Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
The Courts Government Security News

Botnet Attack Shuts Down Hospital Network 360

Posted by Zonk from the that's-not-cool-man dept.
aricusmaximus writes "A California student is now facing felony conspiracy charges after unleashing a botnet attack that shut down the network of a Seattle hospital intensive care unit. This indictment comes a few weeks after another California man pled guilty to similar charges. Both attacks were attempts to make money off of adware affiliate programs. So who's really at fault here? The students? The hospital for not securing their computers and network? Or the adware companies for providing the incentive?"
This discussion has been archived. No new comments can be posted.

Botnet Attack Shuts Down Hospital Network More

Botnet Attack Shuts Down Hospital Network

Comments Filter:

  • Student's Fault (Score:4, Insightful)

    by eldavojohn ( 898314 ) * <eldavojohnNO@SPAMgmail.com> on Sunday February 12, 2006 @08:49AM (#14699488) Journal
    So who's really at fault here? The students? The hospital for not securing their computers and network? Or the adware companies for providing the incentive?
    The students, clearly.

    Colt manufactures guns. Man opens fire in public with a Colt pistol. Who's at fault? The shooter, of course.

    I don't want to hear any psychology bullshit claiming it's not their fault--that it's society's fault for making them desire more money. I don't want to hear any bullshit that they didn't know what they were doing or the hospital should have had better security. This is an aggressive act against a public service--the internet. Computer savvy students implement code that shuts down many computers for the purpose of advertising profit. They didn't realize what they were doing? Oh, come on. Even if they didn't, it's a valuable lesson and a few less spammers to ruin the world when they graduate. Tough. You like computers? How about five to ten in federal-pound-me-in-the-ass prison?

    I'll bet they wished they had enrolled in Computer Ethics 101 before going on this capital venture. As an additional punishment, they should be forced to code software to stop stuff like this from happening and tailor it for medical equipment/computers.

    And what kind of intensive care unit is "shut down" when they can't use computers? It's not like their work would have to grind to a stand still. I don't want to sound like a luddite but are we really that dependent on computers? They're medical professionals, I hope they did just shut down and stop working when the computers crashed.

    This student is in deep trouble. He chose actions that had grave consequences and now he'll face the charges resulting from those actions.

    Inignot: Your stereo is now his stereo by way of my actions.
    Shake: Yes meatwad, with actions.

    • Re:Student's Fault (Score:5, Informative)

      by OffTheLip ( 636691 ) on Sunday February 12, 2006 @08:54AM (#14699505)
      I agree with much of what you say with exception of "And what kind of intensive care unit is "shut down" when they can't use computers?". The acute shortage of bedside nurses elevates computers and networks to a big player in short staffed ICU's. Patient to nurse ratios are improved because of computers. Sure the ICU can continue to function but things would be hectic and possibly deadly for some patients.

      • Re:Student's Fault (Score:3, Interesting)

        by eldavojohn ( 898314 ) *
        I agree with you completely.

        In fact, today we are treating many more patients and types of problems through the help of computers.

        To me, the phrase "shut down" means to close up shop. I know they didn't do this but it makes me wonder how much have hospitals suffered in capabilities by accepting automation?

        Advanced life support system may need to be on the network to send signals. But what about the EKG machine? The intravenous drip? These things should not be dependant on computers yet I

        • When my dad was in a cardiac ICU (Score:4, Informative)

          by Intraloper ( 705415 ) on Sunday February 12, 2006 @11:25AM (#14700160)
          all the monitoring info was radio relayed to a monitoring statin at the central desk, where a single nurse monitored it full time. The unit had a staffing ratin of one nurses per three patients; the monitoring nurse was one of them If they had lost that connection, they would not have had sufficient staff to keep every patient adequately monitored. They didnt have sufficient staff to personally monitor the patients anyway, even with the electronic monitoring helping them out. The nurses were acutely aware of this, and were not happy about it.

          • Re:When my dad was in a cardiac ICU (Score:4, Interesting)

            by Dashing Leech ( 688077 ) on Sunday February 12, 2006 @12:47PM (#14700529)
            "If they had lost that connection, they would not have had sufficient staff to keep every patient adequately monitored."

            Hmm. Interesting. I work for a NASA contractor and the safety systems need to be 3 failures deep to go without being addressed as safety hazards, and that includes non-life-threatening risks (like laser damage to eyes). The above described scenario is one failure deep to become life-threatening. It's interesting that we put more emphasis on astronaut safety, who volunteer for dangerous jobs, than we do for ICU patients.

      • Re:Student's Fault (Score:3, Insightful)

        by SCHecklerX ( 229973 )
        If that network is so critical, then why is it so vulnerable???

        • Re:Student's Fault (Score:4, Informative)

          by cide1 ( 126814 ) on Sunday February 12, 2006 @11:02AM (#14700055) Homepage
          Because all software patches must be validated through an FDA audit procedure. You can't just go patch a computer that someone's life depends on. This case makes this procedure look funny, but you can't just put any software on medical equipment. I'm sure most people are aware of the case of the Therac-25. http://courses.cs.vt.edu/~cs3604/lib/Therac_25/The rac_1.html [vt.edu]

          I'm not sure what the real solution is, but I am sure who the criminal is. If the students didn't release malicious software, that network would still be up.

        • If that network is so critical, then why is it so vulnerable???

          What difference does that make?!? Just because it's "vulnerable", does that give you the right to mess with it? Just because I don't lock my front door, does that give you the right to walk in and help yourself to my stuff?
      • "And what kind of intensive care unit is "shut down" when they can't use computers?".
        And what kind of ICU uses computers that are vulnerable to worm/trojan attacks and are connected to a network that is "visible" to the outside?

        Clearly, the hospital IT department shares at least half of the blame!!

    • Re:Student's Fault (Score:3, Insightful)

      by tpgp ( 48001 )
      Colt manufactures guns. Man opens fire in public with a Colt pistol. Who's at fault? The shooter, of course.

      Hmmmmn, nice attempt to start a flamewar. I mean there's nothing like a gun analogy to get people to discuss thing rationally is there?

      Anyway, back on topic. I think you need to understand shades of grey - the students are clearly most at fault for being the ones who actually caused the damage.

      However, the spy/adware companies are most certainly complicit - they operate in a manner where they encourag
      • shades of grey? oh please.

