Ransomware, Data Breaches at Hospitals Tied to Uptick in Fatal Heart Attacks | Hacker News Reader

Ransomware, Data Breaches at Hospitals Tied to Uptick in Fatal Heart Attacks

krebsonsecurity.com

109 pointssandwall61 comments

This study may be biased toward smaller/rural/poorer locales.

In big-city Canada, patients with heart attack symptoms will usually have an ECG done by paramedics before arriving.

In the US, this has quite survival advantage.

https://heart.bmj.com/content/100/12/944

I don’t know if it’s standard practice to do another upon arrival, but it is redundant and should probably take a back seat to activating other processes that need to happen.

It also helps send them to the most appropriate facility.

So, don't ask me how I know this...

If you are having chest pain, call 911. If you mention "chest pain" to them, you hear a beep in the background, and everything else is a machine.

In my locale, the paramedics carry a portable EKG. If they decide to take you for a ride, they have an EKG machine in the ambulance that's networked to the hospital, and a cardiologist is now on your team. When you arrive, you get wheeled into a special room where an entire heart attack team is standing there, waiting for you.

At that point they do another EKG, and as I understand it, their machine has a larger number of electrodes, so they can get more detailed information from it. The patient is never off an EKG at this point, and it's not a discrete step, but is a continuous monitor.

A blood test will confirm the presence of an enzyme that's produced if the heart muscle is stressed. This is a rapid test, the lab is ready and waiting for the sample.

So, the second EKG isn't really consuming time, since other stuff is happening concurrently, and they need the EKG running continuously to make minute by minute decisions. Regardless of what happens, you're on the EKG until you go home.

I don't know if rural or poorer locations have less sophisticated processes.

If you are having chest pain, call 911.

Wow I had no idea they were linked in remotely. Thanks for sharing.

Is it possible that increased security after breaches is actually what's slowing down medical staff?

I doubt it. Desktop pc's in hospitals are usually just thin clients. Ransomware targets the client pc and implementing security at this level is not cumbersome.

from the article...

“Breach remediation efforts were associated with deterioration in timeliness of care and patient outcomes,” the authors found. “Remediation activity may introduce changes that delay, complicate or disrupt health IT and patient care processes.”

Without any arguments it's just data. Is a lack of spending on key infrastructure, tied to poorer outcomes something we can discuss? I'm not sure this is the best article to discuss the causes/mitigations.

There was one interesting data point, but no source of cause listed. >for care centers that experienced a breach, it took an additional 2.7 minutes for suspected heart attack patients to receive an electrocardiogram.

Is this while they were prevented from performing care? Thankfully PBS's article goes into more details

https://www.pbs.org/newshour/science/ransomware-and-other-da...

>hospitals that experienced a data breach, the death rate among heart attack patients increased in the months and years afterward. This increased mortality doesn’t appear to be due to the perpetrators themselves — the hackers are not controlling the allocation of medications or doctors. Rather the issue may lie with how health care systems adjust their cybersecurity after an attack

Which makes a much different argument: the hospital response to a Cybersecurity incident increases mortality (thus: can we expect a similar uptick in negative outcomes amongst healthcare organizations who implement similar security polices?)

Research paper: https://onlinelibrary.wiley.com/doi/full/10.1111/1475-6773.1...

The PBS article points out that security practices applied to clinicians led to this problem.

Do we have evidence that the hacking took advantage of the EMR's security issues?

>Time from door to ECG significantly increased after a breach and the elevated time to ECG persisted at 4 years after the breach. Security typically adds inconvenience by design—making it more inconvenient for the adversary. For example, stricter authentication methods, such as passwords with two‐factor authentication, are additional steps that slow down workflow in exchange for added security. Lost passwords and account lockouts are nuisances that may disrupt workflow. The persistence in the longer time to ECG suggests a permanent increase in time requirement due to stronger security measures.

So what compromise is possible to ensure fast login? Can two factor login be limited to new login devices? (Thus limiting impact to those working in new locations?)

Should EMR login be separated from local PC login within a hospital/emergency department? (Cold booting a PC and logging into windows would be the slowest response time).

Can we tie logins to employee badges to skip all password entry? (Lost badges would thus warrant reporting loss.)

> Can we tie logins to employee badges to skip all password entry? (Lost badges would thus warrant reporting loss.)

