Canadian hospital's website hacked to serve up Teslacrypt ransomware

Yes, you should have secure backups. But you should keep your website patched too.

Norfolk general hospital

A Canadian hospital's website has been hacked in order to serve up the notorious Teslacrypt ransomware to unsuspecting visitors.

Jérôme Segura, a senior security researcher at Malwarebytes, explains in a blog post that out-of-date server-side software is likely to blame for the site hack of Norfolk General Hospital, which is based in Ontario:

"The web portal is powered by the Joomla CMS, running version 2.5.6 (latest version is 3.4.8) according to a manifest file present on their server. Several vulnerabilities exist for this outdated installation, which could explain why the site has been hacked."

To investigate the hack further, Segura had Malwarebytes' honeypots visit the hospital's website. The packet capture reveals that malicious code injected directly into the site's source code redirected users to the Angler exploit kit, which in turn downloaded Teslacrypt ransomware.

Flow

The case of Norfolk General Hospital is unusua; insofar as attackers are abusing its website to actually spread crypto-ransomware.

Elsewhere in North America, however, medical centers have triaged and treated similar types of malware found on their networks.

Perhaps the most well known case so far is when Hollywood Presbyterian Medical Center, a hospital located in southern California, temporarily declared an "internal emergency" and shut down its computer systems following a ransomware attack back in February.

Shortly following the infection, a local computer consultant said that the ransom fee was 9,000 BTC. At US $3.6 million, this would have been the largest malware-related ransom demand ever recorded. But the claim was incorrect.

Spokespeople for the hospital clarified that the real ransom fee was 40 BTC, or US $17,000. Ultimately, the hospital decided to pay the fee.

About a month later, news broke about a hospital located in Henderson, Kentucky that also declared an "internal state of emergency."

Like Hollywood Presbyterian, the hospital determined that "Locky" ransomware was behind the infection. But unlike its California counterpart, the hospital allegedly restored its files via the use of a backup system and therefore did not pay the attackers a penny.

Locky payment page

The Ottawa Hospital is also reported to have experienced a ransomware infection recently, only this time at the hands of a WinPLock variant. The medical center also recovered from the infection by restoring from unaffected backup.

All of these cases required system backups or ransom payments. By contrast, Norfolk General Hospital's case is much simpler. All it needs to do is upgrade the version of Joomla it is using to run its web portal.

But even that simple step is proving to be too much trouble apparently.

JoomlaCBC reports that Segura checked the infected website a few days after reporting the hack to the hospital's IT teams. Not only is their Joomla version still old and vulnerable, but apparently it has been rolled back to an earlier version that is older and even more vulnerable than the first.

"If they don't update it quickly, it will happen again," Segura told CBC, adding that leaving the website in an outdated state is "just very irresponsible."

To all sysadmins out there, you should always make sure that whatever software you use to power your web portals is up-to-date. This is especially true if you work at a hospital, where friends and family members of those who might not be in the best of health could experience additional suffering as a result of your inattention when they visit the hospital's website.

Don't be a jerk; update your systems.

Have you ever been hit by ransomware?

Tags: , , , ,

Subscribe to the free GCHQ newsletter

, , , ,

Special offers & deals


  • Password Boss Premium Version: Lifetime subscription

    Password Boss Premium Version: Lifetime subscription

    All you need to do is remember one master password, and Password Boss will do the rest - remembering all of your different online passwords securely. Security and peace of mind. 86% off normal price!
  • Fancy becoming an ethical hacker?

    Fancy becoming an ethical hacker?

    Save 98% off the regular price and take advantage of IT Security & Ethical Hacking Certification Training for just $29. This course lays out a successful career path for you in the world of computer security.

More deals...

Leave a reply

2 Comments on "Canadian hospital's website hacked to serve up Teslacrypt ransomware"

Notify of
avatar

Sort by:   newest | oldest | most voted
Brian Teeman
Visitor
Brian Teeman
March 25, 2016 2:24 pm

A hospital would never use out of date medicines so why use 3 year out of date software

coyote
Member
Regular
coyote
March 26, 2016 12:58 am

Ignorance. Also improper (if any) training. List goes on. That's why.

As for not making medical mistakes like you cite? I'm afraid you're mistaken. It happens. There also are doctors (and medical professionals) that defy 'do no harm'. There isn't an excuse but it's still reality.

wpDiscuz