      • Re:Student's Fault (Score:5, Insightful)

        by aelbric ( 145391 ) on Sunday February 12, 2006 @10:13AM (#14699811)
        How can anyone even debate this? Two words. Personal responsibility. It should be a required class in all primary, secondary and higher education school systems.

        Returning to your analogy, it would be like a gun shop not properly securing its merchandise and then shrugging its shoulders when there was a massacre using firearms stolen from said shop.

        So the merchant is responsible for someone stealing his merchandise (an illegal act) and then psychoing out somewhere (another illegal act)? If someone steals a car during a test drive, goes out and gets hammered and plows through a line of school children, are you suggesting the dealer is at fault for not "properly securing their merchandise"? I'm having trouble seeing the logic here.

        • Re:Student's Fault (Score:5, Insightful)

          by MysteriousPreacher ( 702266 ) on Sunday February 12, 2006 @10:28AM (#14699879) Journal
          Returning to the gun shop analogy (since it seems to be popular). If the gun shop doesn't take the precautions required by law and someone steals guns to use in a crime then the gun shop is liable. The point though is that the gun shop is not to blame for the shootings but should be legally liable for the fact that it allowed it's guns to be stolen because they didn't observe their legal obligations.

          If a car shop allows a visibly drunk man with no drivers licence to test drive a car then while not responsible for the deaths caused, they should bear some responsibility for fulfulling their legal obligations (assuming they have any).
      • Shaded os gray my ass. The students commited the act they deserve all the punishment.

        Little bastards.

      • Re:Student's Fault (Score:4, Insightful)

        by utlemming ( 654269 ) on Sunday February 12, 2006 @10:55AM (#14700019) Homepage
        Shades of gray? Who to blame?

        Real easy: The principles are the consiprators. They are the ones that planned the attack, launced it, and used the tools. Personal responsability is not mitigated by availiability, oportunity or circumstance. Just because they saw how to use a tool in such a way does not make them any less the guilty. The gun analogy here does not quite work. Why? Because the adware network had to be changed in order to get it work. So there was more planning, work, testing, etc., which proves more culpability and the maliciious nature of the act. In the case of gun, you just load, point and click. In this case, an entire bot net was pointed at a target, programmed and then used to attack. It is a whole lot different than pointing one gun, it is the equivalent of pointing thousands of guns, and then firing them. Worst yet, it is the equivalent of pointing thousands of guns and then blackmailing someone by saying you won't do it unless they pay you not to do it. So sure they saw that they could do it. They did it. But that does not in any way mitiagate there culpability.

        As much as I hate the adware people, they are just as much as a victem too. Assume that the software was legitimately on the computers they hijacked, then this stunt was in violation of the computer tresspass laws. Further, there software was reversed engineered, hacked and then used on a hospital in an attempt to get the money.

        So painting the hospital and the adware company as secondaries is foolish. When some decides that they are going to exploit someone or something and use illegal methods to gain, everybody in the chain becomes a victem, regardless of their degree of contributing participation. If the adware company had the forsight to know that its software could have been used to do such a thing, then it would reasonable to blame them, but I seriously doubt they did.

        Otherwise, rest the blame squarely on the shoulders of the princple attackers. Personal responsability is what matters. The attackers used what they knew to exploit the tools.
      • To stretch the analogy further: Colt offers a bounty for scalps. They say you're only supposed to bring in al Qaeda scalps, but they'll pay you with no questions asked for any scalps you should happen to stumble across. Obviously, they know that scalping the innocent is more proftable than scalping al Qaeda, so we would ordinarily believe they had some responsibility for the resulting massacres of innocents.

        Because spyware and murder are basically the same thing :)

    • Re:Student's Fault (Score:5, Funny)

      by strider44 ( 650833 ) on Sunday February 12, 2006 @09:08AM (#14699554)
      Colt manufactures guns. Man opens fire in public with a Colt pistol. Who's at fault? The shooter, of course.

      Haven't you been reading the summary? It's the victim's fault for not wearing a bullet proof vest!

    • Re:Student's Fault (Score:5, Informative)

      by malkavian ( 9512 ) on Sunday February 12, 2006 @09:15AM (#14699575)
      And what kind of intensive care unit is "shut down" when they can't use computers?

      I work in a hostpital as one of the business continuity team; we keep the place running in the event of something just like this, and have to evaluate the problems that'll occur in an outage if it happens.
      ITU is dependant on having patient records, history, full charts and responses available in a very rapid fashion. When the computers go down, they don't stop working, just all the communications that happen near instantly suddenly have to be ordered from medical records, and use sneakernet, which is a massive time overhead. In time critical requirements, this may mean the difference between life and death.

      Fair enough, the hospital should have been more secure, but there again, it all comes down to how many admins they have on the job. I know my time is allocated (still) in a very small part on security. I'm pressing to have more allocated. And my budget for security tools is small. Hell, with the NHS budget cuts next year, we'll be lucky to have much budget at all. Still, it's improving slowly. I'm still not happy with it, which gives me more incentive to work harder on it.
      But anyone who would attack a hospital system has to be aware that lives are at stake here, not just a few pounds/dollars. In commercial places, I'd frequently warn people if I could work out who they were, or the admin of the sytems they came in from if I couldn't. Eventually, I'd call the police if I believed they were being too persistent, as a last resort.
      In the hospital, I spot an attack, police will be warned promptly. No messing around. The place I work at saved my brother's life years back in ITU (when, by rights, his injuries should have killed him). I'm a little protective of the work they do, and the systems that let them do their job more efficiently. After all, they may just make that difference between life and death in the borderline cases, and every little win by the skin of the teeth means a lifetime to somebody.

      That was just a clarification, not a dispute. I'm behind you all the way in the sentiment you express. They're in trouble, and justly so.

      • Fair enough, the hospital should have been more secure, but there again, it all comes down to how many admins they have on the job.
        If the US health-care system was not bogged-down with private insurance company administrative overhead, and had so much of it's money diverted into croporate profits, they'd be enough money for proper network administration.
    • Comment removed based on user account deletion

      • Re:Student's Fault (Score:5, Insightful)

        by TFGeditor ( 737839 ) on Sunday February 12, 2006 @10:25AM (#14699871) Homepage
        Bullshit.