You can, but typically you'd use a badge with a PIN. If you use something like this[1] with virtual desktops (VDI) that don't terminate your session when you disconnect, you can get the "time to login" down to a few seconds, since it's the same RDP session following the user around.

[1] https://www.identityautomation.com/iam-platform/healthcare-c...

Most hospital PC's allow this as an alternative, also thumbprints.

We use: https://www.imprivata.com/

I'm not sure I buy the causal link between a small increase in door to ECG time and an increase in 30 day mortality (AFAIK, there's no other research explicitly linking those two stats). Door to reperfusion (or "door to balloon") time matters a lot, but the article doesn't mention those stats.

Possibly to get more data. Not everyone is coming in with a STEMI.

The solutions you propose are pretty much the norm already. PC logins are typically LDAP or AD however. ymmv whether your eme login is on the same domain as your pc login. For example, on Cerner emr they are typically separate but this has more to do with the hosting infra more than anything else.

All the emr security in the world wont help you if a random piece of critical equipment that is compromised locks you out.

Another win for cryptocurrency! Truly, it has changed the world. We couldn't have this kind of progress without it.

Why do you think this is the fault of cryptocurrency?

Ransomware doesn't really work without it. In fact, they specifically call out WannaCry which demands ransom in BTC.

it doesn’t work without the internet or strong open source cryptography either

Don't you see the obvious logical failure of that rebuttal?

is the failure "i don't see cryptographers as my ideological opponents"?

ransomware existed before bitcoin; it used moneypak, western union and similar services as the payment vehicle.

It also doesn't work too well without Microsoft Windows.

you will be pleased to learn there are ransomware families that target macos and linux as well

Citation needed for the Linux one. People have been telling me for decades now that "there's viruses for Linux too!" but I've never seen any actual malware that actually affects desktop Linux. It's like the Yeti.

Ransomware relies on there being safe ways to collect the ransom.

There were a few predecessors (https://en.wikipedia.org/wiki/PGPCoder) using stuff like Liberty Reserve (long since shut down by the Feds), but Bitcoin made it pretty easy.

One tried "mail money to a PO box" back in the 80s. https://en.wikipedia.org/wiki/AIDS_(Trojan_horse) The downsides of that approach for a criminal should be fairly obvious.

Downside? Sounds like a great way to get anyone you want arrested by the FBI without them knowing who made this all happen.

One of the useful features of cryptocurrency is regulatory arbitrage. Without this ability, ransom payments in cash, or electronic bank transfers would drastically reduce the feasibility of receiving the ransom payment without also revealing the identity of the payee.

A side effect of the anonymity is that crypto provides the opsec cover for these undesirable operations.

I reluctantly agree with you.

The main use case right now (and in the foreseeable future) for crypto is difficult-to-trace payments for illegal activities.

Yes, it's pushed companies to have real backups and security. Great! Before, data would just be covertly stolen and sold.

This, along with its absurd energy consumption "pushing people into renewable energy" is fascinating. Why don't we set fire to buildings downtown to motivate investment in fire departments? Why don't we steal things and smash things to motivate investment in police departments? How about dumping toxic chemicals into lakes to invest in the EPA and bolster environmentalism?

Why don't we in general actively engage in the behavior we want to stop in an attempt to motivate different people to stop us?

I think this is the main idea behind "The Purge," and if "The Purge: Survival" is any indication, it's unlikely to work ;)

Your analogy makes no sense. Are there building fires we aren't aware of? Are there smash and grabs happening without police being notified?

The last one actually does happen and it would be great to have a better way to know when and where by who.

Why on earth would you cheer on a company dumping toxic chemicals into the lake just because they raised awareness?! It's caused material harm. That's madness. You punish them for that, and anyone who enabled them.

If buildings catching fires easily was a real problem, then yes one major event would be a wake-up call to everyone else to provide a real solution to the problem.

But you wouldn't reward the arsonist would you?! Or the negligent builder? Or the planning department who failed to stop this insanity when it could have? You wouldn't lobby for systems that fail catastrophically just to point out shortcomings.

You clearly don't remember when they used to ask for moneypack transfers.

It's easier to tie them to the real-world identity of the criminal distributing the ransomware.

