Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Australia Medicine Security IT

Virus Shuts Down Australian Ambulance Dispatch Service 222

Posted by timothy from the severe-spankings-called-for-in-certain-basements dept.
angry tapir writes "Computers which co-ordinate ambulances in NSW, Australia, are back online in three of the state's regions after a major virus forced staff to shut them down for more than 24 hours. The virus crept into the Ambulance Service of NSW's dispatch system, prompting staff to co-ordinate paramedics by telephone and handwritten notes. The cause and source of the virus are not yet known."
This discussion has been archived. No new comments can be posted.

Virus Shuts Down Australian Ambulance Dispatch Service More

Virus Shuts Down Australian Ambulance Dispatch Service

Comments Filter:

  • I know what caused it (Score:3, Insightful)

    by Anonymous Coward on Sunday February 13, 2011 @07:35PM (#35195520)

    "The cause and source of the virus are not yet known."

    I'm gonna take a guess at the cause: somebody decided to use a Microsoft product to control a critical system on which people's lives depend.

    If a bank used an armored car made of cardboard to transport money, would you blame the inevitable robbers, or the bank?

    • Re:I know what caused it (Score:5, Insightful)

      by gandhi_2 ( 1108023 ) on Sunday February 13, 2011 @07:42PM (#35195588) Homepage

      I'm gonna take a guess at the cause:

      letting mission-critical systems be used by employees to surf facebook and download cute fonts and wallpaper.

      • Re: (Score:3, Interesting)

        by Zancarius ( 414244 )

        I'm gonna take a guess at the cause:

        letting mission-critical systems be used by employees to surf facebook and download cute fonts and wallpaper.

        Most likely: Yes.

        A friend of mine works non-emergency dispatch--not quite the same thing as an emergency service, of course--and I get the impression that their network admin has a mild case of brain damage. Apparently they're prohibited from using non-MSIE browsers. Period. End of story. If it's not MSIE, it doesn't belong on the machine. I don't know if their int

        • Re:I know what caused it (Score:4, Funny)

          by micheas ( 231635 ) on Sunday February 13, 2011 @08:31PM (#35195858) Homepage Journal

          When I briefly used windows 2003 I was surprised at how easy it was to lock down IE.

          I was further surprised by the number of things that did not work when IE was locked down and security exceptions had to be added. (Quickbooks being the one that I remember, because it took a fair amount of searching to find out what the exact rule that was needed in order for it to work, most people seemed to just unlock IE, if the forum posts I was reading are any indication.

          There seems to be a common attitude about system administration that if you run everything as Administrator, chmod -R 777 ./, disable SELinux, unlock IE, or run all your server process as the same user (here's looking at you Zimbra) you have fixed the problem, instead of realizing that you have done the equivalent of jumping out the 20th floor window because the ink jet printer is on fire. You're safe for the moment, but the inevitable consequence of your action is going to suck a lot more.

        • Re:I know what caused it (Score:5, Interesting)

          by antifoidulus ( 807088 ) on Sunday February 13, 2011 @08:53PM (#35195986) Homepage Journal
          Here's the thing about locking down Windows, it has the most pointlessly complex, convoluted security policies you could ever imagine. Something as simple as the firewall can be changed in 3 THREE different places on XP(no idea about future versions), and the way they interact and overrule each other is completely non-obvious. Now compare this with iptables, one text file, just one, and it's a text file. Boom, you have a functioning firewall and if someone needs a port opened/closed, it's just a vi command and /etc/init.d iptables reload away. I swear Microsoft makes their products pointlessly complex in order to maximize the number of people who take the MSCE test.

          • Re:I know what caused it (Score:4, Interesting)

            by rtb61 ( 674572 ) on Sunday February 13, 2011 @09:42PM (#35196200) Homepage

            More importantly with Linux you can create far more secure appliances. Where unnecessary services are completely removed and only what is required to run the appliance based server and workstations is installed and available on the installation software.

