Some Coronavirus Vaccine Trials Resort To Pen and Paper After Ransomware Hits Software (nytimes.com) 81
A software company supporting hundreds of clinical trials — including coronavirus vaccine trials — has been hit by a ransomware attack that "has slowed some of those trials over the past two weeks," reports the New York Times.
Employees "discovered that they were locked out of their data by ransomware..." eResearchTechnology (ERT) said clinical trial patients were never at risk, but customers said the attack forced trial researchers to track their patients with pen and paper. Among those hit were IQVIA, the contract research organization helping manage AstraZeneca's Covid vaccine trial, and Bristol Myers Squibb, the drugmaker leading a consortium of companies to develop a quick test for the virus. ERT has not said how many clinical trials were affected, but its software is used in drug trials across Europe, Asia and North America. It was used in three-quarters of trials that led to drug approvals by the Food and Drug Administration last year, according to its website.
On Friday, Drew Bustos, ERT's vice president of marketing, confirmed that ransomware had seized its systems on September 20. As a precaution, Mr. Bustos said, the company took its systems offline that day, called in outside cybersecurity experts and notified the Federal Bureau of Investigation. "Nobody feels great about these experiences, but this has been contained," Mr. Bustos said. He added that ERT was starting to bring its systems back online on Friday and planned to bring remaining systems online over the coming days...
One of ERT's clients, IQVIA, said it had been able to limit problems because it had backed up its data. Bristol Myers Squibb also said the impact of the attack had been limited, but other ERT customers had to move their clinical trials to move to pen and paper.
The Times notes it's just one of "more than a thousand ransomware attacks on American cities, counties and hospitals over the past 18 months." Other interesting details from the article:
Employees "discovered that they were locked out of their data by ransomware..." eResearchTechnology (ERT) said clinical trial patients were never at risk, but customers said the attack forced trial researchers to track their patients with pen and paper. Among those hit were IQVIA, the contract research organization helping manage AstraZeneca's Covid vaccine trial, and Bristol Myers Squibb, the drugmaker leading a consortium of companies to develop a quick test for the virus. ERT has not said how many clinical trials were affected, but its software is used in drug trials across Europe, Asia and North America. It was used in three-quarters of trials that led to drug approvals by the Food and Drug Administration last year, according to its website.
On Friday, Drew Bustos, ERT's vice president of marketing, confirmed that ransomware had seized its systems on September 20. As a precaution, Mr. Bustos said, the company took its systems offline that day, called in outside cybersecurity experts and notified the Federal Bureau of Investigation. "Nobody feels great about these experiences, but this has been contained," Mr. Bustos said. He added that ERT was starting to bring its systems back online on Friday and planned to bring remaining systems online over the coming days...
One of ERT's clients, IQVIA, said it had been able to limit problems because it had backed up its data. Bristol Myers Squibb also said the impact of the attack had been limited, but other ERT customers had to move their clinical trials to move to pen and paper.
The Times notes it's just one of "more than a thousand ransomware attacks on American cities, counties and hospitals over the past 18 months." Other interesting details from the article:
- ERT's vice president of marketing "declined to say whether the company paid its extortionists, as so many companies hit by ransomware now do."
- The attack follows what NBC News calls "one of the largest medical cyberattacks in United States history," taking down the computer systems of Universal Health Services at over 400 locations.
- "In May, the FBI and the Department of Homeland Security warned that Chinese government spies were actively trying to steal American clinical research through cybertheft... More than a dozen countries have redeployed military and intelligence hackers to glean what they can about other nations' responses, according to security researchers."
- Two companies working on a coronavirus vaccine — Pfizer and Johnson & Johnson — emphasized to the Times that they weren't affected by ERT's issues, with a Pfizer spokesperson stressing they're not even using ERT's software.
Interesting (Score:2)
Suicide by stepping in front of a train probably wasn't flashy enough for this particular 'hacker', they wanted to be torn to shreds publicly by an angry mob, apparently.
Re: (Score:3)
We, as an industry, are so incompetent at security we'll never find who did it unless they go around bragging online about it.
Re: (Score:2)
We, as an industry, are so incompetent at security we'll never find who did it unless they go around bragging online about it.
Unfortunately, that is the plain simple truth.
Re: (Score:2)
Indeed. Jamming cat videos will just make us chuckle then yawn. But, mess with Covid vaccines and you get the Bin Laden Treatment! Fuck You, pirates!
Like this? (Score:2)
mess with Covid vaccines and you get the Bin Laden Treatment!
