Ransomware attack on a major IT provider of the NHS

[elsiegee40]

A cyber-attack on a major IT provider of the NHS has been confirmed as a ransomware attack.

 

Advanced, which provides digital services like patient check-in and NHS 111, says it may take three to four weeks to fully recover.

 

Ransomware hackers take control of IT systems, steal data and demand a payment from victims to recover.

 

The NHS insists that disruption is minimal, but Advanced would not say whether NHS data had been stolen.

 

The Birmingham-based firm says it first spotted the hack at 07:00 BST on 4 August and immediately took steps to contain the hackers. It is now working to restore services.

 

The company refused to say if it was in negotiations with hackers or paying a ransom to them.

 

In a statement, it said: "We are rebuilding and restoring impacted systems in a separate and secure environment."

 

An NHS England spokesperson said: "While Advanced has confirmed that the incident impacting their software is ransomware, the NHS has tried and tested contingency plans in place including robust defences to protect our own networks, as we work with the National Cyber Security Centre to fully understand the impact.

 

"The public should continue to use NHS services as normal, including NHS 111 for those who are unwell, although some people will face longer waits than usual.

 

"As ever, if it is an emergency, please call 999."

 

An NHS psychiatrist, who wished to remain anonymous, told the BBC the attack left his team "making clinical decisions nearly blind".

 

"If a new patient came to us, we weren't able to read their history or know very much about them," he said.

 

"The [local] trust are doing their best at setting up an alternative system, they've got a way that we can look at some historical notes now, and have set up another system to mean that we can input new notes.

 

"But there's still basically a week's worth of notes that we can't access. We've been told to be ready for it to not be up and running for who knows how long."

 

At the end of last week, family doctors in London were warned by NHS England they could see an increased number of patients sent to them by NHS 111 because of the "significant technical issue", industry magazine Pulse reported.

 

Advanced initially said that only a "small number of servers" had been affected and that it might be able to recover in a week.

 

Products which have been affected include Adastra, which is used by NHS 111 service, and Caresys and Carenotes, which provide the backbone for care home services like patient notes and visitor booking.

 

The National Cyber Security Centre, which is part of GCHQ, says it is working with Advanced to help it recover.

 

A spokesman said: "Ransomware is the key cyber-threat facing the UK, and all organisations should take immediate steps to limit risk by following our advice on how to put in place robust defences to protect their networks."

 

Ransomware hackers are usually financially motivated and part of large, professionally run criminal gangs that target companies and demand hundreds of thousands, sometimes millions, of pounds in ransom in the form of cryptocurrencies like Bitcoin.

 

While it is hard to trace where the gangs are based, analysis suggests that 74% of all money made through ransomware attacks in 2021 went to Russia-linked hackers.

 

 

https://www.bbc.co.uk/news/technology-62506039

[free780]

I didn’t put 2 and 2 together. Advanced own ProSolution which many colleges uses as their MIS.

[Ditto]

Just saw this and yes, not just ProSolution, but same company that are behind Progresso (now Cloud School). It's a good wake up call that even if you have your systems with a large cloud based provider, you are not entirely immune from attack.

 

A key sentence in the article is 'An NHS England spokesperson said: "While Advanced has confirmed that the incident impacting their software is ransomware, the NHS has tried and tested contingency plans in place including robust defences to protect our own networks, as we work with the National Cyber Security Centre to fully understand the impact."'.

 

How many of us have 'tried and tested' contingency plans, particularly if you have recently switched from SIMS to a cloud based offering? And I am not that I am suggesting local SIMS is better!

[free780]

A decent DR plan with technical controls ready to enable is what you need.

 

When an attack does happen it’s usually out of hours and little can be done that is a manual action. Computers are just too fast running a script as a compromised domain admin account.

 

A defence in depth can really help. Multiple controls can slow down an attack.

[nicholab]

Why do they never seem to be able to arrest these people and make them had over the keys? Also why can’t you uninstall ransom where like normal software? It must have an uninstaller? Edited August 14, 2022 by nicholab

[3s-gtech]

Why do they never seem to be able to arrest these people and make them had over the keys? Also why can’t you uninstall ransom where like normal software? It must have an uninstaller?

 

They’re not in the UK - they may be diverse across the world, or in a country that supports/ doesn’t punish their actions. Some actors do eventually get caught.

 

The encryption is not like software that can be uninstalled. It permanently changes all the files it can get to on a target system - so even if you remove the infection, the damage is done.

[FN-GM]

A decent DR plan with technical controls ready to enable is what you need.

 

When an attack does happen it’s usually out of hours and little can be done that is a manual action. Computers are just too fast running a script as a compromised domain admin account.