        I used to be on the "Microsoft sucks" bandwagon, but then realized that "security vulnerabilities" would not exist if there were no dirtbags exploiting them.

        No, vulnerabilities or not, it is not Microsoft's/Bill Gates' or Steve Jobs' or Linus Torvald's fauly when some criminal with a computer wreaks havoc on the internet or a private network. It is ALWAYS the criminal's fault.

        An unsecured system is no more an "invitation" to exploit than a short skirt is an invitation to rape.

        • -1 Totally Wrong (Score:4, Insightful)

          by dustmite ( 667870 ) on Sunday February 12, 2006 @01:32PM (#14700701)

          but then realized that "security vulnerabilities" would not exist if there were no dirtbags exploiting them

          Yes they would - security vulnerabilities are defects/holes in the software and they would exist regardless of whether or not they were exploited. (If a lock manufacturer makes locks that are easy to pick, those locks are easy to pick regardless of whether anyone actually uses that fact to break into something. Your 'tree falls in a forest' logic is wrong, unless you believe in 100% relativism, which anyone who has ever bumped their toe against something in the dark will be able to tell you is nonsense.)

          Perhaps you were thinking of "exploits". But if you can't even get the most incredibly basic security terminology right, I'm not sure you are qualified to be saying anything about computer security at all.

    • If I offer ten thousand for the death of <name>, sure, the person who kills them is at fault - they're just as guilty as if they'd randomly killed them - but I am at least partly to blame too.
      If I leave my door unlocked, and get burgled, sure, the burglar is at fault - they're just as guilty as if they broke through ten metres of steel plating - but I am at least partly to blame too.
      What the others have done doesn't detract in any way from the guilt of the students - but it doesn't mean they're blamel
      • If I leave my door unlocked, and get burgled, sure, the burglar is at fault - they're just as guilty as if they broke through ten metres of steel plating - but I am at least partly to blame too.
        I disagree. The only reason we have to lock our doors is because there is some problem with our society in that some people don't seem to realize that if something belongs to someone else, that you are not supposed to mess with it. There should be no reason to lock our doors, no need to run antivirus, no need to bl
        • I disagree. The only reason we have to lock our doors is because there is some problem with our society in that some people don't seem to realize that if something belongs to someone else, that you are not supposed to mess with it.

          But you know these people exist. If desite that, you still insist on leaving your car unlocked with the the key in the ignition, I will blame you for being stupid -- and your insurance won't pay up.

    • Re:Student's Fault (Score:5, Insightful)

      by Mistshadow2k4 ( 748958 ) on Sunday February 12, 2006 @10:09AM (#14699784) Journal
      Making guns isn't really comparable to an adware company offering incentives to execute botnet attacks, imho. It would only be comparable if the gun manufacturer offered rewards for shooting people, which I've never heard of any doing. If someone takes out a contract on another person's life, we don't let them walk away and just punish the hitman.

    • Re:Student's Fault (Score:5, Insightful)

      by v1 ( 525388 ) on Sunday February 12, 2006 @10:10AM (#14699787) Homepage Journal
      So who's really at fault here? The students? The hospital for not securing their computers and network? Or the adware companies for providing the incentive?"

      YES

      Though not all to the same degree as I'm sure you would agree. The student is of course the one that chose to break the law, and is most directly responsible for his actions. He was influenced by the adware company that offered incentive to break the law, "conspiracy to commit felony" or some such law. It's not as severe of a punishment as the felony (usually) but it's still illegal and clearly wrong.

      "blame the victim" is a more controversial issue. I believe that "gross neglegence to protect one's own best interests" should in itself place a small amount of the blame on the victim. The world is not perfect, everyone is not honest, and you cannot possibly convince me that anyone in the world believes everyone around them is a saint. By not taking basic precautions when exposed to the general public, you dramatically increase your risk of becoming a victim, and that is your fault.

      If I leave my car parked for a week downtown with the doors unlocked and the keys in the ignition, I'd be quite surprised to find it there a week later when I returned for it. Am I the one that stole the car? Of course not. But did my actions (or lack of actions) knowingly contribute to the theft? Of course. Were they easily preventable? Of course. That's why many insurance companies will not insure against theft if you leave your car unlocked and keys in the ignition, they recognize that you invited unnecessary and excessive risk.

      I believe that the ones who so strongly resist blaming the victim are those that either have been victims in the past or that are afraid of becoming a victim, and believe that they have no responsibility to take care of themselves, and that the world should protect them. They are living in a fantasy world.

      Looked at another way, criminals prefer easy targets, and this is a known factor. By taking less precaution for your safety and security than the average person, you attract the criminals to you and increase your odds of becoming a victim. Choosing to do that has got to be considered an error in judgement.
      • I work for the Department of Redundancy Department.

        Which one?
      • Hear hear. There's plenty of fault to go around.

        Here's another analogy that should make it even clearer:

        A bank puts its customers' deposits in a bushel basked behind a non-armor plate-glass window and closes for the night. A thief comes by, breaks the glass with a hammer, grabs the money, and runs.

        Who's to blame?
        - The bank?
        - The thief?
        - The manufacturer of the hammer?
        - The manufacturer of the plate glass window?
        - The car dealership selling the luxury car the thief w
    • The government should be taking every opportunity to show that attacks like this will be handled sternly. Stick him in a dungeon and give him the Abu Ghraib treatment
    • "And what kind of intensive care unit is "shut down" when they can't use computers?"

      RTFA, dude. They went back to sneaker-net, visual ID and phone calls.

      Every department of any hospital I have worked in has a backup plan for when the 'puters are down. It usually involves a pen and a bunch of paper.

    • Re:Student's Fault (Score:2, Insightful)

      by ninji ( 703783 )
      I've got no choice but to agree. Even if it was in no way intentional to have anything relating to a hospital's systems, If your going to do something illegal for profit, everything that happens as a reprecution is your responsiblity. Direct or indirect, you are the cuase for those actions, and in this case, it is quite direct.