You mean like this [youtube.com]?
Re: (Score:2)
There are some people that really enjoy being evil toads. This is a prevalent theme in drama and films. Bwahahaha!
Why do you need special software? (Score:1)
Re: (Score:3)
And none of them involve Excel spreadsheets.
Seriously, if your data is valuable, why the hell are you using Windows? It should be obvious from this story, and hundreds more like it, that the back of an envelope is a safer place for data than on Windows.
Re: Why do you need special software? (Score:3, Insightful)
Seriously, if your data is valuable, why the hell are you using Windows? It should be obvious from this story, and hundreds more like it, that the back of an envelope is a safer place for data than on Windows.
Really?
Victim-blaming?
Platform-Trolling?
Really?!?
Iâ(TM)m certainly no Windows fan; but they are research-scientists; not security-professionals, FFS! They used the tools they normally use for this sort of thing!
Seriously, you should be ashamed of yourself!
Put the fucking blame where it belongs: The CRIMINALS that had the capital-offense-level GALL to attack a COVID-RESEARCH Project!!!
Anything else is patently ridiculous!
Re: (Score:2)
Re: (Score:2)
It's perhaps the scale and urgency (speed) of the needs that are different this time.
Off-the-shelf stuff is rarely optimized for the organization that needs it. There are often ways to tweak it, but that tweaking takes almost as long as custom software, AND you are still left with a lot of the original architecture that gets in the way or adds unnecessary steps. I'm not saying off-the-shelf is always the wrong choice, only
Terrorists and mass murderers (Score:1)
This data ransoming behavior stopped being cute a long time ago. It's time for whatever country is harboring these terrorists to clean up their house before other countries run out of patience and hit them with trade sanctions, cruise missiles, or worse.
Re: (Score:2)
If we start jailing people who pay them, as accomplices, then the problem would stop almost instantly.
They're not being physically threatened, there is no "force" that "makes" them pay. They're merely agreeing to enrich the perpetrator of a criminal act, in return for some consideration.
Re: (Score:2)
If we start jailing people who pay them, as accomplices, then the problem would stop almost instantly.
We should also jail store owners who have their wares behind glass windows. They're just begging to be robbed by displaying their goods.
A better solution would be, where possible, to track down the criminals and execute them. Every single one, no matter how small a hack they've done. Deface a web site? Execute. Break into someone's Twitter account? Execute. Get into someone's iPhone account and display
Re: (Score:2)
If we start jailing people who pay them, as accomplices, then the problem would stop almost instantly.
We should also jail store owners who have their wares behind glass windows. They're just begging to be robbed by displaying their goods.
You missed the part where I said
They're not being physically threatened, there is no "force" that "makes" them pay. They're merely agreeing to enrich the perpetrator of a criminal act, in return for some consideration.
Learn yous sum werds
Re: (Score:2)
Or, as an alternative to cruise missiles, the potential victims could fix their security holes and do routine backups.
Re: (Score:2)
Re: (Score:2)
[begin]
It's a lesson too late for the learning
[goto begin]
[end]
Punishment. (Score:4, Interesting)
And when he gets sick, a cup of bleach will be given to him for treatment.
Re:Punishment. (Score:5, Insightful)
I am of the opinion that Ransomware should be Capital punishment level offence. It significantly impacts society and threatens loss of life as in this case. It is an par with a release of a dirty bomb or a chemical attack in the sense that once released the level of damage is not containable by the perpetrators.
Re: (Score:2)
Re: (Score:2)
Ransomware exists because people pay ransoms. Stop doing that and ransomware will go away.
There are two ways to stop.
1. Refuse to pay. Treat the event as catastrophic data loss. Hopefully you're insured.
2. Adopt security and backup practices so you're never in a situation where someone could hold your data hostage or steal and sell your data online.
As for punishment, Community service to compensate the harm done to society will give a person plenty of time to reflect on how they choose to live. Exploiting other people tears down society. And it's behavior we shouldn't tolerate in any form, not j
Re: (Score:2)
Trace the bitcoin address back to the crooks and go get them.
Re: (Score:2)
Have fun getting warrants on the accounts of exchanges. Wallets are created easily, and sometimes stolen wallets are used to muddy any investigative accounting. Also the bitcoins can be spent on things that you might not want traced, like hosting and certificates. Which can be used to run schemes to collect even more money. And finally, money, even bitcoin, gets laundered in organized crime. Purchase some good or service and use that to exchange for cash. Sure you take a haircut when you do that, but once t
Re: (Score:2)
They managed to track down the silk road and other drug selling.
