NHS computer systems hacked!?

[Mynight]

Yeah I thought that was rather unfair. Sometimes journalism goes too far.


Apparently the NK links are rather fragile. Just 2 functions being replicated. Which to be honest could have been done on purpose to point the finger.

 

[Diagro]

The papers are ass hats for doing what they did.... Really is pathetic.

In terms of the malware... people need to stop downloading obviously sus email attachments... then this wouldnt happen.

We had a virus of this type at the school I used to be an IT tech at... IT ate into stuff.
We had backups though.. 48 hours later we were clean and back up and running.

If a school can do it.. why cant the NHS?

 

[MikeTheNative]

We managed to get a ransonware virus onto our shared drive a few years ago in work, lady in admin opened a dodgy attachment. Computers were backed up so only lost half a days work in the end. But there's not much you can do against people opening obviously dodgy emails.

 

[Rroff]

But there's not much you can do against people opening obviously dodgy emails

I find the worst offenders have a resistance to learning as well - often older people who for some reason (not just scared of doing something wrong) are very anti having to learn more about computers than they are forced to even when it is their job (and often the type that don't learn from their mistakes).

Does my head in trying to deal with them.

 

[MikeTheNative]

I find the worst offenders have a resistance to learning as well - often older people who for some reason (not just scared of doing something wrong) are very anti having to learn more about computers than they are forced to even when it is their job (and often the type that don't learn from their mistakes).

Does my head in trying to deal with them.

100% this, 'does my head in', is the exact phrase I use too. A number of older folk have the 'it's a computer so too complicated' outlook and as you said there's nothing you can do as they are set against trying to bother to learn.

 

[dr_volki]

100% this, 'does my head in', is the exact phrase I use too. A number of older folk have the 'it's a computer so too complicated' outlook and as you said there's nothing you can do as they are set against trying to bother to learn.

wish you could sack people for this, we have quite a few of these here at work.

 

[leemk]

Where i work , i had a look at what emails the goods in clerks get sent from all over europe.
Loads of attachments for delivery details , ones that contained xl docs , word docs , zip files , links to the websites they use.
The same supplier can send any of the above depending on whos sending the info .
All of them are opened , touch wood nothing bads happened yet (Thats IT's mentality not mine).

 

[lurkio]

Funny that Microsoft had a patch for this in Feb this year for ALL systems inc Xp, 2003 server etc
but didnt release them

http://www.theregister.co.uk/2017/05/16/microsoft_stockpiling_flaws_too/

 

[leemk]

Where i work , i had a look at what emails the goods in clerks get sent from all over europe.
Loads of attachments for delivery details , ones that contained xl docs , word docs , zip files , links to the websites they use.
The same supplier can send any of the above depending on whos sending the info .
All of them are opened , touch wood nothing bads happened yet (Thats IT's mentality not mine).

 

[Rroff]

Funny that Microsoft had a patch for this in Feb this year for ALL systems inc Xp, 2003 server etc
but didnt release them

http://www.theregister.co.uk/2017/05/16/microsoft_stockpiling_flaws_too/

Would need a bit more verification (though I suspect it is correct) MS fudges the dates on some driver and windows patches to ensure they get used correctly in a variety of scenarios i.e. the reason a lot of MS drivers are dated exactly 21st of June 2006 regardless of when they are actually built and signed.

 

[V F]

Funny that Microsoft had a patch for this in Feb this year for ALL systems inc Xp, 2003 server etc
but didnt release them

http://www.theregister.co.uk/2017/05/16/microsoft_stockpiling_flaws_too/

The idea was that a year would give NHS trusts time to manage their upgrades and get modern operating systems, but instead it seems some trusts preferred to spend the money not on IT upgrades but on executive remuneration, nicer offices, and occasionally patient care. Defence Secretary Michael Fallon claimed on Sunday that "less than five per cent of [NHS] trusts" still use Windows XP.

Lovely.

 

[Rroff]

Lovely.

If people knew some of what really went on it would eclipse the furore over MP's expenses I suspect.

 

[V F]

Heh, I'm not surprised.

