NHS hit hard by ransomware / Wannacry Patching

[Trapper]

Exactly what I'm doing now. Patching!

 

Luckily all my clients are Win 7 and above with WSUS kicking updates out.

 

The only server I'm worried about is a core installation of Server 2016 running Spiceworks as Sophos don't have an AV client that works with 2016 core yet.

[FragglePete]

For everyone doing this.... please, please make your SLT, non IT colleagues, etc know that you are/have been doing this ... in your own time ... proactively trying to protect everyone ... still need to be careful ...

 

Make sure they know that you deserve your halo polished...and that just because you have done this doesn't mean that they, or you, can relax.

Oh don't worry; I will - I'll claim a day of in lieu for this as well. They're usually pretty good about these sort of things here.

 

Pete

[Trapper]

Luckily my wife's trust upgraded to Win 7 last year.

 

From other contacts I have in the NHS the cost problem is due to the hardware. They have thousands of PCs with extremely obsolete hardware that just cannot take an install of Windows 7. What can they do really? No money to replace all the workstations, but are required to keep the core job of keeping people alive running along.

 

Now if only someone had promised an extra £350 million per week to the NHS.....

[Arthur]

"The Government Digital Service, set up by David Cameron , decided not to extend a £5.5million one-year support deal with Microsoft for Windows XP."

 

http://www.mirror.co.uk/news/uk-news/tories-cut-security-support-outdated-10413160

 

🤦♂️ when will they learn? We don't point out risks and request money to update things for no reason?!!

Even if the deal was extended for another year wouldn't it have ended in April 2016?

 

https://www.theguardian.com/technology/2014/apr/07/uk-government-microsoft-windows-xp-public-sector

 

https://www.theguardian.com/technology/2015/may/26/uk-government-pcs-open-to-hackers-as-paid-windows-xp-support-ends

[DrCheese]

That & it becomes a question of how long you keep paying it vs forcing the trusts to upgrade machines or isolate them. It's a very difficult problem to solve as replacing a computer may require a massive/costly upgrade on what it's attached to, i.e MRI systems

[kevin_lane]

yep i've been up since 7 this morning updating our servers

[DrCheese]

Hehe, High five to you all! *Throws biscuits/coffee & beers!*

[Devontechie]

I am currently going through about 40 clients servers (most have at least 2 servers if not 3).

[gh5000]

Even if the deal was extended for another year wouldn't it have ended in April 2016?

 

As I read the MS release from this morning, they have released the patch that was available in March for custom support providers to everyone. I.e. MS are still providing custom support and if the NHS paid for it they would had access to the march patch (whether they would have used it is just like us all remoting on last night and this morning after the fact)

 

‪ So if you have any 2003 legacy server still going for some antiquated piece of software apply the patch released this morning.

 

Edit: should say custom support subscribers above

Edited May 13, 2017 by gh5000

[Asgard]

Hehe, High five to you all! *Throws biscuits/coffee & beers!*

 

As I don't drink alcohol I went for this instead [emoji23][emoji23]

[Jamman960]

It'll be interesting to see whether the cost of recovering their systems outweighs the "saving" made by not renewing the extended support contract

[DrCheese]

Admit I have used this as an example to SMT about why it's vital we keep on top of updates - I often get grumbles about downtime & forced reboots, but this shows just how important they are.

[Simcfc73]

I've been monitoring our patching anally after being hit on January and make sure every server gets updated straight away. All on the lovely green 100% at present.

 

We've just started using fusemail too which has the clicksmart faculty which changed the link in emails and redirects to them, where they check if its valid...if its not it gives you a warning. Still won't stop some staff clicking through but the more security i can provide the better.

 

We are getting a pen test done soon, nice to have some £££ for this sort of stuff.

[localzuk]

Doing an audit of all our schools today. So far found some interesting choices by the old IT support company. Eg. Windows Update being completely disabled at one school...

[mullet_man]

Doing an audit of all our schools today. So far found some interesting choices by the old IT support company. Eg. Windows Update being completely disabled at one school...

 

Boggles the mind how companies can disable updates due to their being agreed limits on boot up/logon times.

[googlemad]

Another big problem in the NHS is if you thought educational software from the year 1666 BC was bad enough there are tons of mickey mouse software companies out there trying to make a quick buck from the NHS! Then they get trapped as all their patient data is on said systems!

 

Our Trust is quite good in that the threats are recognised, for example last week a company came in fully expecting to rig up some network medical dishwashers until it was found they ran some ancient Windows CE / embedded nonsense so they didn't get anywhere near the network thankfully! There is a lot more fancy network kit than just client PCs and server PCs in the NHS.

 

Oh and get this, NHS eLearning PC check which you can visit yourself if you're interested - ESR Programme Support. They INSIST on the very specific Java 1.8.0.74 being installed on clients otherwise you get an orange mark against the checker, even if you install a more recent version such as the current Java 8 131! I even challenged them on this but the response I got was basically 'tough luck this is what IBM tells us to recommend'. Absolutely no need for an e-learning system to require Java in the first place in my opinion, it needs a complete overhaul in my honest opinion.

[mullet_man]

I've always had Windows Updates configured to install for clients, I've also recently been working to ensure we update 3rd party stuff like Java, Flash etc more regularly.

 

Hopefully this happening will stop the moaning of staff who insist on never restarting their laptops to complete updates.

[SteveM555]

Also taken a look at our updates to make sure we have everything sorted.

 

We have also temporarily made it so all attachments from external senders are approved by exchange admins beforehand. We already block executables, but as these are coming through as PDFs...

[snagrat]

What about simple things like blocking macros in Office documents originating from the Internet, making certain types of Windows scripts non-executable by associating them with Notepad (or disabling WSH completely), blocking PowerShell.exe, cmd.exe etc. from accessing the Internet and so on?

 

A lot of the macro-based ransomware that I have read about uses PowerShell to download additional files from the Internet. That seems such an easy thing to prevent.

 

https://www.fireeye.com/blog/threat-research/2016/07/cerber-ransomware-attack.html

 

 

 

 

Do you currently block Powershell and other certain files access to the internet?

 

I would be interested in a copy of your group policy if you do.

[FN-GM]

Does anyone have a warning email for staff I could steal please?

[mullet_man]

Do you currently block Powershell and other certain files access to the internet?

 

I would be interested in a copy of your group policy if you do.

 

I've blocked the internet macros for Office, but am interested in tightening things a lot more.

 

I like the idea of blocking poweshell access to the internet etc. So am interested too.

 

Does this blocking break anything?

[FN-GM]

I am looking at disabling SMB 1 on clients as well as servers. I can do it by running this powershell command

 

Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol

 

How would I automate the reboot prompt to no please?

[Arthur]

How would I automate the reboot prompt to no please?

 

Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol [color="#FF0000"]-NoRestart[/color]

[FN-GM]

Of course! Been at it all day, loosing the will to live!

[synaesthesia]

I can't see this mentioned, how exactly did this affect their phone systems? Are they windows based?