NHS computer systems hacked!?

did you miss the last dozen posts, yes it would and it would take a long time until it could be enforced, and as I said that is why it should be done asap.

Point was I think you are massively underestimating the shake up it would require to the law as well as logistically and how whole rafts of interconnected industries work - it would be 10-20 years or more before what you are talking about would be feasible in the slightest.
 
Ive seen the old green on black stuff - emulated on machines because the "app" was never rebuilt
There's nothing fundamentally wrong with applications running on mainframe systems and accessed via terminal emulators, let's not get the idea that newer always equals better.

just no. how did you come to that conclusion.

What good is the source code if you don't fully understand it?
 
Point was I think you are massively underestimating the shake up it would require to the law as well as logistically and how whole rafts of interconnected industries work - it would be 10-20 years or more before what you are talking about would be feasible in the slightest.
nope, again I said like a decade, so I think you are just failing at reading.

also lets take this back to reality, when was an mri machine used as a backdoor.
 
What good is the source code if you don't fully understand it?
did I say have it for everything?
is it a potential back door, can it infect the rest of the system, is it a multi bn dollar piece that is critical for your companys existence? If yes to all then you would probably want to get it in that case.
 
NHS is not only using Win 7 and XP but it's not uncommon to see Windows 98 on ECG machines and other built ins. And for a good reason. We live in terrible times of enforced product obsolescence. A multimillion fleet of 2012 computers with Windows 7 would lose security updates just three years later because Microsoft decided end consumer and millions of machines in government and healthcare places just weren't worth their attention. Multimillion fleet of perfectly good cardiographs or ultrasound scanners from 2012 wouldn't get drivers to work on Windows 8 or Windows 10 because it was unsustainable for developers to maintain such wide span of OSes. Databases wouldn't support both old and new OSes. It's virtually impossible for organisation like NHS to keep up with lifecycles this short. And good that they don't chase those scrooge EOLs. Windows 8 will stop updating next year. Windows 10 forced onto everyone on earth will stop updating in 2020. By the time NHS would replace last computer in Johny O'Groats walk in centre, it would be already obsolete in the eyes of Microsoft and with them, manufacturers and devs writing drivers and so on.
And there isn't viable alternative. Insurable Linux? Red Hat - is even worse - RHEL5 was only released in 2014 and it's already EOL. Just three years later. With no direct upgrade path.
 
Windows 98 running a piece of equipment is fine, but it shouldn't be networked to anything. People wanting to connect everything to everything else and make stupid "cloud systems" is the real issue.
 
NHS is not only using Win 7 and XP but it's not uncommon to see Windows 98 on ECG machines and other built ins. And for a good reason. We live in terrible times of enforced product obsolescence. A multimillion fleet of 2012 computers with Windows 7 would lose security updates just three years later because Microsoft decided end consumer and millions of machines in government and healthcare places just weren't worth their attention. Multimillion fleet of perfectly good cardiographs or ultrasound scanners from 2012 wouldn't get drivers to work on Windows 8 or Windows 10 because it was unsustainable for developers to maintain such wide span of OSes. Databases wouldn't support both old and new OSes. It's virtually impossible for organisation like NHS to keep up with lifecycles this short. And good that they don't chase those scrooge EOLs. Windows 8 will stop updating next year. Windows 10 forced onto everyone on earth will stop updating in 2020. By the time NHS would replace last computer in Johny O'Groats walk in centre, it would be already obsolete in the eyes of Microsoft and with them, manufacturers and devs writing drivers and so on.
And there isn't viable alternative. Insurable Linux? Red Hat - is even worse - RHEL5 was only released in 2014 and it's already EOL. Just three years later. With no direct upgrade path.

apart from extended support is 5 years after those dates you given, but don't let facts get in the way. Oh and w10 is past those dates as long as you keep it upto date, with every new update it gets extended.
Vista was released 2006 and has just ended support.
 
or you know design new software.
Mri also doesn't hold customer data, so don't have it on the larger network or connected to the internet.

It probably would need to be hooked to N3 though to get the scans onto the patient notes.

