Three London Hospitals shut down their computer systems on Tuesday in response to a computer virus infection. Infection by the Mytob worm sparked the emergency response, involving St Bartholomew's (Barts) the Royal London Hospital in Whitechapel and The London Chest Hospital in Bethnal Green. The three hospitals are members of …
Patients with concerns...
> Patients with concerns about their appointment are advised to contact the Trust on?
What about patients with concerns for their Medical Records?
Windows in critical functions?
Surely you jest.
MS's attempts to propagandize otherwise notwithstanding, Windows was originally designed for single-user standalone machines (no network connection), with heavy lashings of "home use". The heavy burden of legacy attitudes and design principles at MS means that Windows, even dear Vista, has not, and cannot, break free from these implicit constraints.
Linux may not be the answer, but Windows is definitely not the answer.
Old news to El Reg regulars.
And the public humiliation of the (l)user who introduced the infection... public stocks or stoning maybe.
Oh my god!!
What platform is that on? I had better check my systems immediately.
Thank feck for that. Linux is safe and I can sleep well tonight. My systems can stay online after all.
mission critical should not use windows
How long must we all put up with such mediocrity in approaches to systems that are important.
Windows should have no place in a system where any virus is unacceptable.
This is a case where 'I want it like my computer at home' should have been struck from the specification.
.... and of course.... linuxlinuxlinuxlinuxlinuxlinuxlinuxlinuxlinuxlinuxlinuxlinuxlinuxlinuxlinux
Not even the computers are immune to MRSA.
Hit by a virus from 2005? Really? They must have some seriously crappy security if they're not protected against something THAT old.
Why the hell...
Are they using Windows in what is basically a critical environment... even Microsoft say that it shouldn't be used.
Even if they have to because their software can't run on anything else, you have to ask just how a virus got onto their systems and was allowed to spread. And if a virus can get ON to their system then data surely can get OFF which is a bit worrying.... would you trust them with your confidential data?
I trust there will be a full investigation and their head of IT does the decent thing and falls on their MRSA infected sharp.
Suitability of platforms
The issue here is not just that they were so badly affected by a virus which was introduced into their network. It's that datacentre systems which are essential to providing services have to run AV software at all.
Hospitals and other such institutions should be forced to use systems that can be secured properly. Last I checked, Microsoft systems don't really do well in that department. They're OK for trivial tasks, but to run a hospital with them strikes me as irresponsible.
You are kidding me
Mytob? That's three years old! WTF?
This just makes me mad...
If the IT infrastructure is run correctly, it shouldn't be possible for a virus to get in let alone spread. The complete IT department (starting at the top) should be sacked.
PS, I’m currently looking for work; so if they want a new IT manager, I’ll do the job for £1,000 a year less than they are paying the current Muppet.
Didn't they update their AV?
This worm is 3 years old.
Why not install a penguin?
Become secure, stable AND save money on all those license fees!
Oh, I forgot, the Linux community probably doesn't bung wads of cash to the correct people.
Is this the Mytob worm first found in 2005?
Seems that they've skipped a virus signature file or 13'000.......
Glad my health is in someone else's hands...
Where's the IT angle - because this is just plain dumb.
Virus writers will code for the platform with high market penetration. Nobody bothers to steal clown shoes, because there is little market for them.
Until there is a unified, non-tech friendly GUI, Linux will have few non-technical advocates. Nobody wants to have to code their own drivers, unless they are the basement-dwelling furry-toothed zealots such as those above.
If, by some sheer miracle, Linux was widely adopted, then it would be plagued by the same propensity for viruses and malicious attacks. (Success/failure rates would then come down to better/worse coding, rather than market share/attack rates)
Wipe that smug grin off your face, nobody wants your clown shoes. Go make it usable for the majority of the computer-using population of the planet, then we'll talk.
Windows for Warships
In the light of this, would it not be prudent for the MoD to reconsider the use of this toy O/S also?
Windows, networking aside, in all its incarnations, is as stable as a two-legged cow. To use it in "mission critical" situations should be a criminal offence.
and as a sidebar
this is absolute proof that there are too many managers with too many dumb ideas running hospitals.
Unlike many, I honestly don't care if a home, or even office user wants to use Windows for their own stuff, as long as that stuff can't hurt me. But there is no way on this planet that I can trust anyone who thinks that Windows is acceptable in hospitals with my medical information, let alone running the place.