It's not impossible to do it with BTC, but at the moment, law enforcement isn't doing much about BTC, unless it involves drugs or CP.

As far as I know, no, moneypak transfers cannot be traced.

They cannot be reverted once spent, they can absolutely be traced. Police can subpoena records from Moneypak, which is more than happy to comply. You also actually have to go out to a physical location, and swipe your Moneypak card, to buy something. That physical location will keep records, may have security footage, etc.

If you're doing Moneypak fraud, and live in any country with a funcitonal rule of law, it's just a matter of time until you either find yourself booked for processing, or, alternatively, ziptied, and with a brown bag over your head, put on a flight to the US.

The Wikipedia article seems to suggest otherwise.

Select quote: "In August 2012, the FBI also issued a warning that scammers were taking advantage of MoneyPak's untraceability to coerce unwitting victims into paying a "ransom" to unlock their computers infected with malware."

https://en.wikipedia.org/wiki/Green_Dot_Corporation#MoneyPak...

No, you'd tie them to the real-world identity of some unwitting mule.

Unless you have better OpSec than the KGB, or a cartel-like reputation for inflicting incredibly disproportionate amounts of violence unto the friends, family, household pets, and lawyers of snitches, pressure on that mule works wonders.

On the other hand, it's a world-readable leger. It would be easy enough for the government to permanently blacklist any downstream transactions from such coins as "proceeds of terrorism", and impose strict liability prison sentences on any regulated person (or exchange) found in posession of them...

The FBI and private companies have tools to track Bitcoin transactions. The FBI brags about the capability often. I'm sure that in most cases it is hard to follow up on because the malicious actors are in other countries.

https://www.chainalysis.com/ https://www.elliptic.co/

They can certainly legislate about that, and I suspect they will, but there are issues. The ledger doesn't have a concept of a specific unit of currency that changes hands. It has transactions, which have one or more inputs and outputs. Lets say Alice has 3 blacklisted bitcoins and Bob has 2 whitelisted coins. They both sign a transaction which takes all 5 of their coins as inputs, and gives 2 coins as an output to Carol and 2 coins as an output to Dan. The remaining coin is left as an implicit miner's fee. Who got Alice's 3 blacklisted coins? You can make up an arbitrary rule dictating who got which coin in a legal sense (based on order of inputs and outputs or something meaningless like that), or say that any coins output from a transaction with any blacklisted coins are themselves blacklisted, but you can't actually track individual coins. Applying such rules to Monero would make even less sense, as the coins essentially go through a mixer during each transaction. Back to Bitcoin, it's also not clear what it means to possess a coin. We can make fairly arbitrary (though Turing incomplete) scripts for the validation of ownership, a signature is just the most common. Next-most common is probably the m-of-n signature; if I possess 1 of 2 signatures that can spend a coins from an output, do I own those coins? What if I have 1 of 3 signatures, and at least 2 are needed to spend the coins? What if the coin is only spendable by solving a non-cryptographic math problem? If I know the answer to the math problem, do I own the coin? If I make a transaction with blacklisted funds that has outputs spendable by anybody who solves the script by putting in the answer to the problem 2+2, does everybody aware of that transaction now jointly own the coin? I'm not saying you can't legislate about this, I'm just saying it gets silly. Also, I doubt there is a single legislator in your entire government who understands the properties of a Bitcoin transaction that I just described. I bet that their first attempt at regulation will be totally ignorant of what it is that they're actually regulating, and it will be hilarious.

Cryptocurrency isn't going anywhere. It exists now, people value it. It will remain so.

We need to focus on building systems that mitigate this as a potential attack vector

It’s a core feature.

Interesting. So you can 'invest' in cryptocurrency and then release ransomware for your chosen scrip to boost your share. Wonder what sort of pen-and-paper white collar crime this would correspond to.

Securities fraud and something under the Computer Fraud and Abuse Act I'm sure ^_^ fun thought exercise.

Cryptocurrency is a tool used by bad actors long after they have compromised the system.

Would you please not post flamebait to HN? That's against the site guidelines:

https://news.ycombinator.com/newsguidelines.html

Long flamewars or long tit-for-tat arguments about a generic thing like cryptocurrency, which you unfortunately did a couple times in the last few days, are also against the site guidelines (see "generic tangents").

Reply on news.ycombinator.com