Illinois Hospital First to Shut Down After Ransomware Attack

It's interesting to see how IT is perceived as a cost-center and not essential to the business in healthcare; yet everything crumbles and collapses when there's an IT outage.

These organizations might not be culturally accustomed to have IT at the core of their business/mission, but it very much is. They might not value engineering skills and people in IT, but they have evolved an absolute dependency on those over the years.

The issue here is cultural, not technical. These ransomware attacks, breaches and outages are completely self-imposed. They can end anytime as soon as the hospital wants it. All they have to do is value and acknowledge IT as a fundamental pillar of their organization, comp it appropriately and make sure to run on hardware that's patched and safe to use. Really no different than washing hands before a procedure to stop infections. Else the cycle will endlessly repeat itself.

If you look at the details of the post, it wasn't the hospital but the billing department that was shut down. Rest of the hospital was fine. So in theory the hospital could have operated but they couldnt bill insurers or government entities.

I'm looking forward to the day that AI replaces the meatsacks in these departments for how awful and poorly run they typically are.

It's interesting that most do not seem to be much worried about the insane vulnerabilities and general lack of security in a lot of our critical infrastructure. You'd think people should be happy about ransomware attacks exposing how weak it all is, because that's concerning and needs to be worked on. These guys are financially incentivized to pen test even companies and institutions who don't take security seriously. Which includes a lot of public ones too.

What a Russian ransomware firm can do, sophisticated state actors manage with ease.

Damn you all are all in on victim blaming. Don't get me wrong, they clearly should have invested more in security, backups, etc, but a fucking hospital is closing come on.

A Modest Proposal

Sometimes investigators know the actual actors involved with such attacks. 15 years ago I worked for Microsoft and went to a security presentation where the team had done some brilliant work and collaborated with law enforcement over months and had specifically identified an individual associated with a cyber attack. The individual was out of reach because of weak computer crime laws in the attacker’s country and poor diplomatic relations.

The FBI was co-presenting and touting the staggering amounts of manpower and funds dedicated to this investigation.

I leaned over to a friend of mine and said something to the effect of “with the state of organized crime in that country we could spend a few tens of thousands of dollars for a permanent solution”.

I always think back to that comment. Attribution in computer crime is hard, but attackers get away with impunity because they either hide behind anonymity or behind jurisdictional issues. Should we just let that go or use more pragmatic solutions?

FWIW, I don't work in a hospital, but I have relatively recently taken on as a client a small rural practice (8-15 employee range) and it's helped further open my eyes and give me more perspective. Big places should at least have dependably competent teams in principle, even if they have tons of expensive legacy, lots more strain/demand, and more perverse incentives and so on. But I think these challenges go up and down the stack in the medical world, and I don't think the available options are as friendly or as good as they should be. This place still only has quite limited internet options (though at long last fiber may come in the next few years), having everything be cloud-based isn't realistic on an unreliable 10 Mbps DSL connection. They had no "IT", just random locals (like us in fairness), which can be decent but also can be... less optimal (one set of intermittent issues they'd been having for years I traced to the previous guys who installed their ethernet not bothering to actually qualify it). And what the doctor had been able to figure out himself. It's a bunch of practitioners and then one front desk person who does all the billing and such and that's it. There was a mixture of windows 7/vista and Mac OS 10.10/10.11. But also a $30k panoramic Xray machine and a bunch of other smaller but still expensive systems that obviously they needed to have work and can't just "oh yeah just buy a new one!" This is a critical local resource in an area where there are towns with a total population of as little as 65.

It was doable on a budget with some work to put together a vastly improved setup for them with data going to a ZFS system with constant snapshotting and then that too getting further backups in a few ways to off site, but it took way more technical knowledge/metaknowledge then it should have. If I think about all the various components, this could and should be a lot easier. And even with what we went with I still can't say I'm truly satisfied. Like, why don't TrueNAS or everyone else in the space long since have watch dogs for signs of ransomware? Encrypted files are readily discernible from unencrypted files by computers, so why isn't there just a GUI option to "alert on threshold of change in encrypted files|filesystem entropy"? Or even "radical deviation in snapshot size"? The key thing about ransomware is deviation from norms, by definition it must suddenly make changes to a massive set of files in a way totally different from typical patterns. If all of a sudden a NAS/SAN observes any hints of that why in 2023 isn't that universally a red alert? Why is Webauthn not everywhere for admin pages? Hiding everything behind an internal VPN is good practice, but further layers would be good too. Etc etc, no doubt endless stuff I'm not even thinking of or don't know myself.

It's a huge societal drain to lose medical services over such events and fantastically inefficient. The cost to ensure everyone has at least some final fallback WORM recovery or the like, even if a month old, has to be a tiny fraction of the damage that even a single hospital shutdown (or slowdown even) causes. Somehow it's not getting priced in and responded to in a uniform manner. I really feel like I should be long since 100% out of a job on this sort of thing because there should be easy options for non-technical types, and that government should have universal help and guides for all medical providers from sole practitioner on up nationwide to get into a known good state.

Thanks cryptocurrency! What a useful technology. Wasting electricity, enabling wild financial speculation, and best of all shutting down critical public institutions like hospitals by enabling rampant cyber crime.

Is there anything this miracle technology can’t do?