      I could see his charge being lowered, for the hosptial shutting down being unintentional, but should definetly still be a large amount of jail time. By this I mean, If I blow up large
    • There is nothing in that article that suggests to me that the perp deserves to be sexually assaulted. Perhaps if you'd actually seen the results of sexual assault you wouldn't be so flip about it happening to anyone, even criminal scumbags.
    • And what kind of intensive care unit is "shut down" when they can't use computers? It's not like their work would have to grind to a stand still
       
      RTFA before typing:
       
      Key cards would no longer open the operating-room doors; computers in the intensive-care unit shut down; doctors' pagers wouldn't work.
       
      Work most certainly DOES grind to a halt when you can't even get in the door.

    • Re:Student's Fault (Score:5, Insightful)

      by mortis_aeturnus ( 606421 ) on Sunday February 12, 2006 @11:56AM (#14700288)
      If you believe that some of the hospital staff is not partially at fault, then you are either not a proponent of personal responsibility, or you are a contradicting yourself.

      The criteria for responsibility is cause and effect. If one entity was not present or did not perform an action (or held an inaction), and the problematic event did not occur, than that entity is responsible.

      Victims should not deserve any benefit of lax criticism solely for being a victim. Furthermore, those who wrongfully claim to be a victim when they are not victims are clearly liars.

      In this case, the victim is not just the hospital. The victims are also the patients of this hospital. However, the patients were at more of a loss than the hospital itself. There has been little discussion of how the hospital staff should be protecting the patients from this attack. The staff is complacent in their inability to protect the integrity of the hospital and, more importantly, the well being of the patients.

      Consider the following examples. If a hospital did not use use sterile equiptment and patients become infected with a pathogen, should the hospital be responsible, or should the pathogen be responsible. By your logic, the pathogen will be responsible. However, the hospital is clearly at fault here.

      If a network of computers becomes zombies after an individual invades them, would you consider the owners of the computers to be at fault? Clearly, you might not. However the computers are similar to pets of an owner. If a pet kills a person, the owner is also at fault. Similarly, the owners of the computer(s) are also at at fault because their property is being used, addendum a hypothesis that the zombies are to be used in an invasive act, should be partially responsible. If one does not believe that the computer owners are at fault, then one can not support laws of most Western societies in their entirety.
    • Colt manufactures guns. Man opens fire in public with a Colt pistol. Who's at fault? The shooter, of course.
      I take issue with this analogy. Colt would be the equivalent of the companies that make the compilers for the software the students make. The adware companies would essentially be hiring out people as mercenaries. So I would say that it's the fault of both the students and the adware companies.

    • Re:Student's Fault (Score:3, Informative)

      by RESPAWN ( 153636 )
      I provide IT services in the healthcare industry, including work at several different hospitals, so here's my perspective on the situation. That said, please note that I'm not 100% up to date on the most current technologies since the hospitals I've worked at hadn't implemented many of them.

      Most likely, the ICU wasn't "shut down". Instead, it's much more likely that only those computer systems used for ordering, transactioning, etc. were shut down. Please note that any life critical equipment is typicall
  • If the hospital didn't have their network locked down (and it's in Seattle so they don't have the usual excuses) then they are in for a world of hurt from the state.
    The HIPPA failures alone for allowing this to happen are mind blogglying bad.

  • Who's at fault? (Score:5, Funny)

    by Anonymous Coward on Sunday February 12, 2006 @08:50AM (#14699495)
    So who's really at fault here? The students? The hospital for not securing their computers and network? Or the adware companies for providing the incentive?"

    This is slashdot. The answer to that question is either Bill Gates or George Bush.
  • Sounds like a setup for a Chewbacca Defense [wikipedia.org].

    It is a pity that the US legal system is no longer about justice; it is now about what can be proven.

  • The Perpetrators Are At Fault (Score:4, Informative)

    by Kurt Wall ( 677000 ) on Sunday February 12, 2006 @08:54AM (#14699506) Homepage
    Suggesting that the hospitals are at fault for failing to secure their networks adequately is assinine. The perpetrators are at fault. Adware companies might provide incentive and the hospitals evidently need to secure their networks, too, but culpability lies solely with the two defectives who committed the crime.

    • Comment removed (Score:4, Insightful)

      by account_deleted ( 4530225 ) on Sunday February 12, 2006 @09:23AM (#14699620)
      Comment removed based on user account deletion
      • Contributory negligence prevents a negligent party from collecting damages when another more ngeligent party injures them. If you're driving in both lanes of a road and a speeding car with a drunk drive hits you, the courts aren't going to give you as much money as they would if you were in your own lane. This likely doesn't apply to this case.
    • However, it raises the question: "Should everyone be authorized to plug anything, anyhow to the internet without a minimum of security measures?" And much more, "Should the hospital fire those IT peoples which plugged their network to the rest of the world without strong security measures?"

      How do you feel about being eventually cared by an hospital which the network and computers has been hijacked? Would you trust the medical records?

      And it's not to say the perpetrator is innocent, he is for sure guilty and

    • Re:The Perpetrators Are At Fault (Score:5, Insightful)

      by Mark Hood ( 1630 ) on Sunday February 12, 2006 @11:50AM (#14700262) Homepage
      [C]ulpability lies solely with the two defectives who committed the crime

      So do you lock the front door when you leave the house?

      Yes? But why, surely it's not your fault if someone comes in and takes everything, it's entirely their fault, no?

      Lock your car too? Use passwords on your PC? Do you walk along flashing your cash at all and sundry?

      You're right, it's the choice of these kids to break the law - but a hospital ought to 'lock the doors'... Not least because if they have a system that literally controls whether people live & die, they should not let just anyone have access to it. I want to know why the Intensive Care unit was on the Internet at all. If ever there was a system that should have an 'air gap' to the real world, it's that.

      And the people saying 'the hospital isn't to blame any more than a woman in a short skirt is to blame for being raped' - it's not about blame, it's about responsible actions. If a woman dressed provocatively walks home alone on darkened streets, of course she doest not want to be raped, but she has to appreciate it raises the likelihood. Rapists exist, and every woman has a duty to herself not to make herself a target. Criminals exist, and every person (institution, business) have a duty to themselves (and their customers) not to make themselves targets too. If you walk down the street with your iPod in your hand, a mugger is more likely to target you than if you don't - doesn't mean it's not his fault, just that you didn't try and protect yourself.

      Agreed, the 'short skirt' argument shouldn't get the rapist a lighter sentence, just because his justifcation was 'she was asking for it' any more than the hospital being insecure should reduce the penalty on these cretins. But I hope the judge says 'you see the scum that's out there? Be smart, be safe, and don't take the risk'.

