Health-care cyberattack is worst in Canadian history, says expert | Hacker News Reader

Health-care cyberattack is worst in Canadian history, says expert

cbc.ca

64 pointsmmphosis37 comments

When you tell your management that they will fall like a house of cards, what else should you do? What else can you do?

At least, for my systems, I found "Relax and Recover." As the project says, there is no excuse.

I’m trying to understand the problem this project solves but failing. Can you explain? Is this only for dedicated hardware?

It looks like it clones your drives and makes an .iso boot disk that you can stick in your computer and restore from snapshot. At least, that's what the demo video showed. The isos live on an NFS share, and I think there's a pxe-style bootloader that will fetch the latest iso for your machine from the share.

Elegant and simple, but definitely not workable for restoring a large network of ransomwared hospitals. Also, I doubt this would stand up well to ransomware either.. worms target shares and then what will you do? It's turtles all the way down! (Unless you use data diodes or write to tape or something.)

Hundreds of Windows vulnerabilities, ssh holes that invite a semi trailer, and endless denial as corporate peers are taken.

For now, we are immune.

Where are you backing up to? Are you sure ransomware worms won't attack your backup machines too?

Have we ever thought about going back to very manual processes as a matter of course? That maybe digital technology is great for immediate and ephemeral communication, but for long term secure communication perhaps pen and paper is best?

This means we keep fewer, more important records on paper.

This requires rethinking management which, lets be honest, needs to happen anyway.

I was having asthma and went to the doctor in Cassis France. To get a ventolin inhaler and a round of prednisone only took two forms -- one at the doctor and the prescription -- and about $70 dollars.

I look at the reams of documents Kaiser generates anyway, virtual and real even though I'm "paperless" and I wonder how much of the expense of my health care goes into schlepping all these documents around.

There is a book by Derrida called Archive Fever that I read when I was a temp and I always think about the quote in it: "the archivist generates more archive, and so the archive is never closed"

Maybe we need that big hack to finally take away the bottle. We don't have to record everything forever, and digital technology is bad at it, anyway.

For medical records? Are you insane?

Every small little detail recorded by your doctor can be crucial to determine a timeline and help with treatment later. Or just to know your allergies and regular vital signs in case of a serious issue that requires emergency care, when you might not be able to give the information ( e.g. car crash, and you're allergic to penicillin or something in the usually used anesthetic or whatever). It can also be useful when you can just call a doctor to get a prescription, because they have your full medical records and know enough about you quickly.

Paper is extremely impractical.

Why do I keep on having to give my allergies to the doctor every time I'm there?

My timeline is that it is too expensive and full of forms for me to go talk to my doctor. And I have to keep answering the same questions to my doctor about my allergies over and over and over anyway.

I think all this paper work helps a parasitic managerial class, but I've never seen it help me.

I can only comment on why it's important for the physician to know about any allergies. Some people have a history or risk of severe allergy and anaphylactic reactions can be potentially fatal. I've had to managed such a reaction in a healthcare setting. Such a reaction is not only potentially fatal but is often very dramatic and sudden. After that I always err on the side of caution and ask for allergies regardless of what the patient's chart says. It's often a wise idea to confirm what's in the chart rather than to blindly trust what's already in there regardless.

It's the physicians job to weigh the benefits against risk of a drug. And potential allergic reactions is a part of that. If a patient with a known history of severe allergic reactions gets another one from a prescribed drug, and the physician hasn't done their due diligence, then the physician could be at fault. I can only imagine that it's even more prudent for US-based physicians to ask that question due to lawsuits and or personal liability.

Also a patients medical status is never static. While unlikely a patient could have had a reaction since the last visit. I guess a more realistic example of something non static is pregnancy status which can be equally important when prescribing drugs etc.

Yes, why do we have to have reams of paperwork? It would be better if my doctor had time to get to know me. Instead, he fills out paper work, everyone around him fills out paper work.

Because your doctor doesn't deal only with you. Having hundreds of patients it's impossible to remember everything about everyone, and they're not the only doctor that would need to know you(specialists). Hence, normalisation of data.

Have you read a single one of my arguments? Less paper work, more doctors and nurses handling fewer patience.

I’m always amazed that these attacks work. Don’t they have off site backups, cloud backups etc.

I get it being a disruption, and loss of privacy for citizens. However why are they stopping appointments.

It's largely bad security practice. They always say "We have backups." But in reality,

--The backups are not only not offsite; they are online and attackable.

--Backups are not done every day on every machine. The machines on which backups are done most rigorously are the gift shop cash registers and the machine that runs the janitorial scheduling spreadsheet. The blood test results pub/sub system was last backed up in 2019.