When are the managers being sacked? And the manager/director/minister who bought Windows?
Bloody typical and inexcusable
How much taxpayer's money is being pissed up against some wall in Redmond, buying Microsoft software for NHS computers? Why the fuck isn't **our** hard-earned being spent on developing Open Source solutions for the NHS?
This would create local jobs for local programmers, who in turn pay local taxes, shop at local stores, eat in local restaurants, visit local tourist attractions with their friends and families, and contribute to local good causes; thus ensuring that money remains within the local economy.
And we could have the default paper size being A4, the time in VCR notation, and words such as "colour", "sulphate", "labour" and "manoeuvre" spelt properly as well :)
What is a PC virus?
A computer virus is a modification to a program that among other things modifies other programs to include the virus. Viruses are spread when infected programs are moved from one computer to another such as by removable media or a shared filesystem.
A PC virus would be one that can infect any PC. The software common to all PC's would be the BIOS. A boot sector virus could potentially infect any PC. In practice, people rarely boot from removable media, and it is not difficult to spot or prevent changes to the boot sector of a fixed disk.
Mytob is a worm - it does not spread by modifying programs. Instead, it emails itself to vulnerable machines. The list of vulnerable systems is: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003 and Windows XP.
Can the register please call this thing a Windows Worm. It will be accurate, irritate some iTards, please the Penguinistas and annoy the Windozians.
The infection at Barts and London Trust was reportedly caused by the Mytob worm,
Click on that link in that sentence, and the story has a link back to The Register story.
We seem to be stuck in a temporal loop here. With no idea who first reported the story.
Mine's the Dr Who outfit.
When will people learn...
If you have a critical system, you simply cannot afford to use windows - In fact, I would go so far as to say you really need a custom OS - It doesn't have to be built from scratch as there are plenty of good kernels available, but it should be lightweight and it should be designed to do the task at hand, not general purpose.
Call me picky here but
faced with the conflicting priorities of "fixing the NHS computer systems so they can avoid or withstand significant DDoS or virus attack" or "investing in a National ID Database" Einstein's and Rocket Scientist should not need to be asked, I feel.
But, then again, what do I know? I'm only a taxpaying NHS patient who's personal information is daily put at risk by Numpties and other un-civil servants who have "New Technologies" thrust upon them by cretins who evidently couldn't implement a system when paid very handsomely to do so.
Mine's the one with the empty wallet.
Point,click, point, click, click EBOLA !
The dummies should have used SELinux, as a tax payer why am I being charged the earth to stick a heap of crap OS in my local hospital when there are better free alternatives at lazy and incompetent MCSE IT managers disposal ?
Oh and before any Windaz zombies flame me, nananana !
PS Bills' boys are you surfing with full admin rights ? Look out syphilis at 10 o'cock !
And could you say *why* Linux is not the answer?!?!
Running Linux, FreeBSD and OpenBSD (different distributions) on all machines at home. Never had an issue with malware, viruses or such. Why should a hospital, that deals with patient data (privacy, security, right?) have to *pay money* to get a crappy product that is a big hassle to maintain?!? A poor friend who is a Windows sysadmin confessed once that it him longer to install and patch Windows that it took malware to infect the OS :-)) System installed "out there in the open" - big mistake he never repeated! Not an issue with Unix-es, that come secure, with mostly all turned off... Doctors, pack and go!
Re: Peter Jones
Gee, didn't *I* say the same thing about the iPhone before it came out? Hyped and hyped and hyped...and HOLY SH*T IT'S BEEN HACKED.
If you're going to deliberately do damage, you're going to cluster-bomb, not make surgical strikes.
Common all over the NHS
Sadly my local trust (cough *tayside* cough) use XP and write usernames and below "no password required" on whiteboards above said networked machines in areas visible to patients, cleaners, contractors etc.
Also they still use paper for outpatient appointments despite having implemented electronic records in GP practices. Which they regularly lose, and claim there is a "known issue" which is being "evaluated" for over 2 years now since I first complained.
But then again what do I know? I'm only an IT grad, unlike their entire IT staff who seem to be made up of relocated cleaners, receptionists, back to work mums who claim to "know a lot about computers" and other assorted untrained twits.