      It's possible for both sides to be at fault - but that seems to elude a large number of the Slashdot 'group thinkers'. Lock these guys up as long as you like, but if you don't also get the hospital to wise up then it's pointless - there's a never ending collection of criminals out there... and next time someone could die.

      Mark

  • common factor .... (Score:3, Interesting)

    by 3seas ( 184403 ) on Sunday February 12, 2006 @08:56AM (#14699508) Homepage Journal
    computer industry....software...

    the analogies that others might post in this thread may not consider the possibility of doing it all different such that these problems either likley won't exist or they can't.

    Want protection from internet problems? Don't connect to it.But even the International Space Station has had its computer problems.

    Life support and computers......hmmmmm....

  • The students, of course (Score:3, Insightful)

    by SoupIsGoodFood_42 ( 521389 ) on Sunday February 12, 2006 @08:56AM (#14699512)
    What kind of idiot would blame the other two? No matter what motivates them, or who makes their job easier, they are the ones who are ultimately responsible for their own actions.

    • What kind of idiot would blame the other two?

      The kind of idiot that thinks that a hospital, being responsible for the wellbeing of its patients, were neglicent in guarding that wellbeing ? Or that the addware scum were perhaps being just a teeny bit guilty for offering a reward for illegal activities ?

      No matter what motivates them, or who makes their job easier, they are the ones who are ultimately responsible for their own actions.

      The students are responsible for their own actions. The hospital i

  • I'm not fond of the adware affiliate programs however, I don't believe that they're even remotely responsible for something like this. Responsibility for something like this falls directly upon the student who was launching the botnet attacks and I hope he's severely punished. Attacks like this could cost the lives of those that are receiving critical care at these hospitals.

    Obviously, the network could have been more secure but that doesn't change the fact that without assholes launching illegal attac

  • In my opinion (Score:2, Redundant)

    by Bazzalisk ( 869812 )
    The students are guilty of teh crime, but the adware companies are guilty of conspiricy to comit teh crime - and in this case I think that they are rather more culpable, since they are encouraging more people to do this. By all means prosecute the students (they deserve it), but if you want to fix the problem you need to chop off the monster's head.
    • From the article: Maxwell simply created a program instructing his infected computers, or "bots," to download the adware. The bots then "phoned home" to the adware company, which credits the hacker's account, unaware that he hasn't gotten the computer owner's permission."

      Yeah, right. "Unaware" my ass. They paid him to commit a crime, and it's not like adware outfits have a shining history of solid business ethic. I hope the Feds get his customer list.

      It sounds like this guy only got nailed because his

  • All three + few more (Score:4, Insightful)

    by luvirini ( 753157 ) on Sunday February 12, 2006 @09:00AM (#14699527)
    If you do not lock your network/car/house you are looking for trouble..

    if you make promotions that encourage antisocial behavior you should be ashamed..

    if you try to steal money frm above promitions by using above holes you are ofcourse a thing called criminal.

    And the extras: Companies making unsecure products..

  • for naming him Christopher.

    Aside from whether his name gave him a Jeebus complex, every Christopher I've met has spent time in jail, so he must be guilty.

    Chewbacca defense doesn't work either, since he doesn't CHOOSE to live on Endor.
    He just got a bad timeshare.
    • My name is Christopher, you insensitive clod!!!

      (My first real chance to use that /. staple...)

      And I haven't spent any time in jail, either, so you must know the wrong bunch of Christophers.....

  • It can't be networked... (Score:3, Insightful)

    by caluml ( 551744 ) <slashdotNO@SPAMspamgoeshere.calum.org> on Sunday February 12, 2006 @09:06AM (#14699544) Homepage
    Surely the actual ICU equipment isn't networked at all, and this just inconvenienced the admin and support staff in that dept?
    • Well, define equipment. Most larger hospitals are going to electronic medical records. Say that the computers by each bed in the Urgent Care area or in the ICU that are used to review patient medical records are infected and go down. Suddenly, the clinicians no longer have the ability to see the patients'

      • current medications
      • allergies

      and someone dies due to a medication problem.

      It sounds like they got lucky this time, but this is first-order scary.

    • I was just visiting my father in the hospital. Many of the patients had a wireless monitor tracking their heartrates. These heartrates were displayed on a series of computer monitors at the nurse's station. I think they were networked using a bunch of PC's.
    • Surely the actual ICU equipment isn't networked at all

      Sure it is. If someone flatlines, the attending gets a page. Furthermore, like someone said, it is pretty simple to throw 20 ekg's on a 24" lcd and monitor all the patients in the ward from a single location. And, of course, they have alarms that go off when someone flatlines too.

      Now, there is a way of doing this and isolating it from the Internet (aka, The Right Way). There is also a Really Wrong, No Seriously, How Goddamn Stupid Do You Have To Be To Do

  • Who's at fault? (Score:2, Insightful)

    by cbiltcliffe ( 186293 )

    So who's really at fault here? The students? The hospital for not securing their computers and network? Or the adware companies for providing the incentive?

    Yes.

    While I agree with some previous posts that most of the fault lies with the student who perpetrated the act, the adware company is an accomplice. They provided the financing to do an illegal act. That's illegal in itself in most places. Maybe they didn't know the students were going to do something illegal, which could be the technicality that

  • At fault: all three (Score:5, Insightful)

    by hellfire ( 86129 ) <deviladv AT gmail DOT com> on Sunday February 12, 2006 @09:07AM (#14699550) Homepage
    All three are to blame, but to different degrees.

    The students should be taken out and beaten. Anyone with any level of computer knowledge these days should know such activities are both highly immoral and illegal. This isn't stealing MP3s. And to attack a hospital? How thoughtless can you get? However, it's easy to be tempted by this type of thing, while these students got caught, many more got away with it at some point.

    The Hospital should be scolded, but it's hard to know just from the story to what degree. It could range from a slap on the wrist to a lawsuit. If they had good computer security, then the students were just good at getting through. If it was bad computer security, then they need to step up and admit it. In any case, they are a hospital that appears to be running Windows to control their sensitive security systems. Bad choice, and that alone warrants one finger pointed at the hospital, if it's true. However, many hospitals are notoriously underfunded. In any case, I hope the IT staff of the hospital reviews this situation and revamps their software to minimize this risk in the future.

