Hacker News Reader

Comment by kaoD | Hacker News Reader

According to Spain's CCN-CERT it's spreading through a remote code execution vulnerability in Windows' SMB Server, affecting pretty much all versions of Windows.

https://www.ccn-cert.cni.es/seguridad-al-dia/comunicados-ccn...

https://technet.microsoft.com/en-us/library/security/ms17-01...

IIUC the security updates have been available since March. I can understand bureaucratic entities having shitty security policies, but Telefónica? It's just... wow.

View on HN

SMB vulns courtesy of the NSA? As to shitty - how long do you think it takes reasonably to test these patches on thousands of servers? What no test on a critical health system?

It's literally as easy as installing a Windows update organization-wide. What is there to test? These aren't servers. These are workstations of common workers. Windows desktops mostly used for spreadsheets and playing solitaire.

I'd rather deploy a Windows update within 2 months of its release and be safe from a RCE vuln.

You have to test the patch against your images! You cannot simply roll out whatever shit Redmond send you down the pipe especially when they had to rush it out themselves due a tip off. That would be gross negligence what if there was some device attached to that workstation keeping someone's machine on? How would you know what that workstation is doing?

And isn't 2 months enough for that?

Also... images? :^) I think you're giving too much credit to the sysadmins in these organizations (and I talk from experience, can't say more).

You should know, of course, because the system was designed and this documentation is easily available and up to date.

> what if there was some device attached to that workstation keeping someone's machine on?

Then it shouldn't be connected to a non-secure network / the internet in the first place.

> workstations of common workers. Windows desktops mostly used for spreadsheets and playing solitaire

As a physician and researcher, this attitude from IT people is why you find physicians who don't like you.

Funny you should say that regarding attitude, doctor. One networking guy who used to work in a big hospital told me he hated working at the hospital because of the attitude of doctors there. Doctors with attitude of 'I'm god' really turned him off from working in the hospital setting.

No one in this thread claimed to be God. It's worth remembering that the whole point of Hospital IT is to facilitate the doctors' and administrators' work.

I wasn't referring to physicians, the NHS wasn't patient zero.

> What is there to test? These aren't servers.

Such hubris.

When I worked night shift in emergency dispatch, our base network ops center pushed out an update that took our phone workstations offline. The phones that receive installation 911 calls and communiques from the command post. With no warning or notification of such an update.

Their reasoning? "We didn't think anyone would need it at 0300"

There are parts of the NHS who specifically do not patch.

And hopefully they have well-designed and regularly audited firewalling and access control paradigms. There are good reliability reasons behind not just sucking down every patch, but it needs to be coupled with smart security work.

And in any case that doesn't seem to be the issue here, per reporting. It's not NHS's reliability-critical systems that are owned, it's all their PCs.

I'd hope so, too, but in what i've seen it generally isn't the case.

Which they use to communicate between staff. I was at a renal clinic this afternoon and the staff there couldn't check to see if my doctor wanted them to do some bloods - so I can go back onto the transplant list.

If I am unlucky this means I could miss out on a potential doner kidney due to the delay

Don't forget to glue the USB ports; yes all of them. No, IT will need to setup a PXE server.

Software monoculture roosters are coming home...

Reply on news.ycombinator.com