Re: (Score:2)
Purchase some good or service and use that to exchange for cash.
Wouldn't be so easy, as it would give investigators a shipping address to work with...
Re: (Score:2)
Obviously you don't ship to your own address.
Re: (Score:2)
Ransomware exists because it's an easy way to make money.
And in every goddam case, it's because the gatekeepers are asleep at the wheel.
Capital punishment for the gatekeepers?
Re: (Score:2)
The question if Capital Punishment deters crime is still controversial. The past few decades economist have gotten into the analysis and they have concluded it does. For example, Naci Mocan, (Economist at Louisiana State University) published a study that looked at all 3,054 U.S. counties over death penalty and found that that each public execution prevented five homicides. In order for it to be effective the execution has to be public and a short time between crime and execution.
Also now that we can go loo
Re: (Score:1)
Re: (Score:2)
How comes the USA, a country which kills people, has so much more crime of exactly the sort that is punishable by death than countries without capital punishment?
It doesn't.
There aren't many capital crimes in the US (premeditated or felony murder, kidnapping, treason, ...). The main one that actually sends people to death row is high-level murder.
The US has populations from many national origins and doesn't require them to assimilate and drop their ancestrial culture, just that they obey the law. They can
Re: (Score:2)
Re: (Score:3, Insightful)
Drone on! (Score:3)
We do that to terrorists. If someone messes with critical functions of society, they are arguably terrorists.
Re: (Score:2)
a) No preventative value. Capital punishment may provide people like you with a great feeling of having gotten revenge, but it does not reduce the problem.
b) You have to identify them first. They know they are screwed if they get identified, so they are pretty careful.
Re: (Score:2)
Cryptocurrency must die!!! (Score:2)
Outlaw cryptocurrency globally and Ransomware will all-but-disappear overnight.
You all know Iâ(TM)m right.
The downsides way outweigh any alleged "advantages" of allowing its continued existence. This just underscores my point.
Re: (Score:2)
Hahaha, no.
There are plenty of other ways to launder money.
Re: Cryptocurrency must die!!! (Score:2)
Hahaha, no.
There are plenty of other ways to launder money.
True.
But no other monetary transaction other than dead-drops of briefcases full of gold dust that is specifically designed to facilitate it at every conceivable level.
Re: (Score:2)
Re: Cryptocurrency must die!!! (Score:2)
Well, next they'll go to gift cards or something. Cryptocurrencies didn't make ransomware possible, just a little more convenient.
Wrong.
Even Gift-Card transactions are infinitely more traceable than Cryptocurrency.
Put your money where your mouth is; find me cases of actual Ransomware before Cryptocurrency.
I'll wait...
Re: (Score:2)
https://blog.radware.com/secur... [radware.com].
https://www.makeuseof.com/tag/... [makeuseof.com]
Re: (Score:2)
Okay. The first ransomware attack was in 1989. Then in the mid 2000's, there was a ton of it in Eastern Europe. All before Bitcoin was introduced in 2009.
https://blog.radware.com/secur... [radware.com].
https://www.makeuseof.com/tag/... [makeuseof.com]
Nice try, and I am actually somewhat impressed; however, you still lose.
From the second link:
"For the victim to recover their files, they would have to transfer $300 to an E-Gold account.
E-Gold can be described as a spiritual predecessor to BitCoin. An anonymous, gold-based digital currency that was managed by a company based in Florida, but registered in Saint Kitts and Nevis, it offered relative anonymity, but quickly became favored by organized criminals as a method to launder dirty money. This lead the
Re: (Score:2)
Re: (Score:2)
Did you miss the use of prepaid debit cards, purchases at online pharmacies, or any of the other methods that had been used for collecting ransoms? And let's not overlook the fact that "can be described" does not mean, "accurately described", or, "should be described as". Slashdot could be described as a predecessor to Reddit or Facebook, both of which it preceded, but would that be a reasonable portrayal?
No, I didn't miss them; but they were never widespread, and, because the payment methods were so clumsy, the "Ransom" amounts were a very small fraction of the asinine sums being demanded today. And if someone walks into a Walmart and tries to buy $300k of stuff on a pallet-full of iTunes Gift Cards or something, someone is going to call the police. It's just not really practical.
And you know it; but like the typical Slashdot naysayer, you're just going to "yeahbut" me to death.