    The adware makes should all be taken out and shot. They are the immoral facilitators and the ones who should take the most blame. They are the modern day equivalent of drug dealers. They didn't kill the person taking their drugs, but they knew it eventually would come to that, and they never stopped selling. They put all the risk for the crime on the students, knowing full well they could get caught, and that someone elses computer system would be seriously damaged. Something very gruesome and painful should befall them, before execution.
    • However, many hospitals are notoriously underfunded.
      Haha, funny. The truth is that many hospitals want you to believe that they are underfunded, when in fact, they have more than enough money, the extra just goes into administration. Of course, IT budgets typically suck in hospitals (they have to keep up this image). It's sort of like running a non-profit, you have to toss the spare money around, but make it look like you really don't have any to spare.


      In any case, they are a hospital that appears to be run

  • shameful suggestion (Score:3, Insightful)

    by jdwclemson ( 953895 ) on Sunday February 12, 2006 @09:13AM (#14699571)
    Is there no end to the chaotic suggestion that the victims are at fault? People SHOULD lock their doors, they SHOULD keep their children from strangers, they SHOULD avoid walking down dark alleys late at night. That doesn't mean they are the ones at fault with the burgler, rapist, or thug attack. When you even suggest the fault lies with anybody but the attacker, you only validate them as being victims of lose security. This breeds contemptable statements such as "it wasn't my fault I killed the man, he should of had a gun to stop me". Absurd? I agree, Zonk's suggestion certainly was.
    • Look bub, there are two basic schools of thought

      Type 1. The world is your oyster. Leave your doors unlocked, take candy from strangers, reply to that nice man from Nigeria who e-mailed you, leave your CD case on the dash and don't worry about walking through that bad neighborhood at 2 AM.

      Type 2. The world is full of evil motherfsckers and no one will ever help you. Carry a gun, knife or mace, deadbolt everything, don't let your child out of your sight, run a background check on your daughter's new boyfriend
  • So who's really at fault here? The students? The hospital for not securing their computers and network? Or the adware companies for providing the incentive?

    All of the above.

    DUH!

  • Stupid question (Score:5, Insightful)

    by SmallFurryCreature ( 593017 ) on Sunday February 12, 2006 @09:27AM (#14699629) Journal
    So who's really at fault here? The students? The hospital for not securing their computers and network? Or the adware companies for providing the incentive?

    Note that what follows below is only based on RTFA wich as usuall when dealing with mainstream press reporting on tech may be wrong or inaccurate or indeed made up on the spot. Nonetheless based on this I conclude the following.

    That the student used zombie computers to install adware software that would then generate 'hits' for the students account so that he would be paid. He was using computers he did not own to defraud adware companies by generating false ad hits. This is a wellknown fraud dealing mostly with pay-per-click style ad schemes.

    So who takes blaim here and for what? Funny enough that the 'question' left out the first and most obvious cullprit.

    • Microsoft for creating an OS that never bothered with security. How do I know it was windows that was hacked? Because everyone know just how many ad programs there are that run on that various unix like OS'es out there.
    • The hospital for not buying proper software, anything not made by MS, and not properly securing their infrastructure. Yes criminals are to blaim for breaking in but you should still lock your house.
    • The adware companies really ain't to blaim that much. They are the victims here. The only blaim they share is like with the hospital in that they do not properly secure their operations to guard against fraud. But since they are the ones who lost money by paying for fake advertising they are the victim.
    • And finally the student. Well it is clear he is a criminal, he took computers that did not belong to him and used them to defraud a third party (the ad companies) for his own personal gain. He is not just some hacker who got caught playing around, he was doing it for the money. I doubt very much he is in fact a hacker, more likely he just used readily available tools to do the work for him. This makes him a simple criminal.

    I am amazed that MS was not mentioned as one of the cullprits. How often does their software got to lead to crap like this before people will finally ban it for any serious use. Would we accept a hospital that used say oxygen bottles filled by the local scuba diver club? Use alcohol produced in someone's bathtub?

    I would very much like to hear that the person responsible for that hospitals computer systems is fired and never allowed to work again. Yes the student is the criminal here who deserves jail time but a sysadmin who installs windows deserves the chair. And yes I would be happy to throw the switch. Hell I would be happy to peddle on a bike to generate the electricity.

    If I sound a bit biased against MS it is because I have once again been drafted in working on some piece of crap MS setup because some MSCE idiot made a nice sales pitch. Why don't you just put a sign on your server "Own me!" and be done with it.

    • What nonsense.

      Sure, Microsoft should be producing secure software - especially with their R&D budget and the amount of talent they have.

      However, to believe that they're liable for an illegal crime committed by two greedy students wanting more money is nothing short of proposterous.

    • It's your fault I just smashed your window with a rock. You should have hired guards to keep me away, or moved to an apartment on the 20th floor where I can't reach it. It's also the window company's fault for not making them out of Lexan. I'm just showing you the flaws in your security.
    • He was using computers he did not own to defraud adware companies by generating false ad hits. This is a wellknown fraud dealing mostly with pay-per-click style ad schemes.

      Please. The adware company itself makes money on every single ad display / clickthrough. They aren't victims here because they made a ton of money by being "victimized".
      It might not be conspiracy to commit fraud, but if you are in a shady market and get paid for fraudulent clicks, it makes it reeaally easy to overlook suspicious behavior

  • Re:Student's Fault (Score:4, Insightful)

    by loraksus ( 171574 ) on Sunday February 12, 2006 @10:20AM (#14699850) Homepage

    The students, clearly.
    Colt manufactures guns. Man opens fire in public with a Colt pistol. Who's at fault? The shooter, of course.

    The difference is that colt doesn't pay people to fire their pistols in public. Now, this doesn't absolve the dumbass of any responsibility, but it sure as hell makes the adware company an accessory. Seriously, they didn't think anything was going on when someone gained 50,000 PCs in a couple of weeks? They knew and didn't give a shit because they were paid even more money by the people whose "content" (read: shit) they were serving up.

