Hacker News Reader

Hacker News

Comment by jgrahamc | Hacker News Reader

Parent Full thread

jgrahamc

Friend of mine who works for the NHS sent me the following email:

All of NHS PCs and hospital systems have gone down from a ransomware trojan!

I have a full clinic this afternoon, and no way to look at my patients' histories, or meds. It's a damned disgrace.‎

The Trojan is demanding some bitcoins be paid, else they'll lose the boxen.

The entire NHS is penetrated.

I can't vouch for "the entire NHS is penetrated"

View on HN

Telefonica (the largest telecom operator in Spain) is having the same issue. There are a few thousands of workers that are not working; it's a disaster!

Same in Portugal (confirmed to be affecting PT, one of the biggest telecom companies, and EDP, the biggest electricity company)

https://www.publico.pt/2017/05/12/tecnologia/noticia/ataque-...

I don't mean to be dramatic here folks, but multiple coordinated infrastructure attacks are a form of warfare. This is literally shaping the battle space. Correlation is not causation and all that, but while people are standing around comparing their knowledge of how to deploy zero-day exploits and which isms it would be satisfying to blame during some future retrospective, the systems we depend on are being actively compromised.

hmmm... that doesn't sound like a 'cyber attack' as much as it sounds like 'getting owned by a trojan'

From my knowledge of NHS IT, it is reasonably hard at the perimeter but with a very soft chewy unprotected centre. I am not surprised this went round like Billy-O once inside.

A 'coordinated' attack apparently unless it is a very agile worm, lots of disparate unconnected levels being hit - such as GP surgeries (local clinics) to large hospitals A&E (ER). The common factor being the widescale abuse of @nhs.net as the email provider for all. Local GPs not meant to be using it at all.

What is the reason local GPs are not meant to use NHS.net email? I work in the sector and I thought it was policy to have them use it as the approved platform to securely communicate with secondary care.

GPs absolutely do use nhs.net; that's how they communicate. It's supposed to be secure enough to send medical records. If you go for a blood test or something, that's how the results come back.

It's apparently using the leaked NSA SMB exploits, so once it hits their internal networks any systems which aren't patched are probably going to get exploited pretty much instantly.

What makes you think GPs are not allowed to use nhs.net email?

https://s3-eu-west-1.amazonaws.com/comms-mat/Comms-Archive/J...

> A nominated Local Organisation Administrator (LOA). For primary care organisations, specifically GP practices, pharmacies, optometrists and dentists this is provided by NHS England Area Teams. Where appropriate, Department Administrators may be nominated.

Not necessarily a coordinated attack, it could be a technique which is exploiting some weakness in security practices and they happen to have hit on these systems.

'Cyberattack' seems to be the latest buzzword that tech journalists like to use. I'll agree that all the information I've seen points at this being a regular trojan rather than some targeted hacking. Will be interesting to see how it started.

Maybe targeted emails with attachments?

Sometimes I wonder how much of the economic activity in bitcoin is generated by ransomware.

I'm pretty sure it is a really good chunk. Probably only trumped by drug deals.

Wow that sounds bad.

Reply on news.ycombinator.com