            The dispatch machines need only handle bookings, dispatch, arrival, return etc. (database) and then pass that data to accounting, nothing else. With Linux it is fairly easy for a skilled person to create a custom appliance distribution, all without infringing copyright.

            That is the biggest problem with windows the impossibility of creating completely custom installs with everything you didn't need, not just maybe, most likely, disabled but actually completely absent, on the machine and on installation software, all because go to jail copyright infringement.

          • Re: (Score:2)

            by drsmithy ( 35869 )

            Now compare this with iptables, one text file, just one, and it's a text file.

            Of course, the time you spend learning the comically baroque iptables can account for a lot of clicking in Windows...

            • Now compare this with iptables, one text file, just one, and it's a text file.

              Of course, the time you spend learning the comically baroque iptables can account for a lot of clicking in Windows...

              Then repeat that for another ten systems.
              Or just copy the same file to all of them.

              • Re: (Score:2)

                by Bert64 ( 520050 )

                Iptables is no more complex than any other widely used firewall system, cisco asa/pix etc...
                The fact the configuration is all in a single text file is a huge positive (cisco do the same, as do most other commercial firewalls).

                And of course, if you really can't handle editing the textual ruleset by hand, there are plenty of graphical frontends available for iptables, and you still get a textfile at the end of it which you can copy to other systems and back up easily.

                Also the windows firewall is extremely cru

          • Re: (Score:2)

            by Bert64 ( 520050 )

            Not only is windows extremely complex, but many of the security options don't really work, or are incorrectly used...

            Things like the group policies for restricting access to the command prompt - thats a client side check in cmd.exe itself, modify the binary and it will run. People think its actually enforced at the OS level but its not.

            The trouble is, all that complexity makes people think it's better than it really is... Complexity is a bad thing and there is much to be gained from keeping things simple, t

        • it's probably worse - considering this place would be running 24/7, one could easily believe that the computers were seldom rebooted, and patch tuesdays would sit in the queue for weeks until the machine finally crashed and had to be rebootled.

        • Sorry, I don't agree with that. MSIE may be insecure, but as long as it's updated through WSUS it's definitely more secure than the firefox some random user installed and forgot to update for about 2 years. So unless centrally managed, I agree that other browsers should not be installed. (This goes for any part of software, not only browsers.)

          • Re: (Score:2)

            by Bert64 ( 520050 )

            While true about the lack of central updating, this is primarily a problem of windows not offering a centralised update feature that other applications can easily hook into... I have Firefox and Chrome on my linux system and both browsers get updated centrally along with everything else on the system.

            On windows you will sooner or later have to deploy some kind of third party update system, because a windows system without third party software is generally not that useful... At the very least most systems wi

      • I'm gonna take a guess at the cause:

        letting mission-critical systems be used by employees to surf facebook and download cute fonts and wallpaper.

        Oh, I'm sorry, but that was a good guess. We were looking for Stuxnet - it not only affects centrifuges but other spinning devices such as sirens and wheels on emergency vehicles. ;-)

      • Most likely cause: Pathetic pricks who write virus code and let it loose on the world, with no care whatever for the consequences to others.

      • I'd say it's more likely the source was a laptop which had been exposed to the outside world. Typically managers/executives etc, who often take their work laptops home.

    • I'm gonna take a guess at the cause: somebody decided to use a Microsoft product to control a critical system on which people's lives depend.

      Is that even allowed under the license agreement? I do remember Java always said it couldn't be used for ATC and nuclear power systems... doesn't Windows say something like that too?

      • There are U.S. Navy vessels that have Windows computers in their control systems. There are power plants with Windows computer in control systems. There are... I think you get the point.

        • Re:I know what caused it (Score:4, Informative)

          by headhot ( 137860 ) on Sunday February 13, 2011 @08:41PM (#35195914) Homepage

          Yea, and at-least 2 of them were shutdown by windows crashes and were dead in the water, need a tow all the way back to port. The smart ship program started with an unix bases system until MS hired a retired admiral to loby for it.