 

A defence in depth can really help. Multiple controls can slow down an attack.

 

In addition to a BCP.

[Roberto]

It must have an uninstaller?

 

Why must it? The installer/uninstaller thing is a convention that legit software vendors choose to follow, not a hard rule that must be enforce by the technology (and even if that was a case, malware writers would then look to subvert this 'hard rule’).

Edited August 15, 2022 by Roberto

[nicholab]

Why must it? The installer/uninstaller thing is a convention that legit software vendors choose to follow, not a hard rule that must be enforce by the technology (and even if that was a case, malware writers would then look to subvert this 'hard rule’).

 

How are OS so madly written that software can be installed without proper permission.

[CHiLL]

How are OS so madly written that software can be installed without proper permission.

It's not installed though is it? Isn't it just an application that's executed?

[andy_b]

How are OS so madly written that software can be installed without proper permission.

 

Using a zero day exploit to get elevated permissions.

[dcwhitworth]

How are OS so madly written that software can be installed without proper permission.

 

In almost all cases it isn't. This is why phishing is so prevalent these days. OSes are actually pretty secure, certainly compared with the past, the attackers pretty much need to get hold of a compromised account to do their work. No matter how good the security of your OS is, it can't do much if legitimate users give away their login details.

Edited August 15, 2022 by dcwhitworth

[nicholab]

Just which I was clever enough to write the code to defeat these scum bags.

[jthompson]

Why do they never seem to be able to arrest these people and make them had over the keys? Also why can’t you uninstall ransom where like normal software? It must have an uninstaller?

 

It's a bit like unsmashing a vase. You do all you can to prevent someone smashing it in the first place, but you'll want a spare in case they manage to do it. Particularly if there are countries out there who find the smashing of foreign vases by their cyber-crims as geopolitically convenient.

[Norphy]

How are OS so madly written that software can be installed without proper permission.

 

Because… it’s not as simple as that. An operating system is literally millions of lines code by itself. ANY operating system. And that’s just what comes with the operating system. Throw in the code for the application, the framework it’s running on, it’s dependencies and so forth. More and more lines of code that can and often will interact with one another in unexpected ways.

 

In all those millions of lines of code, there are inevitably going to be bugs and security flaws. Even if you could get your code perfect, there’s then everything underneath that code: the compiler or interpreter for the code; that could be buggy. Hell, there could well be bugs at an even lower level than that, at the CPU microcode level or even a bug on the CPU itself. See Spectre and Meltdown, for instance. The more complex anything is, the more likely it’s going to have a flaw.

 

And that’s just at a code and interpreter level. Even if all of that was perfect (and it never will be), it’s still missing the human side of things. Ultimately, a computer isn’t going to really know what’s authorised an authorised programme and what isn’t. It’s just going to follow the rules it’s been programmed with and/or follow the instructions of its operator. If someone isn’t paying attention and accidentally runs a malicious piece of software then that’s all it takes to get entry. It doesn’t need to be installed in the traditional manner, it just needs to get onto the computer then executed.

Edited August 15, 2022 by Norphy

[nicholab]

It sickening that people choose to help the Russian, North Korea, Chinese and Iranian government when we know they are wrong illegal and oppressive.

[FN-GM]

How are OS so madly written that software can be installed without proper permission.

 

It’s not just the OS. 7-Zip and Adobe PDF recently had an issue that allows you to elevate to admin. Both fairly common applications.

[Roberto]

It sickening that people choose to help the Russian, North Korea, Chinese and Iranian government when we know they are wrong illegal and oppressive.

 

If you were a Russian, North Korean, Chinese or Iranian citizen then you wouldn't 'know' that 'your' government were wrong, illegal and oppresive. In fact, as far as you'd know, it would be the likes of us and our goverments that were "wrong, illegal and oppressive".

 

And yes, there are some people who will do anything for money regardless of any other morality too.

Edited August 16, 2022 by Roberto

[elsiegee40]

Please take care to steer clear of the politics that may or may not be behind this kind of attack. Further posts of that ill will be removed Edited August 18, 2022 by elsiegee40

[Kitkatninja]

Just which I was clever enough to write the code to defeat these scum bags.

 

It's a constant battle, malware/ransomware keeps on evolving so code that may be able to stop them today, may not be able to stop them tomorrow. For example Android 13 was just released, and Malware developers have already bypassed Android 13's new security feature.

 

But I like the way you think

[jthompson]

Just which I was clever enough to write the code to defeat these scum bags.

 

Like most people, you've spent too much time developing things like empathy, and a moral conscience, rather than spending your time learning how to be an extreme sociopath.