This doesn't appear to be a data heist. The hospital claimed no digital patient records were taken from its computers, just made inaccessible.
Oh, so these were honest criminals?
I'm sorry but a company that is so careless as to allow themselves to be hacked via Remote Desktop Protocol should not be taken at their word.
It was most likely an automated attack rather than targetted anyway, we all know that. The Reg is just turning it into some really crappy hollywood spin.
Realistically as they apparently can't secure RDP they also don't have proper network tools in operation - so won't be able to say for sure if data was leaked because they probably had nothing monitoring incoming/outgoing traffic and volume.
Based on the technical expertise shown up to this point, I doubt that they are capable of knowing if that is the case or not.
Clearly they had never actually tested back up and restore procedures and probably not even followed them. Don't bother backing up if you haven't ever tested you can restore from a back up!
If you choose to be prey then you encourage the existence of predators to the detriment of everyone.
Choosing to be prey is not taking preparatory steps to avoid being taken advantage of as well as the immediate surrendering of value to predators.
A Hospital holding up their patients to defend themselves from the righteous criticism of their behaviour is deplorable.
Agreed completely. If no-one in the history of humankind had ever paid up kidnapping, extortion and blackmail would be of purely academic curiosity. Not only are those paying up rewarding criminals for their actions they are also encouraging them to go for another victim.
Criminals only do it because it's profitable.
With bitcoin pricing the way it is, 4 btc was $62,000 when they paid, it's now (Wednesday morning) $44,000.
I sort-of hope the baddies didn't cash out.
I wonder why the authorities don't kill this sort of crime by preventing use of the payment method. Is following the chain too slow?
"I wonder why the authorities don't kill this sort of crime by preventing use of the payment method. Is following the chain too slow?"
Good question . durisdiction maybe? I know we can see the wallets in question , so in theory a country could pass laws to all exchanges that certain Wallets contain "proceeds-of-crime" coins and to act accordingly... That would have various people up in arms about snooping I guess.
Also I suppose that until they come to cash out - it *is* fairly anonymouse , and if they spend those coins without visiting an exchange ... they get spread around like real dirty cash would ... it all becomes a muddy mess and criminal is effectivly untraceable?
disclaimer - All of the above is my own wild uninformed speculation, and may well be incorrect.
One approach to enforce money laundering law might be for Interpol to maintain a real time contaminated list of keys blocked from cashing out based on reported crime by a member organisation - or an exchange which receives contaminated coins is fined the cash amount paid plus 10% by money laundering legislation. Any payment within the blockchain from a contaminated key contaminates the key which accepts the payment until the blockchain records a reversal of that payment.
Good idea, but the poster above you highlighted the loophole. If they were never exchanged for cash on an exchange, no one really know what happened.
The real hacker can still cashed in through other means (like physical cash) and sent the coin to the trader address. At worst, a few tens of thousands unlucky people will get fined without knowing since coins are 'sent' like a gift. Those people would only know they have contaminated coins after receiving it. Not to mention if the traders inter-traded the coins, then everyone will now have connection to the contaminated coins. This is the reason crypto currency do have some anonymity.
The criminals broke in around 9.30pm on January 11 after finding a box with an exploitable Remote Desktop Protocol (RDP) server, and inject their ransomware into connected computers.
Sounds like they haven't tested their backups before, hmmmm.
You may think that you have the best backup policy in the world but if you haven't tested it then you would be wrong. All you have is a piece of paper.
Not quite sure if people will believe that statement.
Physicians, Business Impact Analysis thyselves!
It's not just about backups. It's also sensible permissions like not allowing old fixed documents to be trashed. Also versioning file-systems (such as ZFS). Mostly common sense.
They could get their data back from backups without any loss. The meets the Recovery Point Objective.
They couldn't get it back in time to continue normal operation though. So was their Recovery Time Objective wrong (of course everyone can wait a week, I don't want to pay extra to get it back in 2 hours!) or was the recovery procedure unable to meet the RTO? Which if it is a supplier could result in a claim?
Living here almost 13 years, with ~8 family visits to the same hospital (inpatient and outpatient, including births of all our kids), this has been the only time the computers were completely "down" as opposed to the usual "slow". I feared the subject of the article would be said local hospital -- which would have explained the outage -- but I am also relieved it is not.
Sorry, Indiana. Your problem, not mine.
"Sorry, Indiana. Your problem, not mine."
Are you sure? Did they explain the outage, with proof?
Wednesday 17th January 2018 15:42 GMT Potemkine!
... this hospital can expect to be heavily under attack. Because they let RDP servers in the wild, one can suppose there are other major vulnerabilities to be exploited.
Paying the ransom is like screaming "please attack me again!"
So, how about organ transplants?
"Yes, we know it's a bad idea, but we were running out of kidney donors, so we made the conscious decision to buy a few from the black market. After all, it saved patients' lives!"
Find out who the hackers are and double their health insurance premiums.
would be nice to know if it was cheaper to pay the ransom than staff time to restore then test the restoration.
A tech is ~ $300 usd per day 10 techs = $3k plus costs for other hospital staff taking longer to do stuff plus outside consultants plus fbi time.
If the ransomware is priced right and reputable for handing over the keys then paying suddenly becomes a cost effective reasonable option.
Probably one not looked into in depth until it happens to you.
The first one's always cheap.