The 2017 attack the largest to have ever hit the health service - - PowerPoint PPT Presentation

▶
the 2017 attack the largest to have ever hit the health
SMART_READER_LITE
LIVE PREVIEW

The 2017 attack the largest to have ever hit the health service - - PowerPoint PPT Presentation

Mar 12, 2023 151 likes •892 views

The 2017 attack the largest to have ever hit the health service hit computers at hospitals and GP surgeries across 48 NHS trusts. At least 6,900 NHS appointments were cancelled, and up to 19,000 affected in total, after staff were

slide-1
SLIDE 1
slide-2
SLIDE 2
slide-3
SLIDE 3
slide-4
SLIDE 4
slide-5
SLIDE 5
slide-6
SLIDE 6
slide-7
SLIDE 7
slide-8
SLIDE 8
slide-9
SLIDE 9

The 2017 attack – the largest to have ever hit the health service – hit computers at hospitals and GP surgeries across 48 NHS trusts. At least 6,900 NHS appointments were cancelled, and up to 19,000 affected in total, after staff were forced to resort to using pen and paper when they were locked out of computerised systems.

slide-10
SLIDE 10
slide-11
SLIDE 11
slide-12
SLIDE 12
slide-13
SLIDE 13

That's partly because there are so many easy targets. More than 36,000 healthcare-related devices in the US alone are easily discoverable on Shodan, a sort of search engine for connected devices, according to a recent Trend Micro survey. Unlike desktop computers and servers that run anti- virus software and other "endpoint" security checks, the diversity of IoT devices and initial lack of concern about their role in network security often makes them trivial to compromise.

slide-14
SLIDE 14
slide-15
SLIDE 15
slide-16
SLIDE 16
slide-17
SLIDE 17
slide-18
SLIDE 18
slide-19
SLIDE 19
slide-20
SLIDE 20
slide-21
SLIDE 21
slide-22
SLIDE 22
slide-23
SLIDE 23
slide-24
SLIDE 24
slide-25
SLIDE 25
slide-26
SLIDE 26
slide-27
SLIDE 27
slide-28
SLIDE 28
slide-29
SLIDE 29
  • Healthcare Database (48,000 Patients) from Farmington,

Missouri, United States

  • It was retrieved from a Microsoft Access database within

their internal network using readily available plaintext usernames and passwords. I have had access to his system since early 2016.

  • Database (210,000 Patients) from Central/Midwest United

States

  • This product is a very large database in plaintext from a

healthcare organization in the Central/Midwest United

  • States. It was retrieved from a severely misconfigured

network using readily available plaintext usernames and passwords.healthcare hack

  • Database (210,000 Patients) from Central/Midwest United

States

  • This product is a very large database in plaintext from a

healthcare organization in the Central/Midwest United

  • States. It was retrieved from a severely misconfigured

network using readily available plaintext usernames and passwords.

  • Healthcare Database (397,000 Patients) from Atlanta,

Georgia, United States

  • This product is a very large database in plaintext from a

healthcare organization in the state of Georgia. It was retrieved from an accessible internal network using readily available plaintext usernames and passwords.

slide-30
SLIDE 30
slide-31
SLIDE 31
slide-32
SLIDE 32

Are You Ready to Hack A Company?

slide-33
SLIDE 33

First Question: Where do we start?

slide-34
SLIDE 34

Found a webmail server!!

slide-35
SLIDE 35

OK, so we found a webmail server…what now?

slide-36
SLIDE 36
slide-37
SLIDE 37

What do we do with this?

slide-38
SLIDE 38
slide-39
SLIDE 39
slide-40
SLIDE 40

Now we are basically done!

+ =

slide-41
SLIDE 41
slide-42
SLIDE 42
slide-43
SLIDE 43
slide-44
SLIDE 44

BUT IT GETS WORSE!!

slide-45
SLIDE 45
slide-46
SLIDE 46
slide-47
SLIDE 47
slide-48
SLIDE 48
slide-49
SLIDE 49
slide-50
SLIDE 50

What About Tracking Down Employees?

slide-51
SLIDE 51
slide-52
SLIDE 52

Or Targeting Folks in the Nearby Coffee Shop?

slide-53
SLIDE 53
slide-54
SLIDE 54
slide-55
SLIDE 55
slide-56
SLIDE 56
slide-57
SLIDE 57
slide-58
SLIDE 58
slide-59
SLIDE 59
slide-60
SLIDE 60
slide-61
SLIDE 61
slide-62
SLIDE 62
slide-63
SLIDE 63
slide-64
SLIDE 64
slide-65
SLIDE 65
slide-66
SLIDE 66
slide-67
SLIDE 67

#6: Have a plan and test it.

slide-68
SLIDE 68

#7: Know who you are going to call.

slide-69
SLIDE 69

#8: Recognize the overlap of physical and digital security.

slide-70
SLIDE 70

#9: Train Your Employees

slide-71
SLIDE 71

#10: Do not be embarrassed!

slide-72
SLIDE 72

WE ARE NOT SECURING A NETWORK, WE ARE SECURING LIVES!

ELECTRONIC HEALTH / MEDICAL RECORDS EMBEDDED HEALTH TECHNOLOGY MEDICAL DEVICES PERSONAL INFORMATION AUTOMATED DRUG TREATMENTS CORPORATE NETWORKS

slide-73
SLIDE 73

@ d a r k c y b e d c y b e r @ V i n c e C r i s l e r v i n c e @ d a r k c u b e d . c

  • m