Patient dies after ransomware attack reroutes her to remote hospital | Hacker News Reader

Patient dies after ransomware attack reroutes her to remote hospital

arstechnica.com

43 pointsfurcyd12 comments

The bitcoin addresses used by malware are monitored by different organizations.

I wonder how hard it is to track the people behind this once you mention homicide to exchanges they use.

if those people used any best practice, and also swapped to another blockchain without using an exchange then it would be very difficult and fruitless to track the people behind it, all of those different organizations and armchair blockchain detectives would just be following bitcoin across addresses and making maps with arrows like a crazy person, not even knowing that they are unable to tell that the owner of that bitcoin changed hands 20 transactions ago in every single path. all of those organizations just assume a person "on the run" is transferring to different addresses they own "trying to hide", and that they'll eventually hit a known exchange address and get nabbed. with that poor logic, someone might get nabbed.

a lot of people don't use a single one of the default, best practices that have been on every bitcoin Wiki for an entire decade, so investigators have that going for them.

Do you have any recommended blog posts or literature to learn more about the best practices of using crypto I'm such a way, i.e. to evade tracking?

Avoid address reuse.

Most wallets and most exchanges do not help with this, they completely neglect it.

In UXTO blockchains like Bitcoin, a core feature is combining your “outputs”, immediately correlating otherwise separate addresses in the same wallet. The system supports transaction types that wallets may not show in the GUI. So you can choose to only send from a specific address. You may have to recreate you hierarchy of addresses in a more capable wallet, but you always can do that no matter where you normally use your bitcoin.

Ultimately you want to unlink your transaction.

Monero, a few smart contracts and some layer2 systems do that. “Coinjoin” systems do not do that, the advertisement of them is probably funded by adversaries.

You have to get your transactions to the systems and currencies that let you unlink.

So you have a series of bitcoin addresses that werent funded with an exchange or tied to your identity. For illustrative purposes lets say you cashed out of a gambling website to a virgin address and US institutions will freeze your accounts if you try to cash out. Nothing illegal for you, as the federal law is only against financial institutions. Just fire up Tor and hop over to Monero using Morphtoken.com and send them btc and get monero. (You dont need Tor for cashing out gambling withdrawals, but just get in the practice.)

Now you have Monero, which is more analogous to cash. If that claim isnt comfortable enough for you, spend time researching that yourself.

You have options now. Monero can just be a conduit for unlinking transactions as you go back into transparent blockchains in a few hours or days. Or it can be your desired currency and nest egg. Or you can sell it directly into fiat currency as several exchanges support it, as well as all OTC desks, as well as local in person markets. Monero is perfectly suited for exchanging for goods and services and many people use it for that despite merchants accepting bitcoin more prevalently, many bitcoin invoices are paid with Monero which trigger another service like Morphtoken to pay a merchant in bitcoin.

Back to the conduit example, you can just generate a new hierarchy of addresses on whatever blockchain you like and convert the monero back into that cryptocurrency.

You can also deposit that Monero on a crypto-only exchange and just trade it for something else and withdraw. This option has the caveat of whether you want to do this in Tor or not, whether the amounts trigger KYC or not, whether you want to use someone else’s KYC, whether you are patient enough to stay in the non-KYC’d withdrawal limits over many days and several accounts, etc. If you just used Monero to a crypto-only exchange under your identity and they got subpoena’d in the future, do you think you need a way to explain the source of funds?

Anyway, thats not even necessary. In this gambling example there is no need to reintegrate, you just need to pass a chainanalysis filter so a US financial institution feels compliant. Unlinking solved, problem solved.

vmception knows his stuff and this is correct.

Question: what do you think about the litecoin mimblewimble features that are supposed to happen later this year?

Litecoin is already so widely integrated in the ecosystem that it should become the largest "privacy coin" overnight, but I don't know enough to say if it's any good.

MimbleWimble has limitations for privacy, better for scaling and comes with a little bit of unlinkability but not enough.

https://litecoin.com/en/news/the-litecoin-mimblewimble-propo...