          • Yea, and at-least 2 of them were shutdown by windows crashes and were dead in the water, need a tow all the way back to port.

            Thats urban myth. IIRC the original article that claimed that Windows was to blame was debunked. The original article was based primarily on speculation from a unix oriented developer who had not worked on the project and who was not on the ship. The publisher of the article backed away from it. The Navy officers who were on board at the time said it was the application software that controlled the propulsion system. The developers of this application software said it was their fault, although the software

            • Re: (Score:2, Interesting)

              by ArsenneLupin ( 766289 )

              The operating system was not involved, it would have happened under unix too.

              Not true. Under Unix, it would just have killed the one uncritical process that did the division by zero (the "bad data" was a zero value for a measurement that could/should physically not ever be zero), and would have left the processes controlling propulsion and all the rest alive.

              • The operating system was not involved, it would have happened under unix too.

                Not true. Under Unix, it would just have killed the one uncritical process that did the division by zero (the "bad data" was a zero value for a measurement that could/should physically not ever be zero), and would have left the processes controlling propulsion and all the rest alive.

                You are assuming that the processes controlling the equipment did not do the divide. Furthermore, NT works as you describe. One process misbehaves and is terminated but the others continue, NT and Unix are similar in this manner.

            • Here's what Wikipedia has to say about it:

              http://en.wikipedia.org/wiki/USS_Yorktown_(CG-48)#Smart_ship_testbed [wikipedia.org]

          • Which is why modern fly-by-wire aircraft will come with five systems with identical functionality, but build on different hardware running different software written by independent suppliers. So even if they put Windows in the mix it's not likely they would crash all at the exact same moment.

            Unix and Linux, contrary to popular belief, is not crash-free. Running your whole ship on a single Unix base may result in less crashes than a Windows based system, it doesn't make such crashes less catastrophic.

            • Re: (Score:2)

              by Bert64 ( 520050 )

              Unix may not be crash free, but it is a much simpler and better understood system.
              When stability or security are important, simplicity is exactly what you want because it gives you the greatest chance of having a full understanding of how and why the system works, and more importantly if something breaks its much simpler to fix. Not to mention, simpler system = less to go wrong.

        • and a windows crash left a ship dead in the water.

          windows for warships.

          • and a windows crash left a ship dead in the water.

            Actually the navy officers on board the ship at the time of the incident said it was not windows, rather it was an application that controlled propulsion. The developer of this software also admitted it was their software, although it was a development version not the production version that would have handled the fault more robustly. IIRC a speculative article by a unix advocate who was not involved in the project and who was not on the ship made the original claims against windows. Linux advocates ran wit

        • If for no other reason, it's a bad idea to use Windows (or any proprietary OS) because the functionality should be 100% reviewable. Black boxes are a really, really bad idea in critical systems.
      • Depends on what you mean by used for Nuclear power systems. There's a countless regulations saying what can and can't be used in those circumstances and almost all of them deal with the actual control aspect. Industrial plant control is almost all done on proprietary hardware with localised control modules. The only time Windows comes into play is for programming the system, or making setpoint changes / operator feedback display. In any Nuclear power plant you should be able to go right up to the operator c

    • If a bank used an armored car made of cardboard to transport money, would you blame the inevitable robbers, or the bank?

      Both.

    • If a bank used an armored car made of cardboard to transport money, would you blame the inevitable robbers, or the bank?

      I'd blame the robbers for stealing the money, and the bank for not securing it as I had hired them to do, since I know robbers exist and steal money. That said, it's not like banks are going around putting up money-dispensing kiosks that runs Windows [google.com].