One simply does not code a new mri backend .jpg
 
NHS is not only using Win 7 and XP but it's not uncommon to see Windows 98 on ECG machines and other built ins. And for a good reason. We live in terrible times of enforced product obsolescence. A multimillion fleet of 2012 computers with Windows 7 would lose security updates just three years later because Microsoft decided end consumer and millions of machines in government and healthcare places just weren't worth their attention. Multimillion fleet of perfectly good cardiographs or ultrasound scanners from 2012 wouldn't get drivers to work on Windows 8 or Windows 10 because it was unsustainable for developers to maintain such wide span of OSes. Databases wouldn't support both old and new OSes. It's virtually impossible for organisation like NHS to keep up with lifecycles this short. And good that they don't chase those scrooge EOLs. Windows 8 will stop updating next year. Windows 10 forced onto everyone on earth will stop updating in 2020. By the time NHS would replace last computer in Johny O'Groats walk in centre, it would be already obsolete in the eyes of Microsoft and with them, manufacturers and devs writing drivers and so on.
And there isn't viable alternative. Insurable Linux? Red Hat - is even worse - RHEL5 was only released in 2014 and it's already EOL. Just three years later. With no direct upgrade path.

MS have been doing this for a long time. You only have to look at the roadmaps now to see that new versions are purely created because that's what the roadmap/cycle states. How else do you sell people 3 years of SA? You promise people that they will get a new version of an OS/software package at least every 2 years. There's no real need for a new OS that quickly as they could easily build in new functionality etc but that's not going to make them the money they require. They want to sell you a new shiny and you will buy it..

With regards to data protection GDPR is going to shake up the whole game with regards to hacks and leaks. Companies will get massive fines for not securing data. (2-4% of turnover if I remember correctly?) Any company looking after user/personal data will need to demonstrate they have controls in place to secure it and also report leaks/hacks within 72 hours. Although it's an EU thing it affects any personal data traversing the EU, so us in the U.K. And even guys in the US won't be able to dodge it.
 
apart from extended support is 5 years after those dates you given, but don't let facts get in the way. Oh and w10 is past those dates as long as you keep it upto date, with every new update it gets extended.
Vista was released 2006 and has just ended support.

The caveat is that they have to pay for the extended support no?
 
Fair play to whoever designed this. Credit due. Bit excessive targeting the NHS, whoever did this will get a lot of ££$$ and a decent job in chaos therum.
 
What are the chances that crypto currency will be under the microscope again given its the method of payment for this type of ransomware?
 
Fair play to whoever designed this. Credit due. Bit excessive targeting the NHS, whoever did this will get a lot of ££$$ and a decent job in chaos therum.

The purest capitalism - lots of profit for a few people at little or no cost to them.
 
Fair play to whoever designed this. Credit due. Bit excessive targeting the NHS, whoever did this will get a lot of ££$$ and a decent job in chaos therum.

I don't think it was intentionally targetted at anything other than large corporations by the nature of its design - I suspect a botnet or similar just sat there pushing emails, sniffing for vulnerable machines and exploiting backdoors if and when opened when infections were successful to push further malware and largely acting autonomously.

Person who designed it probably wasn't directly involved in deploying it these days - possibly people who are more of the "script kiddie" type were the ones who put it into action possibly after paying for it themselves.
 
Securing Web Infrastructure and supporting services Good Practice Guideline

4.2 Remove unneeded services/applications

If at all possible, each server in a production environment should host a single application or service only. Multiple purpose systems should not be used as it is often necessary to compromise on security controls due to the varied ways that such systems need to be accessed or the types of services which they provide need to be configured.

The following are indicative of services/applications which are found on a variety of OS’s. Any which are not required should be removed prior to placing the system in a production environment. If it is not possible to remove the service or application it should at the very least be disabled:

File and printer sharing services – e.g. Microsoft File and Print Sharing (NETBIOS), Server Message Block (SMB), Network File System (NFS), Samba Services, FTP, TFTP, RCP


Glad this is good practice, otherwise there could have been a lot more incidents.
 
Back
Top Bottom