NHS computer systems hacked!?

FutileBreadMachine said:
I was working there at the end of last year on a contract when someone in support sent a test email to a new Outlook distribution group which they had accidentally added pretty much the entire NHS staff mailing list to. Then people started doing "Reply All" to the message saying things like "Please remove me from this group"/"You sent me this in error" and this multiplied out into millions(?) of emails and brought the entire NHS email system to a halt. It even ended up on the BBC and I believe The Sun even named the support person who sent the initial email.
Click to expand...
I worked there for just over 6 years in different trusts, some of the things you see are shocking.
Rroff said:
Previously they've been less sophisticated and not utilised capabilities like SMB to break out from the initial infection - as I've been saying in some of the threads slowly these are being packaged up with more sophisticated tools and increasingly there is attention being paid to things like infecting IoT devices or hiding copies of it away in device firmware (for instance NAS boxes) to reactivate at a later date when people think the infection has gone, etc. I'm not quite sure at what level and on what timeframe that kind of stuff is making its way into the wild.
Click to expand...

I agree, I still think this was sat there waiting to be triggered, similar to what you said earlier, embedded with some form of hardware maybe, this came in from the N3 spine from what i have read, caged above has supplied some great links also.

There are 1.5 million plus people working in the NHS, if this was just a simple click on a wrong\dodgy email then it would happen everyday.
 
Last edited:
Rroff said:
AFAIK current infections are stalled due to the "killswitch". The NHS has had people working through the weekend quarantineing and cleaning systems so there shouldn't be any mass event from people turning them on.
Click to expand...
Ah yes, i forgot about that :)
 
Arazi said:
I worked there for just over 6 years in different trusts, some of the things you see are shocking.

I still think this was sat there waiting to be triggered, similar to what Rroff said earlier, embedded with some form of hardware maybe, this came in from the N3 spine from what i have read, caged above has supplied some great links also.

There are 1.5 million plus people working in the NHS, if this was just a simple click on a wrong\dodgy email then it would happen everyday.
Click to expand...

It is kind of strange - the way it suddenly burst out world wide doesn't fit any normal propagation pattern even for an aggressive worm and doesn't seem to have the normal patterns in relation to timezones, etc. which does suggest it has been loitering undetected waiting for some kind of trigger or something very odd going on. The pattern of updates on the live map also kind of suggests people turning infected systems on for the first time post some kind of triggering event rather than new infections (though that is largely just a guess based on instinct).
 
Rroff said:
It is kind of strange - the way it suddenly burst out world wide doesn't fit any normal propagation pattern even for an aggressive worm and doesn't seem to have the normal patterns in relation to timezones, etc. which does suggest it has been loitering undetected waiting for some kind of trigger or something very odd going on. The pattern of updates on the live map also kind of suggests people turning infected systems on for the first time post some kind of triggering event rather than new infections.
Click to expand...
I wonder if it could have been hidden in PLC's up and down the UK and elsewhere in the world, then triggered by whoever had the access.
 
Arazi said:
I wonder if it could have been hidden in PLC's up and down the UK and elsewhere in the world, then triggered by whoever had the access.
Click to expand...
maybe. im sure i've read of these types of malware having a scheduled activation.

would explain why so many different organisations were effected at the same time.
 
V F said:
Do tell!
Click to expand...

My brother does IT contracting for the NHS and previously worked at a high level in IT at the NHS - have to be a bit careful though I don't want to get him into any trouble heh relaying some of the same kind of stories as Arazi could probably tell.
 
Rroff said:
It is kind of strange - the way it suddenly burst out world wide doesn't fit any normal propagation pattern even for an aggressive worm and doesn't seem to have the normal patterns in relation to timezones, etc. which does suggest it has been loitering undetected waiting for some kind of trigger or something very odd going on. The pattern of updates on the live map also kind of suggests people turning infected systems on for the first time post some kind of triggering event rather than new infections (though that is largely just a guess based on instinct).
Click to expand...
Fully agree, also, now that the killswitch has been broadcast worldwide then it is surely easier now for someone to change the domain to a different one and off we go again.
 
Rroff said:
My brother does IT contracting for the NHS and previously worked at a high level in IT at the NHS - have to be a bit careful though I don't want to get him into any trouble heh relaying some of the same kind of stories as Arazi could probably tell.
Click to expand...
He will deffo know where im coming from :)
 
Arazi said:
Fully agree, also, now that the killswitch has been broadcast worldwide then it is surely easier now for someone to change the domain to a different one and off we go again.
Click to expand...

Its given time for systems to be patched against the SMB exploit (though I suspect a lot aren't) but it just shows how vulnerable business networks are to these things if better measures aren't taken - the next one could find an even nastier way to spreading.
 
You must log in or register to reply here.
Back
Top Bottom