    • Re: (Score:2)

      by CAIMLAS ( 41445 )

      Here's another, additive guess:

      The hardware their mission-critical, lives-depend-on-seconds their 'server' ran on? It was probably something like a standalone server without redundant power supplies or disks. The system may have had redundant disks through software RAID. Odds are strong against the system having ECC RAM, or the hardware being on a maintenance plan. Odds are strong for the organization paying 5-10x as much for the 'certified' hardware than it cost the shitty vendor to build from their parts

    • "The cause and source of the virus are not yet known."

      I'm gonna take a guess at the cause: somebody decided to use a Microsoft product to control a critical system on which people's lives depend.

      If a bank used an armored car made of cardboard to transport money, would you blame the inevitable robbers, or the bank?

      It doesn't matter what OS you use. They're all susceptible to vulnerability when not properly managed by a competent administration staff.

      If a bank used an armored car made of any material and failed to inspect it, maintain it, recognize its flaws, and reinforce it, would you blame the company that made the car, or the bank?

    • Windows jokes are tired... ::yawn::

  • Windows (Score:3, Insightful)

    by sirsnork ( 530512 ) on Sunday February 13, 2011 @07:56PM (#35195670)

    I'll probably get modded to hell for this, but this isn't Microsoft's fault. Their IT staff is either incompetent, or their management is. Stopping Wdinwso from getting a virus isn't a diffucult proposition.

    Install decent AV in it, keep the subscription up to date, done.

    You can of course go much further and lock down the OS so it doesn't let removable devices connect etc, but unless this was more than a virus, simple AV would have solved it.

    • If only it was that easy.... (Score:2, Insightful)

      by Anonymous Coward

      ....because it's not. Check an infected file on www.virustotal.com, and you'll see for yourself that at least a third won't detect the virus -- of course this always varies from virus to virus, rendering the 'one AV fits all' argument invalid... sadly.

      • Re: (Score:2)

        by 0123456 ( 636235 )

        This is why I always install at least three different AV programs on any Windows PC.

      • It isn't about AV here. It's about staff fucking up.

        A proper firewall, all updates applied and staff visiting ONLY the sites they're supposed to (which would be a handful of business pages, most of an internal nature) and no way of plugging USB sticks or MP3 players into the system, and you can completely and totally prevent this.

        All these things can easily be maintained and enforced by proper security personnel and the correct settings in the relevant OS.

        Someone didn't do their job and it seems like both t

        • Re: (Score:2)

          by dbIII ( 701233 )
          Sensible policy that results in making IT staff look as if they know what they are doing can get shot to hell by management undermining or completely removing those policies. Then you may have very good IT staff that are reduced to putting out spot fires each time the inevitable happens. I don't think we can make a judgement about the competancy of the staff here especially since rules and proceedures can get very weird in anything involving government.
          I've seen this sort of crap from a safe distance and

    • Re: (Score:2, Insightful)

      by whoever57 ( 658626 )

      Install decent AV in it, keep the subscription up to date, done.

      Hah, hah! While I won't argue with the proposition that it is possible to make Windows secure, the idea that installing AV is sufficient is laughable.

      Show me the AV tool that catches 100% of viruses, including new viruses that have just been seen in the wild.

      • norton catches a virus every time i boot up... it's a dll that makes my critical software run. i have to un-quarantine every single boot.

        which makes me less likely to ever turn the machine off, which means security patches don't get installed, unless i get a crash or the power fails.

        norton would store the exception, but it's GUI (sadly not the scanner itself) crashes in a runtime error on exiting and never bothers to save the exception.

        i love norton. it's the best virus-simulator i've ever found.

    • Re: (Score:2)

      by CAIMLAS ( 41445 )

      By "decent AV" do you mean "AV which management will approve and is made by Symantec or McAfee" or "AV which doesn't fit the previous description"? Because the former may have even caused this, directly.

    • Re: (Score:2)

      by Rennt ( 582550 )
      It's true that is possible to secure windows, but it is not easy and that is NOT how you do it. AV software is a borderline scam.