    Kneecap 'em both (yes, there are more than 2 people involved) - and I mean this quite literally, this sort of shit would get nipped in the bud quite quickly if we went IRA on them and used a makita drill (or would it have to be Black and decker, you know, for the whole "made in america" thing.)
    A couple hundred companies should also be knocking on the adware companies' doors, "politely" asking for a refund and leaving letters from their lawyers.

    And, to be quite honest, a couple sysadmins also need a kick in the ass with a steel tipped pointy boot. Why would your keycard system be connected to your network, especially in a hospital situation? To say nothing of the fact that the pager system got owned (from what I understand, pagers are sort of important to doctors in hospitals) and it seems that pretty much everything was disrupted because ~15% of their computers were infected.
    Not blaming them for the attacks, of course, but lets be serious, this was a pretty big screwup on their part. Then again, given hospital politics, it probably wasn't the sysadmin's fault, but a department head who has no training in IT, but does everything Toilet and Douche tells him to do.

    Finally, id by some small chance, Christopher Maxwell is reading this, I can only hope that in 15 years you will remember your job at WalMart and recall how it was the best job you ever had.
    Don't drop the soap, bud.
  • We're in a pretty 'ucked up world if someone has to ask who is at fault. Lock him up.

  • Before you blame the admins... (Score:4, Insightful)

    by NorbrookC ( 674063 ) on Sunday February 12, 2006 @10:34AM (#14699909) Journal

    Yet another slashdot thread where everyone immediately starts screaming "Linux!" "BSD!" the second they hear the term "security breach". Of course, it'd be nice if there were actually a lot of applications for healthcare that run on those OSs - which there aren't. OSS is pretty thin on the ground when it comes to this field.

    Why don't you look and see what's involved in hospital IT? I've been there, and it's a major headache for admins. You have administrators who don't really know much about computers and doctors who are frequently the biggest prima donnas in the world when it comes to getting what they want, in a corporate culture which caters to them.

    Add in software developers who frequently have no clue as to what's actually needed, how to make a useable UI, and how information flows in a healthcare setting. But they have a hell of a sales pitch to the doctors and administrators, and you're the one who has to make it work.

    Now try to secure it. Really! Wait until the first time Doctor X decides they're going to install their personal software on the workstation. Never mind that supposedly they're not allowed to do that - they'll do it anyways and then scream at you when you take it off. Take a wild guess as to who the hospital's going to back!

    It's easy to blame the IT people, and the use of Windows, here. Wrong, but easy. They picked it up pretty quickly, and dealt with it. I'm sure they'd have loved to have more control, but unfortunately it's a question of what you're allowed to do, not what you want to do.

    • The doctors are at fault (Score:3, Informative)

      by mangu ( 126918 )
      You have administrators who don't really know much about computers and doctors who are frequently the biggest prima donnas in the world when it comes to getting what they want, in a corporate culture which caters to them.

      Then it's very obvious that the doctors are at fault. A doctor who doesn't scrub thoroughly enough before performing a surgery cannot blame the infection on the germs. A hospital that relies on a computer system that isn't secure enough cannot blame the crackers.

      Microsoft software shouldn'

      • Microsoft software shouldn't be allowed in hospitals for the same reason pets aren't allowed in surgery rooms.

        Nice - but do you know how little software for hospitals is available that doesn't require Windows? I'm serious. I know a lot of healthcare IT people who'd love to be able to move away from Windows, but you can't work with something that doesn't exist. Which is the state of OSS - and even the various closed *nix systems - in this area. Not enough applications.

        A doctor who insists in having

    • Yet another slashdot thread where everyone immediately starts screaming "Linux!" "BSD!" the second they hear the term "security breach". Of course, it'd be nice if there were actually a lot of applications for healthcare that run on those OSs - which there aren't. OSS is pretty thin on the ground when it comes to this field.

      It's not just healthcare apps... The vendor of vertical app my wife (who is the comptroller) uses in her business is switching from Linux to Windows - because their TCO is *higher* un

  • Let's say I have a car with a nice stereo in it. I leave the car unlocked all night, and in the morning discover that the stereo is missing, having been ripped out of the dash with what I can presume was a crowbar.

    The crowbar company is not at fault. I am not at fault, even if I am stupid for having left the car unlocked. The thief is at fault, the end. My leaving my car unlocked does not give anyone the right to enter my car for any reason.

    Just because computers are involved doesn't mean the rules chan
  • But the crime was commited by the kid. Guilty as charged. As for the admin and adware, you don't learn near as much from success as you do from failure. I bet the hospital tightens security after this. As for the adware... Well, they will learn if it fits into their business practices.
  • "So who's really at fault here? The students? The hospital for not securing their computers and network? Or the adware companies for providing the incentive?"

    In order, I would rank:

    the student

    the adware companies

    the hospital IT staff

    THE STUDENT (80% blame)

    has no excuse for his actions. He deserves the prison sentence he will no doubt get.

    THE ADWARE COMPANIES (15% blame)

    Just when I thought they could not be any more despicable, they prove me wrong. (One of the tasks I deal with is cleaning up,

  • We're at fault (Score:4, Insightful)

    by Simonetta ( 207550 ) on Sunday February 12, 2006 @12:34PM (#14700473)
    We are the ones who are responsable. Because, we, the technological elite, have done nothing to prevent this type of situation from occuring. And we have the power to do so. But we don't have the spine to accept our responsibilities for the technology that we create.

        Who should go to jail or at least get tossed out of school? The students of course. For unleashing deliberately an uncontrolled technology for profit without making any preparations for the consequences.

        If you are a chemical company and you dump poison into a stream or pump it into the air to get rid of industrial surplus, and this directly causes death and destruction, then you are responsible (at least in the civilized world). You make sure of the effects of what you do before you do it.

        Same with software. The days are just about over where people will accept unwanted consequences of bad software as unforseen 'acts of God'. The time is coming to an end where you can publish any junk with a tiny print disclaimer stating that you as the software creator are not responsible for anything that the software does.

        Same with malware. The software company that put out this adware program should be sued out of business, and the programmers should be blacklisted for creating an application that was outside of acceptable guidelines. And we as the technical elite should set and enforce the guidelines. This is an idea whose time has come and no one else can do it but us. This is the only way that this type of thing will stop. And if the adware program sellers don't like it, too bad. We created the net; we control the net; we take responsibility for what assholes do on the net; we punish the assholes who don't follow our guidelines. That is the way it should be. It would improve the position and respect that geeks get in society.

