NHS computer systems hacked!?

Rroff said:
Tons and tons and tons of home users are on unpatched or poorly patched Windows 7. As I mentioned before though this seems to have been crafted with at least some focus on getting into and infecting organisation's networks.

Possibly it has got in through that recent issue with attachments being able to deliver their payload without a user even opening the attachment which mostly affected corporate networks but I'm starting to think there is something about this infection that we haven't seen/are aware of yet as the way it has spread through businesses especially seems suspicious to me - I'm seriously starting to wonder if they have exploited a previously unknown vulnerability on the server class vPro CPUs which are less common in a home environment and its then leapfrogged from that.
Click to expand...

Indeed!
 
Rroff said:
Tons and tons and tons of home users are on unpatched or poorly patched Windows 7. As I mentioned before though this seems to have been crafted with at least some focus on getting into and infecting organisation's networks..
Click to expand...

It exploits a flaw in SMB used by the NSA, by its nature it isn't going to affect your Mothers PC as much as it would a corporate network.

Nate
 
Energize said:
Automatic updates and the fact that single users don't use windows xp.
Click to expand...

There are still loads of people using Windows XP - albeit its at 0.89% on say Steam hardware survey but that is still millions of users worldwide and often people on XP and 7 aren't using automatic updates - for awhile infact XP and 7 updates were stalled broken and anyone who hasn't applied the fix will not be getting new updates since about 18 months ago or so.
 
Nate--IRL-- said:
It exploits a flaw in SMB used by the NSA, by its nature it isn't going to affect your Mothers PC as much as it would a corporate network.

Nate
Click to expand...

It still has to get a foot in the door - which would have around equal chance of happening ostensibly for the overall collection of home users versus overall collection of enterprise ignoring the number of machines involved in each. Other "scattershot" attacks have seen far higher volume of non-corporate systems compromised in comparison to what we see here just comparing 1 home user to 1 corporate compromised as a whole.
 
Rroff said:
It still has to get a foot in the door - which would have around equal chance of happening ostensibly for the overall collection of home users versus overall collection of enterprise ignoring the number of machines involved in each. Other "scattershot" attacks have seen far higher volume of non-corporate systems compromised in comparison to what we see here just comparing 1 home user to 1 corporate compromised as a whole.
Click to expand...

You misunderstand the problem. It isn't the initial infection that is the problem, it is that once one PC is infected, it can worm its way though the entire connected networks to infect all hosts with a network cable in them. This in turn can then infect other networks (given lax security) and it can spread..

Nate
 
Rroff said:
There are still loads of people using Windows XP - albeit its at 0.89% on say Steam hardware survey but that is still millions of users worldwide and often people on XP and 7 aren't using automatic updates - for awhile infact XP and 7 updates were stalled broken and anyone who hasn't applied the fix will not be getting new updates since about 18 months ago or so.
Click to expand...

In addition to that, anyone who cares about security and privacy won't be using automatic updates because last year MS made it impossible to get automatic security updates for 7 without also installing whatever malware MS decide to push at their users. You have to patch manually. In addition, MS patches have become notoriously crap and many people delay them until they find out what's broken by new patches. Something often is.
 
Nate--IRL-- said:
You misunderstand the problem. It isn't the initial infection that is the problem, it is that once one PC is infected, it can worm its way though the entire connected networks to infect all hosts with a network cable in them. This in turn can then infect other networks (given lax security) and it can spread..

Nate
Click to expand...

Not misunderstanding anything. In other ransomware attacks for one corporation hit - no matter how many machines internally are compromised, there would be a number of home users also hit, so far with this one there has been a very low number of reported home user infections which is a bit unusual and suggests that the foot in the door mechanism isn't fully understood yet.

SMB (EternalBlue) and the internal RDP looping, etc. is irrelevant to what I'm saying here.
 
Rroff said:
Not misunderstanding anything. In other ransomware attacks for one corporation hit - no matter how many machines internally are compromised, there would be a number of home users also hit, so far with this one there has been a very low number of reported home user infections which is a bit unusual and suggests that the foot in the door mechanism isn't fully understood yet.

SMB (EternalBlue) and the internal RDP looping, etc. is irrelevant to what I'm saying here.
Click to expand...

What is the Ratio of Home users to Corporate users infected then? I'm not being glib but the extent is not known so far to be able to state such as fact.

Nate
 
There's 31 pages of replies so someone may have mentioned this already, but, surely with proper policies set absolutely no XP machine in a corporate environment should have contracted a virus?
 
This strain of malware seems to have very specifically targeted masses of corporate email address's hence the little/no reports of home users, had they sent them to hotmail/gmail users etc they would most likely have found there smtp servers on a blacklist very quickly.
 
Nate--IRL-- said:
What is the Ratio of Home users to Corporate users infected then? I'm not being glib but the extent is not known so far to be able to state such as fact.

Nate
Click to expand...

Don't have exact figures but I've been following those that are monitoring it like malwaretech that have published lots of data.

Cuchulain said:
There's 31 pages of replies so someone may have mentioned this already, but, surely with proper policies set absolutely no XP machine in a corporate environment should have contracted a virus?
Click to expand...

There is no way to fully protect against i.e. previously undiscovered way to inject code via a vulnerability in a signed driver, etc.

LizardKing said:
This strain of malware seems to have very specifically targeted masses of corporate email address's hence the little/no reports of home users, had they sent them to hotmail/gmail users etc they would most likely have found there smtp servers on a blacklist very quickly.
Click to expand...

Its possible it is as simple as that but something doesn't add up to me instinctively. It seems to have gone impossibly far impossibly fast to depend on the odd person opening an attachment in a business even with its possibly unprecedented ability to quickly spread internally on a network - I mean it is less than a month or so since the NSA tools used were leaked.
 
Last edited:
Cuchulain said:
There's 31 pages of replies so someone may have mentioned this already, but, surely with proper policies set absolutely no XP machine in a corporate environment should have contracted a virus?
Click to expand...
They would need to be on a totally air gapped network to have avoided the infection, off the top of my head most guidlines suggest xp machines must not have internet/emails, unfortunately this is not enough in this instance.
 
Regarding the Russian stuff earlier - looks like the latest info shows massively more infections in Russian organisations than any other country or demographic which is interesting - as someone said tends to indicate it doesn't originate in Russia as they'd be very unlikely to risk messing with the FSB lol.
 
Looks like the NHS saga has now affected me personally. Looks like my outpatients dept is still broken so have had my appointment tomorrow cancelled. T
hats the 2nd cancellation in two weeks. Hope the meds that I'm on that aren't working aren't also doing any damage.

I know, a bit woe is me
 
You must log in or register to reply here.
Back
Top Bottom