 

[mysticsniper]

Where i work , i had a look at what emails the goods in clerks get sent from all over europe.
Loads of attachments for delivery details , ones that contained xl docs , word docs , zip files , links to the websites they use.
The same supplier can send any of the above depending on whos sending the info .
All of them are opened , touch wood nothing bads happened yet (Thats IT's mentality not mine).

This only spreads via SMB. e.g. there is no initial phishing/malvertising vector - only organisations with a port 445 gap in perimeter defences would get infected and only those with CIFS/SMB1 and without the MS patches would continue to be infected.

 

[Rroff]

This only spreads via SMB. e.g. there is no initial phishing/malvertising vector - only organisations with a port 445 gap in perimeter defences would get infected and only those with CIFS/SMB1 and without the MS patches would continue to be infected.

https://twitter.com/calebbarlow/status/864232713863213056

That is kind of damning - however I refuse to believe this is purely down to some companies having port 445 exposed.

(Also covers that stuff I was talking about before where very low numbers of infections are seen with private individuals, etc.).

To quote someone else who summarised what was said in the interview:

just heard first sensible media interview on the topic - guy from IBM ~7:45 on r4 today
- they do not undertand how phishing/patient-zero was achieved, and no big trail of emails in sample they take
- absence of private individuals attacked
- low ransom demand - corp customers usually attract >$10k$ and 50% pay
- quick deployment in organisations too

read another article on jpg ransomware attacks via facebook I had not heard of,
since I still think, via image sharing sites, tha could be easiest vector for OC user infection, say.
(edit: I do not mean using jpg for ransomware, that is not new - the fact it got through any pre-filtering that I thought FB or other image sites employed)

 

[datalol-jack]

I could not resist...






And on that halcyon note, I'm out with my coat, smirk and diskette!

 

[CHokKA]

https://twitter.com/calebbarlow/status/864232713863213056

That is kind of damning - however I refuse to believe this is purely down to some companies having port 445 exposed.

(Also covers that stuff I was talking about before where very low numbers of infections are seen with private individuals, etc.).

To quote someone else who summarised what was said in the interview:

If you read https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html and pay particular attention to the part where he analyses the outgoing connections, you can sort of piece together that all it would have taken is for one single PC, anywhere in the world with internet access, to start the spread of this globally, because the malware itself seems to have a pre-determined list of external IP addresses that are vulnerable on port 445. Some research definitely went into where the payload could be delivered prior to the triggering of this attack.

 

[Rroff]

If you read https://www.malwaretech.com/2017/05/how-to-accidentally-stop-a-global-cyber-attacks.html and pay particular attention to the part where he analyses the outgoing connections, you can sort of piece together that all it would have taken is for one single PC, anywhere in the world with internet access, to start the spread of this globally, because the malware itself seems to have a pre-determined list of external IP addresses that are vulnerable on port 445. Some research definitely went into where the payload could be delivered prior to the triggering of this attack.

Yeah but that doesn't explain the scale of it alone - some of the places hit almost certainly didn't have port 445 exposed. It seems like each infection also just started randomly scanning on port 445 to try and further spread it - but again many of these organisations even with relatively vulnerable systems have port 445/SMB hard locked down at their gateway. (In some cases there might have been vulnerabilities via personal devices that had both network access and their own internet connection but that is not uniformly the case).

 

[Arazi]

I think part of the problem is we are still emerging from the initial age of this scale of technology in industry and those nearer the top of companies that are calling the shots on forward strategies just have no idea or insight into the technology and the realities of how that works going forward and those below them tend to look to those people for direction going forward resulting in a disconnect there in thinking (obviously some companies do have tech people at very high levels with more clout, etc.).

You could almost say this was inevitable in the progression of technology.

I think you've hit the nail on the head there, 100% agree

Aye

 

[stockhausen]

<SNIP> But there's not much you can do against people opening obviously dodgy emails.

Is there something you can do about people opening seemingly legit emails then?

I only ask because I have seen some VERY plausible looking SCAM/Phishing emails; there was a reference to one in this very thread.

I have had any number of emails, seemingly from people I know well, whose email contact lists had been hacked. I even had one that referred to a skiing holiday I had been on with one of them. People need to be INCREDIBLY cautious where emails are concerned. If there is an attachment and the emails looks less than 100% genuine, I frequently contact the "sender" to confirm that it was really they who sent it - after looking carefully at the "Reply to" address.