? An Executive high enough in Leadership who won&#x27;t get fired. Will be interesting to see.