The Nhs Cyber Attack

[horseshoes]

Not knowing the first thing about how they have made this attack, please give me your views.

A) could it possibly be a 15 year old in his bedroom acting alone, or does it have to be more sophisticated?
B) will anyone pay the ransom and if they don't, what will happen?
C) how easy would it be to find out WHERE the attack originated from?
D) how severe would the punishment be if they found the culprit?

[Mamyalynne]

All answers to those questions would be guesswork at this stage - the big guns are working on it.

Scary really.

[EDDIE51]

The spread of the virus has apparently been stopped
http://www.independent.co.uk/life-style/gadgets-and-tech/news/nhs-cyber-attack-ransomware-wannacry-kill-switch-domain-name-malwaretech-a7734296.html
But sites already infected are still struggling to get up and running again.

[horseshoes]

Oh I realise it's still guesswork Mamy, I was just interested in people's opinions really. It IS scary. Mind you my hospital records aren't at risk - they've already lost those! It does have such terrible implications for patients though. I read today that doctors can't access test results etc etc. some patients must be at dreadful risk. If someone dies as a result of this attack, and they catch the perpetrators the charge should be murder or at least manslaughter; but then it would have to be proved it was as a direct result of the attack. I'm thinking ahead of myself now, my head will be hurting soon!

[horseshoes]

Eddie, that's incredible. It sounds as if he almost found it by accident!

[EDDIE51]

I have also heard that the NHS was so badly affected because most of it unbelievably still uses Windows XP ! Which is no longer supported by Microsoft and therefore prone to attack.

[-Talbot-]

As Mamya says the big guns are working on it and I'm sure when things are under control HansUrbancka will post his findings.

[bhg481]

Microsoft have just issued an update for Windows XP as a result of the attack.
It's all very well for people to criticise firms for not updating from XP but it can prove very expensive to replace printers etc which may not work on a new OS. (I lost a perfectly good laserjet printer when I moved from XP to Vista with a new desktop). On top of that, not all users are computer-savvy and can get confused by a new system.

[EDDIE51]

It was not guesswork the man who found it is among the world's leading malware detection experts. He intentionally 'trapped' the virus.
Using a complex system to attract it into a specially made web site that it could not get out of. I do not pretend to understand how he did it but he has been working on a solution since it was first detected.He even cancelled his holiday so he could work on it 24 hours a day.

[horseshoes]

Wow Eddie, he's a clever chap then.

[horseshoes]

Eddie, "guesswork" was used in reply to Mamya's first answer, not the malware man:-)

[Mamyalynne]

Accidental Hero but Hero nonetheless.

//I will confess that I was unaware registering the domain would stop the malware until after i registered it, so initially it was accidental.//

http://www.itv.com/news/2017-05-13/accidental-hero-triggers-kill-switch-to-halt-spread-of-cyber-attack/

[horseshoes]

Serendipity!

[-Talbot-]

EDDIE51
It was not guesswork the man who found it is among the world's leading malware detection experts. He intentionally 'trapped' the virus.





I will confess that I was unaware registering the domain would stop the malware until after i registered it, so initially it was accidental.



EDDIE strikes again.

[gingejbee]

Calling it "the NHS Cyber Attack" is a tad parochial, isn't it? It's effects were felt worlwide....

[Old_Geezer]

There is a difference between creating such a thing from scratch and getting hold of it and releasing it. It would be my guess that the basic code has been around a long time and someone has fiddled with a few details and released it. It's worldwide hit at once action suggests to me something that got out of hand since no one in their right mind wants all the worlds governments checking for them at the same time. Surely, ideally, one targets one or two large companies at a time in the hope that they pay up and then write the loss off.

Some may pay the ransom. Those that don't risk having to wipe their disks and reload their backup. Unless they have the resources to repair the problem.

As for how easy and what would happen, I don't know but I suspect there is a heck of a lot of skilled IT folk checking. As this could result in deaths from hospital disruption I'd hope the gaol terms would be in the decades. It should be given the sheer amount of extortion anyway.

[EDDIE51]

Talbot, The guy was studying the virus and saw it was trying to get into a specific 'domain' that had not been registered. He immediately registered the domain so that he could study it when it entered 'his' domain. He intended to 'trap' it for further study when it was in his domain but once it entered he found it had been deactivated. So yes, in that sense it was 'accidental' but the guy knew enough to set up a domain that he knew would attract it.
I do not see that as 'accidental'. It took a huge amount of computer power , knowledge and skill. If you read my link it says he almost 'lost' it due to the massive amount of memory it needed to hold it in his new domain.

[Togo]

//Prior to the dump, Microsoft released a fix, or patch, for the issue, although computers that did not install the update, or could not due to the age of their software, would have been vulnerable to attack.//

From the link attached. Moral of the story do your upgrades, particularly security upgrades, and keep your operating systems up to date.

http://www.msn.com/en-gb/news/uknews/nhs-cyber-attack-uk-researcher-accidentally-stops-global-spread-of-ransomware-by-activating-kill-switch/ar-BBB4Zv8?li=BBoPWjQ&ocid=spartannt

[Togo]

//"If large numbers of NHS organisations failed to act on a critical notice from Microsoft two months ago, then whose fault is that?" //

Also in the previous link.

[Togo]

And.
//The US Department of Homeland Security said on Friday that the patch, released by Microsoft on March 16, "addresses this specific vulnerability, and installing this patch will help secure your systems from the threat".//

[Togo]

Just as an after point. No Hospitals in Wales were affected.