If it wasnt so likely to cause serious harm to patients it would be laughable, as it stands its bloody dangerous as is the refusal of senior medics to use a product called soap! they all seem to think a few drops of water on the finger tips works just as well *rolls eyes*
How about not allowing any internet access on the hospital intranet and limiting disk access for usb mass storage/cd/dvd/floppies, I mean these guys should know how to keep things sterile it's thier damn job to.
The muppets who put up MS Windows should be named
just to ensure that no other organisation suffers the misfortune of employing them. Add Peter Jones above to the list - he is touting MS inspired FUD. Just how anyone could put something that is life critical on top of MS Windows beggars belief - it is not fit for anything critical.
This sort of thing is entirely predictable, pretending that it is unfortunate is not an acceptable excuse.
Do you think that they will have a case for financial redress from Redmond ? - Not a chance!
Idiots and retards
Idiots and retards...
And no, I'm not talking about the hospital workers. I'm talking about most of you posting comments. I do so love it when clueless morons try to push their religion, political agenda, choice of OS, whatever onto other people for no reason other than to make themselves feel superior.
Let's play a game, boys and girls...Don't worry, it's a real quick one.
1. Windows should not be used in mission-critical, life-and-death situations? OK, I'll accept that, and I'll agree with it. But what would you suggest? You'll see the same exact disclaimer on virtually any product, from your precious Linux all the way down to your APC UPS. So what desktop operating system *IS* allowed for use in mission-critical, life-and-death situations?
2. What medical software is available for your preferred OS? Did you think that maybe, just maybe, hospitals use Windows for most of the their desktop systems because that's what the software is written for? And don't even try the "but if they used Linux, then people would write the software for Linux!" argument, because the software needs to be in place (and stable) *BEFORE* they switch. Otherwise the switch is kind of pointless, isn't it?
Game over. Those who passed can go to the next round. The rest of you can go back down to your Mom's basement and wonder why nobody likes you (except, of course, your friends in Sadville).
And for those who think I'm trolling, I'm not. I hate Microsoft as much as the rest of you. I think it's an extremely bad decision to use it in critical situations. Hell, most of the time, I think it's a bad decision to use it at all, in any situation. But I live in reality where choices have to be made and you have to select the best tool for the job. Like it or not, at the present moment for most companies, that's Windows, simply because the industry-specific software hasn't been made available yet for other OSes.
Single Point of Failure
Hospitals should be the first to realise that diversity is a great (the only real) protection against a virus. If the desktop is merely the client - then why is there not a mix of Linux & Windows? Neither is perfect but they are not going to fail at the same time. Too many eggs methinks.
"Can the register please call this thing a Windows Worm. It will be accurate, irritate some iTards, please the Penguinistas and annoy the Windozians."
Nice one....All three.
Strangely, the last major virus outbreak I witnessed (it happened while I was on a client's site, and no it wasn't my fault) was presided over by an IT department filled with highly qualified IT graduates who knew jack sh*t about computers in the real world but had excellent CVs. They had to employ an outside consultant to find and fix the problems.
Still, the university education ensured they could make the report look lovely with loads of very nice diagrams and buzz words like 'best practice'. As a bonus, some of it was even spelled correctly.
How is it that this hospital is not protected from risk that are 3 years old?
You can't really blame MS for this one
I'm no Windows fanboi, but you can't blame Windows for this (at least not totally) Didn't anyone hear of PATCHING these systems? AV software? There's no reason that a several-years-old virus infection should turn into an 'epidemic' like this. Probably the affected hospitals either have lazy IT staff or perhaps they got rid of most of them for budget reasons? After all, everything's running and IT staff is just sitting around looking bored--they must not do anything--get rid of them! I hope they follow better procedures medically at least...
"Virus writers will code for the platform with high market penetration. Nobody bothers to steal clown shoes, because there is little market for them."
Ancient myth. There are plenty of Linux boxes out there (Apache is the majority web server platform after all, and has been for some time, often on Linux). The fact that there are more Windows machines (and certainly more with incompetent administrators) is only part of the reason Windows is more prone to this sort of thing.
"Until there is a unified, non-tech friendly GUI, Linux will have few non-technical advocates. Nobody wants to have to code their own drivers, unless they are the basement-dwelling furry-toothed zealots such as those above."