    • I agree with that, and would like to add a few more points (not sure whether they're valid or not in this case, just general):

      Why would the computers or their LAN have to be connected to the Internet? That's one major attack vector. I can understand they need to interface with other networks - Internet can help - but how about simply whitelisting those allowed connections in a firewall? And reject any and all incoming connections to the network on firewall level?

      Why allow users to attach any external medi

    • > I'll probably get modded to hell for this ... Install decent AV in it, keep the subscription up to date, done.

      You're just *wrong*. You need to understand how antivirus packages work, and then *think* about what they don't and can't do...

  • Windows is such crapware, as so many of you think, why don't you guys all get together and write an emergency management system that runs on a Linux distro? Now I obviously don't know for sure, but it seems likely the reason they are using Windows is that their application is written that way. Take a way the need to use Windows before bitching and moaning about them using Windows.

    • I heard one's being worked on but they are trying to shave a few microseconds off the compile time for the built in .bf compiler and no one wants to make the UI.

    • Re: (Score:3, Informative)

      by Anonymous Coward

      Windows is such crapware, as so many of you think, why don't you guys all get together and write an emergency management system that runs on a Linux distro? Now I obviously don't know for sure, but it seems likely the reason they are using Windows is that their application is written that way. Take a way the need to use Windows before bitching and moaning about them using Windows.

      Presentation at this week's North Carolina GIS Conference

      Open Source Computer-Aided-Dispatch – GIS at
      Work in Emergency Response,” Arnie Shore,
      Anne Arundel Co, MD

      Looks like Arnie will be talking about this:

      http://groups.google.com/group/alt.comp.opensource/browse_thread/thread/29ba12a929bd7bd3?pli=1

    • Re: (Score:2)

      by CAIMLAS ( 41445 )

      A big part of this is 'compliance testing'. It's hard (and expensive) to get a product approved for this-or-that "mission critical", regulated use.

      Not only that, but you can guarantee the cogs of local government would make all-Linux (or whatever) locked-down workstations a no-go. Users would bitch, and that'd be the end of that: facebook would be available, "application" would be available, and so on - and it'd be all over. It doesn't matter which OS it's running on if there is no administration.

  • Again I must ask: why was the emergency response system connected to the world wide web in the first place? Was the virus specifically designed/targeted to attack them? Or was it installed through a physical medium? Either way, it seems like having a back-up system, ready to be up in only a few hours with frequent tests, would be something the group should look into.

    • They are just Dispatch they need incoming data and data on where they are sending the ambulances to after picking people up.

      • Which doesn't require access to the internet. We have this thing called a VPN that pretty much solves that problem.

        Ignoring that, you can just only allow access to the remote systems that are required for that data.

        I'm constantly amazed that anyone allows any critical systems access to the internet.

    • Re: (Score:2)

      by mutube ( 981006 )

      Either way, it seems like having a back-up system, ready to be up in only a few hours with frequent tests, would be something the group should look into.

      A backup system was in place - a paper one. I worked in an ambulance control and a paper-only system was in place and tested monthly in case of complete power/system failure.

      It sounds scarily old fashioned but if well thought out paper backups are perfectly effective - and resilient.

  • ... had the answer. Wash your hands after touching a Windows machine.

    http://en.wikipedia.org/wiki/Ignaz_Semmelweis [wikipedia.org]

  • A rather interesting choice of words in TFA: "The virus crept into"
    Eek ! In all my years, I've never known a virus to "creep" anywhere. Once in a computer they usually jump about and whack the system senseless in a few microseconds. This must be one of those new super-viri we've been hearing about because the mental giants responsible for this system still have no idea as to the cause or source, according to TFA. Glad to know that calls to the 000 emergency number weren't affected, although for the unknown

  • Where does it say Windows? (Score:3, Insightful)

    by Vorghagen ( 1154761 ) on Sunday February 13, 2011 @10:45PM (#35196428)
    Almost every comment posted so far is bashing Microsoft or Windows for being an insecure OS but I can't find any mention of either in the article. It doesn't give any information about what kind of system the Ambulance Service was running.