Stop paying ransoms (Score:1)
Re: Stop paying ransoms (Score:1)
Paying a ransom should be a crime. Remove the incentive.
Breaking into computer systems is already a crime, likely worldwide.
Now what?
Re: (Score:3)
Paying a ransom should be a crime. Remove the incentive.
Breaking into computer systems is already a crime, likely worldwide.
Now what?
The people who do the breaking-in are hard to catch. The people who pay them are easier to catch. If the penalty for paying the ransome is large enough, people will stop paying, which will decrease the frequency of computers being broken into, a net good for society.
Re: (Score:2)
In other words: Fuck justice. Just go for the easy target.
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
How will you actually know:
a) that I was a victim of a ransome ware attack?
b) that I paid the ransom?
Re: (Score:2)
How will you actually know: a) that I was a victim of a ransome ware attack? b) that I paid the ransom?
Ransomeware is like kidnapping. When it happens to unimportant people, on a small scale, it can be kept quiet and therefore profitable. However, the kidnappers sometimes get greedy and go for a high-value target. When that happens there is no way to conceal it. For example, when a large hospital chain stops accepting patients and reverts to pen and paper, everybody knows about it. When a public company pays out a lot of money after a computer incident, the shareholders notice and ask why.
Re: (Score:2)
When a public company pays out a lot of money after a computer incident, the shareholders notice and ask why.
No, they don't.
How should that be even be remotely possible? Shareholders have no access at all to bank transactions a company does, unless they also work in that company and are actually involved in accounting/money transfers.
Re: (Score:2)
When a public company pays out a lot of money after a computer incident, the shareholders notice and ask why. No, they don't. How should that be even be remotely possible? Shareholders have no access at all to bank transactions a company does, unless they also work in that company and are actually involved in accounting/money transfers.
Shareholders (and the Securities and Exchange Commission) see the company's financial records on a regular basis. An unusally large expenditure shows on the bottom line, and raises questions.
Re: (Score:2)
They see the financial report, but not the single transactions ...
An unusally large expenditure shows on the bottom line, and raises questions.
Something like this does not show up.
Re: (Score:2)
They see the financial report, but not the single transactions ...
An unusally large expenditure shows on the bottom line, and raises questions. Something like this does not show up.
The financial report shows how much was spent for each category of expenditures. If this quarter's report shows an extra million dollars in IT expenses people will ask what the company bought with that money. If top management gives evasive answers, stockholders will hire a private investigator who will interview everyone involved to find the truth. A public company cannot hide a large payout.
Re: (Score:2)
If this quarter's report shows an extra million dollars in IT expenses people will ask what the company bought with that money.
Yes, that one could notice. Nevertheless, that is unlikely.
stockholders will hire a private investigator who will interview everyone involved to find the truth. A public company cannot hide a large payout.
They do not need to hide it. And if the company is public, it is so bug that million wont show up anywhere as odd.
holding IBM for ransom (Score:2)
If this quarter's report shows an extra million dollars in IT expenses people will ask what the company bought with that money. Yes, that one could notice. Nevertheless, that is unlikely.
stockholders will hire a private investigator who will interview everyone involved to find the truth. A public company cannot hide a large payout. They do not need to hide it. And if the company is public, it is so bug that million wont show up anywhere as odd.
Let me explain using an example: IBM. I picked IBM because they are a large company that has been using computers since the 1950s, and they have a well-written annual report, which you can read here: https://www.ibm.com/annualrepo... [ibm.com] . The same logic applies, on a smaller scale, to smaller companies.
Let’s pretend we want to bring down IBM’s internal data processing systems, holding the data until a ransom is paid. In order to do that we would have to introduce malware into all of IBM’s
Re: (Score:2)
We talked about a million, not 10billion.
And my point is pretty simple. I doubt anyone in a shareholders meeting would care.
I for my part owned shares of probably close to a hundred companies. I never even looked at such papers, why would I?
You want to prohibit paying ransom? Good luck. A company like IBM would cease to exist if they would not pay in such a case ...
Re: (Score:2)
We talked about a million, not 10billion.
And my point is pretty simple. I doubt anyone in a shareholders meeting would care.
I for my part owned shares of probably close to a hundred companies. I never even looked at such papers, why would I?
You want to prohibit paying ransom? Good luck. A company like IBM would cease to exist if they would not pay in such a case ...