I have never coded my own driver - and haven't you heard of GNOME?
"Wipe that smug grin off your face, nobody wants your clown shoes. Go make it usable for the majority of the computer-using population of the planet, then we'll talk."
The way you talk makes it plain that you haven't tried Linux in a while. I suggest you have a play with Ubuntu's latest release - you can boot it from a Live CD without installing - and then we'll talk.
Admin equivalent rights
If you give users admin equivalent rights then these infections will always happen. This worm copies itself to system32 on an NT/2K/XP machine BUT only if you have admin rights.
I have your title right here
If only they had been running OS/2 Warp, this wouldn't have happened.
Virus writers do write for the target
some can create polymorphic as well, but it is harder to pull off.
Yeah, the ramen worm-virus was one of the early nods that RedHat had a number of server installations - which got some home users as well :)
But, I notice some have been using this idea to try and claim that unix is somehow not more secure than windows, to that I just chortle. Unix systems are attacked all the time, and primarily because most of the source code is available, but the attacks tend to be done by benevolent people who will release the exploit along with notification to upstream who patch or update appropriately.
The windows lot keep their exploits and use them for commercial cracking far more than the unix groups, and unix has far better security tools in place. And, the user base tend to upgrade all the time, most use a rolling release distro.
As the to the netbook linux lot, well a lot don't upgrade and if they grow in size you will see more unix style viruses.
The myth was that unix is inherently secure, no one in the know ever says that, they just say unix is more secure than windows and there are hardly any viruses.
And even if Linux say got 50% market share, the systems tend to be more diverse each kernel is different in many cases, so unlike windows where due to conformity it offers more compromises for your buck. So windows at 40%, Llinux 50% you will still be looking at the Linux split, say 30% Ubuntu the aim would go there.
Oh and virus, worm, trojan definitions don't go there - it is just malware there are no rules.
Anti-virus was just a better marketing term than anti-malware. Each definition sort of identifies a subset of operation but it is never clear cut, primarily because data can be made into code and vice versa.
Public vs Private Sector
I used to work in NHS IT, I can tell you what the problem is here.
Money, or more likely, distinct lack of it. The government puts targets and restrictions on how much they can spend, but the competition with the private sector means the balance of pay is just bollocks.
They pay their consultants and surgeons shedloads of money, at the expense of the salaries of the staff in the IT department. I know that the IT director of a large chunk of a specific part of the NHS gets paid about 15K less than the same job if he was working in the private sector, for example. And when people realise that they can get better elsewhere, they move on. Staff turnover tended to be rife.
The other thing is that certain chunks of the NHS get their software for free (or subsidised) - when I worked for a part of the NHS in Scotland we got shedloads of free software from people like Novell and Microsoft, so why would you install Linux when you get Windows and Office for free?
WIth such a small amount of IT staff supporting a large number of users, you have to install the most common and easily worked OS, and unfortunately for most people that means Windows.
There is no excuse, though. All the email scanning firms (such as Messagelabs) and web scanning firms (such as Scansafe) are available for use on the NHS Internet, alongside a corporate AV licence (isn't it Sophos inside the NHS?).
What's the betting that they've outsourced the IT department at these hospitals......??
Mines the one with the really old Celeron CPU in the Siemens Nixdorf laptop in the pocket.
This has got fuck all to do with using Windows, but everything to do with using Windows *wrongly*
1. Not patching it
2. Clicking on every stupid link and doing whatever the malware tells the user to do
3. Letting users run as admins.
If Linux users were routinely left to run as Root, how long do you think it would be before there'd be more Linux bots than you could shake a stick at?
Plenty of failings here, but frankly they lie at the Hospitals' doors, not MS' this time. And before you assume the IT dept should be sacked, what's the odds that they've been pointing out the above failings, and explaining the possible consequences, for years and been brushed off by senior management, whose mantra is "It Won't Happen Really".
Further to my last
I read on McAfee: "When the attachment is run, the virus copies itself to the WINDOWS SYSTEM directory (typically c:\windows\system32) as wfdmgr.exe . Registry keys are created to load this file at startup:
CurrentVersion\Run "LSA" = wfdmgr.exe
CurrentVersion\Run "LSA" = wfdmgr.exe
RunServices "LSA" = wfdmgr.exe
Translation - it can only infect a machine if you're running with elevated rights. Too much clinical software assumes the user has elevated rights. This is why I get so annoyed with useless vendors who make this assumption. I'm glad to say this couldn't happen on a network I administer, not because it's Linux, but because I let users run as admins over my dead body.