        Blaming the hospital is like blaming 911 equipment makers for the situations that caused people to call 911 (an emergency telephone code that contacts help in the USA). No one would blame electrical equipment manufacturers for the acts of a criminal deliberately cutting the power in a hospital.

  • Why do they need the internet in the first place? (Score:5, Insightful)

    by atomic_toaster ( 840941 ) on Sunday February 12, 2006 @12:59PM (#14700579)
    Let's set the argument regarding who is at fault aside for a moment. Let's even set aside the "this wouldn't have happened on a non-Microsoft OS" hyperbole. My main question is this:

    WHY WERE THE HOSPITAL'S COMPUTERS CONNECTED TO THE INTERNET IN THE FIRST PLACE?

    I can't think of a single reason that the computers containing confidential information, personal medical records, and systems necessary for the day-to-day running of the hospital weren't on a stand-alone network in the first place. There are probably some tools that require internet connection, but why weren't these tools run on separate computers? It's fairly easy to transfer data from an internet-connected computer to a non-internet-connected computer (and vice-versa) with floppy discs, removable drives, CDs, DVDs, etc. It may create a small extra step every once and a while, but it's not like the dangers of computers being hacked over the internet is unknown. Even if it did not create an ethical dilemma to have patient records possibly available to a competent internet hacker, the threat of massive lawsuits should such information be stolen should be enough to create some justifiable paranoia about internet attacks. Also, if someone had died because of a slowing of communications within the hospital due to the current hacking, the hospital probably would have been faced with a wrongful death suit. Whether the hospital lost such a lawsuit or not, it would still cost a lot of money and effect the bottom line.

    Come on, people, this should be a case of enlightened self-interest. It may be the robber's fault if the robber comes into your house through an unlocked door, but the insurance company won't cover your losses if you left the door unlocked. Locking your doors can be a bit inconveninent if you have to get the door open again while carrying an armload of groceries, but it's worth the security in the long run.

  • It's web of stupidity. (Score:3, Insightful)

    by Inoshiro ( 71693 ) on Sunday February 12, 2006 @01:23PM (#14700666) Homepage
    "So who's really at fault here? The students?"

    Yup. Motive, means, opprotunity. S/he went ahead and performed a crime. This is the easiest to prosecute under the very slow-to-adapt laws that exist at the moment.

    "The hospital for not securing their computers and network?"

    Yup. Not taking due care with patients' lives is a felony, IIRC. This is as bad as not requiring your doctors to have a degree or wash their hands. The hospital is lawfully required to set safe standards.

    "Or the adware companies for providing the incentive?"

    Yup. These folks are guilty of a different crime, but still guilty. I don't know why there aren't more police aresting people and charging them with theft of service. Ad-ware is almost exactly like spam in terms of its side effects and damage.

    Everyone is guilty! Only the student will be prosecuted, unless some smart lawyers get on it.

  • Shades of (blame) grey... (Score:4, Insightful)

    by Shoten ( 260439 ) on Sunday February 12, 2006 @01:30PM (#14700695)
    The students are at fault, above all else. But I can't believe that the IT department of the hospital was so incredibly foolish as to put everything on the same network. Access control for the doors, computers in the ICU, the system that handles paging doctors...all on the same net instead of broken out by system? What the hell? Did the system at the nurses' station in the ICU NEED to have direct connectivity to the card reader on the door?

    I don't think for an instant that the students who exploited systems at the hospital are in any way excused by the fact that the hospital set themselves up for a good hard screwing once they got exploited. But anyone...ANYONE...in a role of designing networks and systems needs to face the facts that such people do exist, are out there, and are very busy. You have to plan for certain "what if" situations, and this is a textbook example of one such scenario. That the IT department of the hospital put all of their eggs into one networking basket as they did is utterly inexcusable, and they too share some blame for planning a system on the proverbial assumption that there are no bad people in the world.

  • STRAW MAN! Patients - not hospital are victims... (Score:3, Interesting)

    by hung_himself ( 774451 ) on Sunday February 12, 2006 @02:54PM (#14701044)
    Of course the students and adware companies were wrong but the scariest part of it was that the hospital - is getting off so easily - even in the land of geeks. What would be the reaction if the hospital had left its records, medications, instrumentation out in the open and physically rather than just electronically accessible to the public? If someone had died - who do you think would be sued - the idiot who tried to pawn the heart monitor or the hospital for leaving it on the street?

    For those not familiar with the health system here - it is a private one. The motive for hospitals is to maximize profit while minimizing costs. Since there is relatively little public accountability through the government, and individual patients are largely unaware of the relative quality of hospitals, health care insurers are the ones that keep costs from getting too high and malpractice suits keep quality of care from getting too low. Mistakes can cost money - but admitting mistakes can cost a lot more and thus the level of cover-your-butt here is amazingly high.

    In such a CYA environment, I question two things - the assertion that noone was hurt - and that the bot attacks were the ones that brought the network down. Both of these things may be true but are also things that administrators would say to prevent lawsuits. The fact that the staff was able to adapt so well to the computers being down suggests to me that this is not the first time that it has happened. In any case, there is no question that the computer network is poorly setup and that is almost certainly the fault of the administration. The docs can get away with small things like putting screensavers on their machines but it would take a high level admin who wanted to save money by using the same OS across the board and/or wanted remote connectivity so that his crackberry could work more easily to really screw things up. If there are lawsuits - things will probably change - not necessarily to do things in a sane matter - but so that they can't be sued. The same calculation (effect on lawsuits) will also be used to decide whether and who will be fired/scapegoated over this - and it won't be the admin with the crackberry. At worst he/she might be made to go on a junket to Japan to learn how to run a hospital more like a automotive assembly line...

  • Who's at fault? All of them! (Score:3, Insightful)

    by kavau ( 554682 ) on Sunday February 12, 2006 @03:35PM (#14701206) Homepage
    "So who's really at fault here? The students? The hospital for not securing their computers and network? Or the adware companies for providing the incentive?"

    How about "all of them"? Our society likes to attribute guilt to a single party (or even a single person, aka scapegoat) whenever possible and convenient. Makes the task of appearing to make progress and fixing things much easier, I guess.

    Shit happens when idiots collide.

Slashdot Top Deals

news: gotcha

Close