Perhaps nobody who attends a shareholder's meeting would care, but professional investors would, and the SEC definitely would. I agree that in such a case IBM would cease to exist if they did not pay the ransom, but having paid it, what is their next move? I don't think concealing it is an option, so they would have to disclose it, and pay the fine. If the fine is so large that they are stripped of all assets and cease to exist, then they should not have paid the ransom and just gone quitely into the gra
Re: (Score:2)
The problem basically is that:
a) OSes - notable Windows - are to easy to penetrate
b) companies do not grasp that they are IT companies and treat IT stuff/staff like shit
c) IT is incompetent
And on top of that, back up solutions are to simple. Can't be so hard to flag: oh, over night 2000 files in your "Documents" Folder have changed.
I'm actually considering to write my own back up solution - with all those idiotic no brainer problems we are annoyed all the time.
Re: (Score:2)
The problem basically is that: a) OSes - notable Windows - are to easy to penetrate b) companies do not grasp that they are IT companies and treat IT stuff/staff like shit c) IT is incompetent
And on top of that, back up solutions are to simple. Can't be so hard to flag: oh, over night 2000 files in your "Documents" Folder have changed.
I'm actually considering to write my own back up solution - with all those idiotic no brainer problems we are annoyed all the time.
Writing your own backup solution is a good idea, if the existing solutions either don't meet your needs or are too expensive. I wrote myself a backup script in Python that checksums file data to prevent bit-rot. This was before btrfs, with its data checksumming, was reliable enough. My backup media is bare hard drives, placed in an inexpensive 8-drive tower. Each drive tray has a hardware off-line switch. I power on a drive only when using it.
If you are infected with malware that encrypts writes to dis
Re: (Score:2)
A scary idea, isn't it?
Re: (Score:2)
The creatures doing this are nothing but parasites (Score:2)
They are lower than shit, because you can spread shit on the soil and use it to help things grow.
My definition of humanity is a being who treats others in a humane manner. These parasites do not qualify so they do not deserve any sort of human rights whatsoever.
I would be perfectly happy to see whoever did this locked inside a small, cold, windowless cell and given assurance that the only way they will ever leave is nailed inside a box. I would also be very happy to know that the cell was provided with a st
As it looks now (Score:3)
...they should have used pen and paper from the get-go, since they're unable to secure a network.
Smith-Corona virus? (Score:2)
Re: (Score:2)
Purely mechanical typewrites do not contain a processor and are therefore hard to bug. However, it has been demonstrated that electro-mechanical typewriters are susceptible to certain kinds of espionage bugs, as demonstrated by the Soviets to the United States and described in this article:
https://spectrum.ieee.org/tech-history/silicon-revolution/the-crazy-story-of-how-soviet-russia-bugged-an-american-embassys-typewriters [ieee.org]
Oh come on! (Score:1)
At what cost to society? (Score:2)
Re: (Score:2)
Re: (Score:2)
First of all - against popular believe - a billion is not a lot of money.
Secondly, it won't be "countless billions"! With close to 8 billion ppl on the planet, assuming the shot at a doctor costing about $20, assuming every person gets two shots, that is $40 * 8 = 32 billion dollars. That is *costs* for the public, not earnings of anyone involved. Considering that about 25% of that goes to the producers of the vaccine (the rest is distribution, storage and admistering the drug), this would be $4 billion. So
target? (Score:1)
CyberInsecurity: The Cost of Monopoly (Score:1)
* The sum of the world’s networked computers is a rapidly increasing force multiplier.
* A monoculture of networked computers is a convenient and susceptible reservoir of platforms from which to launch attacks; these attacks can and do cascade.
* This susceptibility cannot be mitigated without addressing the issue of that monoculture.
* Risk diversification is a primary defense against aggregated risk w
That explains why I could not get on te survey (Score:2)
I was invited to take part in an extensive Covid-19 survey in the UK, run by IQVIA. For medical reasons, I can't use the phone, so I contacted the email address they gave out. I never got anything except an automated response. If their computer systems were out of action, then that would explain the problem.
I consider the survey to be quite important, because it is some kind of general screening survey for coronavirus, not limited to those admitted to hospital, or showing symptoms. The current statistics fo
Some Coronavirus Vaccine Trials Resort To... (Score:2)
...Pencil and paper after chinese-made pen runs out of ink. ...Tatoos after chinese-made pencils break, and covid causes paper shortage.
Vendor attacked, customer hit? (Score:2)
I bet the customers were told the data would be safer that way. But such a critical service should have a separate server in its network storing database update log entries up to the second, using a write-once solution.