    • Re:Where does it say Windows? (Score:5, Interesting)

      by grcumb ( 781340 ) on Monday February 14, 2011 @01:13AM (#35196852) Homepage Journal

      Almost every comment posted so far is bashing Microsoft or Windows for being an insecure OS but I can't find any mention of either in the article. It doesn't give any information about what kind of system the Ambulance Service was running.

      It said, 'Virus'. That means Windows.

      I hate to be the pee on your your empiricism, but the preponderance of evidence accumulated over the last 15 years leads to the conclusion that Windows is a necessary precondition for a virus to take down an entire system (as opposed to a single PC).

      Secondly, if this had been a Mac or Linux virus, you can bet your bottom dollar the headline would say so. In 4 inch letters. And red type. With Drudge-style cherries spinning. And a klaxon.

      Plus, the very next story would be about the spontaneous, simultaneous death by shock-and-horror of the entire editorial staff at the Register. And Wired. And boingboing.

      And then Slashdot would slashdot itself. And dogs would play with cats...

      ... And everyone would finally get their pony.

      • Almost every comment posted so far is bashing Microsoft or Windows for being an insecure OS but I can't find any mention of either in the article. It doesn't give any information about what kind of system the Ambulance Service was running.

        It said, 'Virus'. That means Windows.

        I hate to be the pee on your your empiricism, but the preponderance of evidence accumulated over the last 15 years leads to the conclusion that Windows is a necessary precondition for a virus to take down an entire system (as opposed to a single PC).

        That also can mean "We still do not know what hit us" or "We know what did hit us, and it was our fault and we do not want it to be known".

  • Sysadmins need to realize that just because they have users or probably managers complaining "OMG, I can't get on Facebook and check my Farmville!!!" the users do not need access to anything but what is critical for the applications and uses required to do their jobs. When you start opening these holes, what do you expect?

  • As an EMT for the past 4 years, most places are coordinated by telephone, (standard) radio, and handwritten notes. Including my agency. It works just fine.

    For large cities or areas, CAD (computer-aided dispatch, in this context) is a fantastic tool - but they functioned without it probably as recently as a few years ago. Some of the dispatchers still working there, I'm sure, started out without a fancy CAD and are perfectly happy to keep track of everybody's location using Post-Its, a map, a notepad, and pe

  • Boredom... (Score:3, Interesting)

    by sigipickl ( 595932 ) on Monday February 14, 2011 @12:23AM (#35196742)

    Having worked for many health care facilities over the years, including those with EMT/Ambulance staff, I can tell you that ambulance drivers and dispatchers suffer from periods of insane boredom while waiting for the next call to come in. During this downtime, they monkey with the PCs, browse some of the most pointless/inappropriate websites, and try plugging anything with an ethernet jack in to your network. The latter includes personal laptops, wireless access points and satellite/cable boxes. Solutions to this include 802.1x/NAP and even just getting the crews a DSL/Cable internet connection for their personal use. Like many things in I.T. (and life in general), the more you restrict someone's access to something they want, the more they will work against your efforts to restrict them.

    In this case, I'll put my money on an outside computer being plugged in to the network.

    I've never had to deal with I.T. in a fire station, but I can guess it's every bit as bad, if not worse.

  • 100% isolated with no Internet access, period. Bring all patches in via offline media and/or an isolated DMZ drop off point, and then bring them into a central WSUS/Secunia/Shavlik server for updates. Remove all external media methods (remove DVD/CD drives, epoxy USB ports). Install a decent piece of auditing software (Tripwire) to track all unauthorized changes. Not simple, but not hard for a competent IT team.

    Add a proper test/staging lab where you evaluate all changes and track them, and you've got a

  • These are exactly the incidents which will give chromeos fertile territory to plant in.

Slashdot Top Deals

If mathematically you end up with the wrong answer, try multiplying by the page number.

Close