NHS computer systems hacked!?

Unfortunately, there is an excuse. Those are often crazy expensive machines and there is nothing wrong with the data they produce or fetch other than age of the OS. It's easy to say air gap them or take them off the network when the money spent on them, or worse, the iron clad contract clauses demanding other earthly penalties they were surrounded with back in a day won't allow for retirement. I kid you not - there are places out there, where to this day you will find old Elonex or DEC boxes running Windows on Novell, with DOS window open fetching data to lotus symphony spreadsheets off serial port equipped Reuters APMs hooked up to ISDN lines. And some commodity markets would probably collapse the next day if those things were discontinued while the only way to air gap them would be to create daisy chain of students feeding and moving floppy drives with every cycle of the batch script. Vast lists of telecom and satellite equipment both on earth and in heavens with no viable or barely any data encryption possible operated day to day with equipment and systems so old that it's scary. And they have to be, in a massive simplification, accessible over the net. Obviously, in most cases they benefit from slightly better IT than the underpaid glorified janitors that populate NHS basements, but the point still stands - this isn't fault of people forced to operate and rely on those machines and OSes - I blame Microsoft and Microsoft alone. And I hope someone shakes that tree to the roots.

What does any of that have to do with the NHS? These machines can be air gapped, we did that to our kit before replacing (and yes I'm talking NHS here, not fantasy land).
 
The malware was made available online on 14 April through a dump by a group called Shadow Brokers, which claimed last year to have stolen a cache of “cyber weapons” from the National Security Agency.
Microsoft coding error -or- intentional NSA required BackDoor?
 
Contracts and maintenance agreements are not much use when a company who supplied you with rock solid and great performing software 5, 8, 10, 15 years a go closes down or gets bought out by another company. Capita couldn't care less what OS or how old the software is, if you're not going to pay them the £££ for the software to be rewritten or upgraded, especially if it's a public sector organisation and they automatically add 30%.
 
it doesn't - but whether there is some hardware involved or not the point is still the same re: maintenance contracts and upgrades

Which is great until the company you bought the equipment goes out of business/gets bought out etc...(which hardly an unlikely scenario over 10-20 years) Then you end up with a doctor under the desk trying to solder a USB cable onto a serial connector so they can keep using the equipment :p.

Of course the last sentence was completely tongue-in-cheek, but you still end up with massive costs having to get people in to reverse engineer the equipment and figure out how to build some kind of converter so that the machine with the legacy connector which no longer exists can still connect to and work on a modern operating system. All of this on a budget which is already inadequate.
 
Precisely. THey'll bend you over a barrel. For a while uk.gov could pay for extended XP support, but I believe that stopped some while back, or they hiked the price to ridiculous $$$. Probably because government licensing is woeful.
 
because companies would keep it upto date as there is now a law which punishes them.

This is a terrible idea and will lead to things being less secure, not more secure.

Installing updates is a costly process so if companies are forced to install all new updates then they will put a huge amount of pressure on the vendors not to release so many updates. Anything which isn't considered a critical issue will be left and a patch wont be released until a critical issue is discovered and they can issue an update with all the minor bug fixes bundled into it.
 
Who mentioned Crapita?
Pub sector always over paid. Back in 2006 worked with one who paid MORE than double the retail price for PC's and extortionate prices for replacement hard disks because of contract they stupidly signed up to. Hate to say it but private companies would keep eye on costs, do wonder if some of the public sector would be better privatised! Too often in public sector the thought is 'its not my money', hence such poor contracts are signed up to.
 
Last edited:
Who mentioned Crapita?
Pub sector always over paid. Back in 2006 worked with one who paid MORE than double the retail price for PC's and extortionate prices for replacement hard disks because of contract they stupidly signed up to. Hate to say it but private companies would keep eye on costs, do wonder if some of them better privatised! Too often in public sector the thought us 'its not my miney'

You mean the private company selling those PCs to the public sector for double the retail price ripped them, and us the taxpayers, off?

I have no idea why public sector procurement across the board (Govt, MOD etc) is always so appalling, but I think the private firm ripping them off should shoulder more of the finger pointing on this one.
 
You mean the private company selling those PCs to the public sector for double the retail price ripped them, and us the taxpayers, off?

I have no idea why public sector procurement across the board (Govt, MOD etc) is always so appalling, but I think the private firm ripping them off should shoulder more of the finger pointing on this one.

Disagree. The corrupt politicians who sign off on those terrible contracts because they get a back-hander from the private company are the real "criminals"
 
Which is great until the company you bought the equipment goes out of business/gets bought out etc...(which hardly an unlikely scenario over 10-20 years) Then you end up with a doctor under the desk trying to solder a USB cable onto a serial connector so they can keep using the equipment :p.

Of course the last sentence was completely tongue-in-cheek, but you still end up with massive costs having to get people in to reverse engineer the equipment and figure out how to build some kind of converter so that the machine with the legacy connector which no longer exists can still connect to and work on a modern operating system. All of this on a budget which is already inadequate.

Have you got some examples of this happening? Is it a common occurrence?

I'd assumed most medical equipment manufacturers were rather large companies. If you're paying for millions of pounds worth of MRI equipment or whatever then presumably these aren't small companies?
 
Disagree. The corrupt politicians who sign off on those terrible contracts because they get a back-hander from the private company are the real "criminals"

That is the supposition, yes, but is there any proof?

And also, just because you can rip someone off, doesn't mean you should
 
Or use Macrium or other software to backup your system daily, keep as many revisions a large hard disk can hold, once the disk fills up the oldest backup is deleted.

Password protect the back-ups.

If the thing sits dormant for x time wouldbt it be included in potentaly days/wreks/months of vack ups?
 
Have you got some examples of this happening? Is it a common occurrence?

I'd assumed most medical equipment manufacturers were rather large companies. If you're paying for millions of pounds worth of MRI equipment or whatever then presumably these aren't small companies?

I'd guess people wouldn't be that open about talking about these things.

Are you just making things up now?

Are you totally naive?
 
Have you got some examples of this happening? Is it a common occurrence?

I don't have examples in terms of medical equipment as I've never worked in that sector, but I've already posted an example I've experienced with a building management system. No idea if it's a regular occurrence, but it's certainly a possibility.

Are you just making things up now?

Again, no idea about the medical sector, but I've worked in a large public organisation in another sector, where my recommendation of supplier has been ignored by the higher ups and a far worse contract with another (the same every time) supplier been accepted for undisclosed "reasons" on several renewals.

Maybe there was a perfectly legitimate reason for it (which for some reason no one else was allowed to know), or perhaps it was dodgy, but only ever happened in the organisation I worked in and nowhere else... Who knows? ;)

Edit: sorry, corrupt "politicians" was a little too specific, replace that with "government officials/high up civil servants/managers etc"
 
Last edited:
Legacy machines that need access to the network - fair enough, but firewall them from the WWW!
 
Legacy machines that need access to the network - fair enough, but firewall them from the WWW!
it could have down the N3 line linking NHS sites not from the internet. point of infection may not have even started on a legacy machine. could have been a personal laptop that was bought in etc etc.
 
I don't have examples in terms of medical equipment as I've never worked in that sector, but I've already posted an example I've experienced with a building management system. No idea if it's a regular occurrence, but it's certainly a possibility.

Seems rather unlikely though for particularly expensive equipment that can't be easily replace tbh... ergo I'll go back to my comment re: maintenance/upgrades.
 
Back
Top Bottom