Osaka General Medical Center ransomware: a contractor's VPN

Osaka General Medical CenterHospital, prefectural, acute careJPRansomware (Elbie, per the report)

1 Summary

At 07:45 on Monday, October 31, 2022, help-desk staff found the electronic medical records down and a ransom message on screen. The hospital switched to paper records and stopped emergency admissions. Core systems came back after 43 days and all clinical systems after 73. The investigation committee concluded that the attacker most likely entered through a VPN appliance at the hospital's catering contractor.

Probable cause: A catering contractor's unpatched VPN appliance let the attacker in, and an always-on remote-desktop link carried them from the contractor into the hospital.

Fig. 4-2-1Osaka General Medical Center, the way in

Source: Osaka General Medical Center investigation committee 「大阪急性期・総合医療センター情報セキュリティインシデント調査報告書概要」 (pp.1–3)

The VPN appliance belonged to the hospital's catering contractor. The attacker then crossed into the hospital over an always-on RDP connection.

S=1:100 2 Factual information

2.1 The way in

The committee: the attacker entered the catering system "using a vulnerability in the VPN device that the system builder had installed for remote maintenance (entry with the leaked and published ID and password is also possible)," then reached the hospital's catering server over RDP.

Source: Osaka General Medical Center investigation committee 「大阪急性期・総合医療センター情報セキュリティインシデント調査報告書概要」 (pp.1–3)

Product: Fortinet FortiGate at the catering contractor
CVE: CVE-2018-13379

2.2 After entry

At the contractor, weak shared administrator passwords fell to a dictionary attack. From the contractor's side the attacker cracked the administrator password of the hospital's catering server, logged in to it over RDP and uninstalled its antivirus. The same ID and password worked on the other servers, so the attack spread to the medical-record and core systems, and most servers were encrypted. The committee judged a data leak extremely unlikely.

2.3 Damage

Core systems, including the medical records, restarted on day 43 (December 12, 2022); all clinical systems were back on day 73 (January 11, 2023). Some of the hospital's roughly 2,200 terminals showed traces of unauthorized access. Because each one could not be checked in time, every server and terminal was reinstalled. New inpatients in November 2022 were 33.3% of the year before. The committee estimates investigation and recovery at several hundred million yen or more, and lost revenue at well over a billion yen ("more than ten-odd hundred million yen").

2.4 Sequence of events

Time	Actor	Event	Source
2022-10-31 04:07	Intruder	Heavy RDP traffic from a server on the contractor side to the hospital's catering server, until 04:10.	Osaka General Medical Center investigation committee
2022-10-31 06:50	Hospital	Critical-care system fails.	Osaka General Medical Center, Information Security Incident Investigation Committee
2022-10-31 07:10	Hospital	Core systems fail.	Osaka General Medical Center, Information Security Incident Investigation Committee
2022-10-31 07:45	Help desk	Staff arrive, find the failure and a ransom message.	Osaka General Medical Center, Information Security Incident Investigation Committee
2022-10-31 08:30	System vendor	Ransomware infection confirmed; systems disconnected.	Osaka General Medical Center, Information Security Incident Investigation Committee
2022-10-31 08:50	Hospital	Senior staff convened; care switches to paper records.	Osaka General Medical Center, Information Security Incident Investigation Committee
2022-10-31 17:00	Hospital	First notice posted on the website.	Osaka General Medical Center, Information Security Incident Investigation Committee
c. 2022-10-31 18:00	Contractor's system builder	Firmware of the VPN appliance updated without a backup; its logs are lost.	Osaka General Medical Center, Information Security Incident Investigation Committee
2022-12-12	Hospital	Core systems including the medical records restart (day 43).	Osaka General Medical Center, Information Security Incident Investigation Committee
2023-01-11	Hospital	All clinical systems restored (day 73).	Osaka General Medical Center, Information Security Incident Investigation Committee
2023-03-28	Investigation committee	Investigation report published.	Osaka General Medical Center investigation committee

S=1:100 3 Analysis

Point	Finding	Source
The contractor's VPN appliance had CVE-2018-13379, which allowed theft of the file holding the administrator ID and password.	Stated	Osaka General Medical Center, Information Security Incident Investigation Committee
The device's address, ID and password were on a publicly leaked list; the committee found entry with them "reasonable" to assume.	Stated	Osaka General Medical Center, Information Security Incident Investigation Committee
An RDP connection between the contractor and the hospital was left always on.	Stated	Osaka General Medical Center investigation committee
Windows passwords were the same on every server and terminal, and no account lockout was set.	Stated	Osaka General Medical Center investigation committee
How long the attacker was inside. The VPN appliance's syslog was lost when its firmware was updated without a backup on the evening of October 31.	Unknown	Osaka General Medical Center, Information Security Incident Investigation Committee

S=1:100 4 Conclusions

The committee concluded that the attacker entered the catering contractor's network through its VPN appliance, by the vulnerability or with the published credentials, crossed into the hospital over RDP, and spread because passwords were shared and accounts never locked. It wrote that the damage might have been avoided had the VPN appliance and the RDP connection been managed properly.

S=1:100 5 Recommendations

Recommended or carried out by: Investigation committee

For each external communication device, confirm in writing who maintains it and who manages its vulnerabilities.
Set criteria for allowing remote maintenance, and check the security of the connecting side before approving it.
When remote maintenance is used, confirm its purpose and time and review the connection logs.
Make every Windows password unique per server and terminal, and turn on account lockout.
Run users as standard accounts without administrator rights, and install antivirus on the medical-record servers.
List every device connected to the clinical network as an information asset and assess its risk.

Source: Osaka General Medical Center investigation committee 「大阪急性期・総合医療センター情報セキュリティインシデント調査報告書概要」 (pp.1–3)

Sources

Source: Osaka General Medical Center, Information Security Incident Investigation Committee 「調査報告書」 (pp.11–12, 18–19, 36–41, 45–47; pp.11, 37, 45–46, 71)Osaka General Medical Center investigation committee 「大阪急性期・総合医療センター情報セキュリティインシデント調査報告書概要」 (pp.1–3)