--The restore procedure is never tested. Not rarely, never. Because it would take machines out of service for an hour. Can't have that.

--Joe who runs department X drags his feet about upgrading his organization's computers and getting on the corporate backup rotation. And if department X gets taken out, the whole company shuts down.

--Bob in the basement is running a research network nobody knows about, and he puts it directly on the Internet so he can run his experiments from home. And of course it contains a bridge to the corporate intranet.

It's just a clusterfuck everywhere. Good people busy getting their jobs done who see security procedures as obstacles to work around. The bad guys completely understand this organizational dynamic and they exploit it for profit.

Just adding to these from my favourite incident:

You restore from backups to alternate hardware, but your key software is license locked to hardware. It was always the documented recovery process to contact the vendor and request a new license. Their SLA is 30 days.

What if the ransomware infiltrated 3 months ago but was not activated until now? Restoring a 3-month old backup is not useful if the data changes significantly each day.

I don't think the bad guys wait 3 months. Time is money. They have no advantage in waiting.

I believe that forensics of major attacks does show that usually the bad guys have been in the network for weeks before triggering the ransomware, and it rarely happens on the same day as the initial attack. The expectation is that they will first spend the time and effort to look at your network to find out your backup process, and do/wait as much as is necessary to circumvent, disable or destroy your backups if it can be easily done.

On the contrary -

If you have an incremental backup that goes as far back as say 14 days for example. No separate archived snapshots, etc.

If you infiltrate the network and figure out this crucial bit of info - you just wait 14 days while you branch out and infect more PCs, more of the network.

Once 14 days goes by, it's guaranteed that any data the victim tries to restore from is corrupted or potentially encrypted with ransomware.

Some IT types still think RAID 5 is a backup and recovery solution because they think a failed drive hot-swap fixes everything. The recurring failures are actually due to weak management.

There’s little information in the article on how this is affecting patients and doctors.

According to CBC radio, all elective surgical procedures have been canceled and now everything has to be scheduled by hand on literal paper.

And there are no lessons learmed. They restore the computers and when the next attack comes they are hit again.

"worst ever" seems overblown from random 'security expert' but definitely a shock to smaller province areas like Newfoundland to be knocked offline for so many days. Seems like will forever be problems like this when all it takes is a random email link click and whole networks of computers linked together can be tied up. They had backups but still missing weekend/recent days - typical.

Question is, did they pay the ransom?

https://www.msn.com/en-us/news/politics/lawmakers-call-on-bi...

Anything thus far on how they got in? Was it phishing, zero day, etc?

Should we just fund and legalize government backed hacking to basically pentest entities whether they like it or not?

What’s CSEC up to?

Yes. Although throwing red teams at the problem probably isn't the most efficient use of resources.

Better would be constructing a system where government-paid appsec teams are granted access to cloud source control repos for all projects + ability to randomly pentest whatever they desire.

If a breach is found (in release candidate stage or prod), the offender's contract is reduced by the prize amount, and that amount goes into the appsec team's budget.

The only way to make people care about appsec is to (1) increase the likelihood and frequency of exploits & (2) ensure exploits have direct budgetary impact on the teams developing the software.

If the exploits occurred due to under-funding doesn't this pose some issues?

I'd take the perspective that most large company exploits occur because of under-visibility of risk, which ultimately leads to under-funding.

It's easy to say "Our systems are secure and follow all standards" when they aren't and they don't.

It's harder to explain why projects keep coming up with multiple successful pentests or security flags.

Increasing visibility of risk and aligning incentives, with a credible and independent validation party, is the solution.

The biggest gotcha: payment must be for a successful penetration, and must not be for some paperwork flagging of minutiae.

Good idea. Also, anyone, including employees, can give them tips on how to get in, and can't be legally punished for it. Of course, simply handing over private-keys and passwords wouldn't be allowed, but giving them a tip to poke around an API exposed to the public would be okay.

It's "Top Secret".

What's not so secret is that CSEC pays low and kills your career growth.

I like that idea, or at least contract a private company to do the pentest. That makes it government-sanctioned and pushes the responsibility back onto the people who run the services in question, so we never have to guess about whether it's negligence or ignorance.

Are there any wider implications whete security doesn't get taken like we expect it to as a result?

That's a pretty good idea actually. I'd get behind that.

Yah, for sure. Or maybe unify the provinces with the feds in terms of infrastructure, govcloud primitives with a cross functional cross provincial mandate?

Reply on news.ycombinator.com