Hacker News Reader

Comment by lol768 | Hacker News Reader

Shutting everything down seems like a really rash response, especially when these systems seem to be used for critical communication e.g. the phones too. The Twitter messages seem to suggest that doctors are seeing this on their personal machines, but why would this impact the phone system? Are they not separated out?

I'm also really curious as to how this started. The article mentions a "bug" in the IT systems - some sort of novel zero day in the software they're using that was exploited remotely? Or is it more likely someone screwed up and ran something without thinking?

Edit: There are reports on twitter that this is impacting X-rays, pagers as well as the phone system. This is ridiculous if true and suggests there have been some major failings when putting this infrastructure in place.

View on HN

>There are reports on twitter that this is impacting X-rays, pagers as well as the phone system. This is ridiculous if true and suggests there have been some major failings when putting this infrastructure in place.

Take a look at that operating system and the UI from the article and tell me how that's unexpected.

That will be stock photography, rather than taken today.

It is still accurate. We still have XP machines floating around our campus. They are running EMR software.

Christ. There is no excuse for that whatsoever. A live machine?

If the software doesn't run on versions higher than XP, then there's no alternative. There's a lot of expensive equipment which is stuck on XP.

Virtual machines are a thing.

How does that help? We're talking about devices that need, for whatever driver-related reason, to run on the bare metal.

A non-health example: http://www.effectivebits.net/2011/08/to-run-windows-or-not-t...

And medical devices cannot just be modified after they are approved for medical use. Any changes must be introduced by the original vendor (or an approved 3rd party vendor) and put through a barrage of tests and certifications needed to release such a device for use on a human. Those include EMC/EMI testing, QC testing, safety testing, RF testing, clinical trials, regulatory compliance, etc.

When you buy a medical device running Windows 3.1, it will run that until it is thrown away or replaced.

>There is no excuse for that whatsoever.

Except for budget and non-technical leadership in technical leadership roles

Are they paying Microsoft for extended support?

Yes. NHS has a national level support agreement for XP. There are a lot of legacy systems and it's not just the bother of replacing the system, there are a lot of front line staff who only know how to use specific applications and are not generally computer literate so moving them to new systems will slow everything down for weeks or months as they learn a new application.

What does this cover provide? Any ideas? I assume every customer is different?

I'm not sure which article you were referencing, but the pictures in the Guardian piece clearly show Windows 7.

If it's hitting everything it seems like it's just forking everywhere. For it to do that there must be some _really_ bad security practices

How on earth could an X-ray machine be affected? Why the hell does the NHS have an X-ray connected to the Internet?

It's hopefully not connected to the internet, but to the local network. Many medical appliances in hospitals expose remote control over regular tcp/ip, Preferably running Windows XP or CE.

I wasn't seriously suggesting it was directly connected, but my understanding (and I am far from knowledgeable when it comes to security) is that mission-critical devices should be physically 'firewalled' from the Internet, and even any network.

If you do that, how do the images get from the x-ray machine to the radiologist for analysis? How do they end up as part of the electronic health record & accessible for future use? If you create an air gap and ask people to use USB sticks to move data from "mission-critical" systems to the main network, you only slightly reduce the risk of those systems becoming infected and you now have a situation that's much less convenient (time is money) and creates a new vector for leaking personal health information.

They should be; but security in government organisations is pretty bad. They are heavy on security on it, but in completely ineffectual areas.

Reply on news.ycombinator.com