Shouldn't the hospital have been able to treat the patient without networked computers?

Darknet Diaries just did an episode about how Wannacry disabled the NHS on episode 73. The episode was way more descriptive of how the attack affected functions of the hospital, but basically, there’s a lot of overhead. Suddenly, you have to check everyone in by hand, you don’t know who their normal doctor is, you can’t look up medication, ransomware might be affecting specialized computers for the medical equipment. Some hospitals were able to pivot to pen and paper and still treat patients, but the attack was basically like an accident on the freeway. It just jams everything up.

My first reaction as well. What, we can't treat people when they come in any more? The paperwork is more important than a life? And the terrible thing is, nowadays I truly think that's pretty much how it works.

The fall of Rome must have looked much like this.

Short answer: yes. Realistic answer: it can be dreadfully complicated. In the ED where I work, there are many, many moving parts in a metaphorical fast, fluid dance. Computer systems: Pertinent patient medical history for most patients, including clinics/doctors/implanted device serial numbers, meds, past workups (both conclusive and inconclusive), etc. Very useful almost all the time, can get by if the patient is a good enough historian. I suppose there is a way to get paper-based printouts in a no-computer situation, but I am not familiar with it (all our system downtime where I work falls back to a read-only system, not a no-access system). Our systems also coordinate imaging/lab orders. Yes we can fax paper orders, call, and face-to-face with our teammates in different parts of the building -- but the higher the census/acuity, the more chaotic it is when we are not practiced with that method, and mistakes are much more likely to happen. Meds/procedures are also ordered and communicated on the system, and completion/administration is charted on the same. Patient exams too. Notes. Pertinent allergies or history the patient forgot to tell the doctor but told his/her nurse afterwards (then it is entered right there so when a certain med is ordered, a flag is raised to everyone who needs to see it). We are very, very used to being able to communicate centrally like that. Going to temporary paper charts is doable - just much slower. As we don't do it everyday, everytime we need to re-rehearse the system. Our rapid, fluid dance crashes and we're fumbling almost blindfolded, trying to get the same amount done/communicated/verified/double verified with our same patient load as before.

Real life example: during a (seemingly) poorly-planned downtime of our charting system (maintenance), we got several simultaneous critical trauma patients involved in more than one unrelated MVA. As they arrived very close to each other, they went to CT for imaging as soon as primary/secondary evaluation was done. As there was more than one CT available, 2 went simultaneously. None of these patients were conscious and therefore couldn't verify their own identity. In the hurry to evaluate and stabilize them, two of them had their namebands switched (the namebands didn't use their actual names, just random computer-generated and obviously not belonging to a real person type names, for the sake of brevity (no time to hunt for IDs or make calls yet) so CT/labs/everything else can happen ASAP). Quite fortunately the error was found after the scans were completed but well before the neurosurgeon came to evaluate and do a life-prolonging invasive procedure the wrong (intubated trauma) patient. This seems like a simple thing to prevent, and it is, provided everyone remember to slow down and be mindful of these steps.

Now I imagine the ED at that hospital at capacity with high acuity patients with a very full waiting room (as flow has slowed down considerably), and perhaps a decision was made to go on divert (EMS directed to take all incoming patients to the next closest appropriate hospital). If the physicians and nurses (and all other staff that keep the place from sinking into the mud at any given time) were all occupied with critical patients at the time this patient was to arrive, my experience tells me that there would likely be a high risk that somebody was going to have a bad outcome because the demand exceeded the resources. This is just my take on the situation given almost no data other than that computer systems were down and this patient was diverted to another hospital and died. I don't know the emergent medical condition nor do I know if it was due to lack of timely hospital resources that she passed. What I do know is that if that ED was at its max with critical patients (and metaphorically raining fire and brimstone sent from the vengeful ED gods because a non-superstitious staff person remarked how "quiet" it was that shift and superstitious coworkers became upset), she may not have had a good chance there either, or somebody already there may not have had a good chance. Who knows. I can only speculate.

Reply on news.ycombinator.com