How did the virus get in? An email attachment? Shouldn't hospital systems be completely closed?
Perhaps they should treat the computer network as a restricted network and stop attachments being transmitted without being vetted in some way, or use a propriety communications protocol other than email so that it can't propagate viruses.
It's very worrying when such critical systems are clearly vulnerable to this kind of problem.
I guess the real issue here is that everybody wants to use solutions based on Windows, the Internet, and standardised communication applications such as email to save cost.
This have nothing to do with the OS and everything to do with the muppets running the system. If the desktops were properly locked down, and the users had the correct level of access none this would not have happend. Over the last ten years or so I have worked on mission critical networks with over 5000 Windows PC and have NEVER had any issues with viruses or malware.
Yes a Windows based network is easy to setup badly, but its also piss easy to setup well. Using some obscure minority OS which does not work with the mountain of lagacy systems being used out there in the real world is not the solution.
Mytob may have been around for years, but virus writers update their code too. This is probably a variant of the old code rather than the same one from before. Expecting it to be the same code as three years ago is like saying "You use Windows! But that's 25 years old!". This is the latest generation of the Mytob family. That said a decent AV should still recognise the virus from its behaviour or from the similarity of the code, so more of an explanation than an excuse.
I used to write hospital PAS systems
back in the Netware/DOS days. We got into trouble with other health care centres because updated our systems to new data requirements long before those locked into turnkey systems could get patched up.
We were just beginning to link up to the separate imaging systems to ward could see digital images (CAT, MRI, etc) through an image viewer and also squirting data into a separate pathology system.
Further we used thin client PC's usually crammed onto the end of desk, no room for a mouse, had a form of instant messaging and locked down public terminals so staff would need to scan a bar code from their badges to access systems.
Users were locked into a menu at login and could only access the apps they needed for their jobs. We in IT controlled access to the apps and the app owners applied permissions within the app.
Oh and the web was only just starting and no access was given to the 'net. We accessed it via a secure link through the attached hospital. General users neither had nor needed it.
Quote "This has got fuck all to do with using Windows, but everything to do with using Windows *wrongly*"
Your talking total rubbish, windows lets you do this out of the box but with Linux it's a no no unless you elevate your privileges by intent. M$ is making some half arsed attempts to copy the Unix security model using UAC, but it's all still underpinned by a lot of poorly written W32 legacy code in the kernel which quite frankly should have been binned. They had long enough to sort it between xp and Vista's release but were more concerned with adding extra DRM and anti-piracy measures than focusing on the OS of tomorrow.
Infected hospital infection shock
If an institution IS going to become infected, what better than a hospital?
Same old questions, same old answers
'so why would you install Linux when you get Windows and Office for free?'
Because a free pig with lipstick is still a pig with lipstick.
'If Linux users were routinely left to run as Root, how long do you think it would be before there'd be more Linux bots than you could shake a stick at?'
Thats the whole point, a great deal of care is taken in the design of the OS to make sure that root privileges are not needed to run user software. Unlike MS systems I have managed, when, yes, we had to run as Administrator otherwise the software wouldn't work.
Actually the point I was making wasnt about real world / theoretical knowledge / experience, it was more about zero experience vs any experience.
Thing is, what I have noticed is that those who can talk the talk and come from "the right background" land on their feet all the time, despite being hopeless; come from any other background and your up against it.
FYI I didnt do the last year of my course as it was rapidly turning into a joke, 95% of the course was Java as a successor to the domination of C++. Everything else was just a half hearted tack on. This from an "old university"
So I left and did a lot of travelling and gained knowledge and experience "in the real world" doing a lot of diff jobs.
Come back here and get told "well its not british experience...so you might as well have not bothered, oh and you dont have a first...or a masters" and this for menial low level IT work.
Big surprise emigration is going wholesale, companies and public bodies dont have a clue and would rather pay over the head for consultants than train people properly. But then that doesnt seem sophisticated does it?
*apologies for the rant folks, im sick as hell and work wont let me have the time off so im kinda hacked off*