Hackers broke into hospitals despite software flaw warnings

WASHINGTON (AP) — The hackers who seriously disrupted operations at a large hospital chain recently and held some data hostage broke into a computer server left vulnerable despite urgent public warnings since at least 2007 that it needed to be fixed with a simple update, The Associated Press has learned.

The hackers exploited design flaws that had persisted on the MedStar Health Inc. network, according to a person familiar with the investigation who spoke on condition of anonymity because this person was not authorized to discuss the findings publicly.

The JBoss technology is popular because it allows programmers to write custom-built software tools that can be quickly made available across a company, but security researchers discovered it was routinely misconfigured to allow unauthorized outside users to gain control.

MedStar said in a statement Friday evening to the AP that it would not provide details about how the attack occurred, and it criticized further media coverage of the case as perpetuating "the infamy of malicious attacks for airtime and publicity" and encouraging copycat hackers.

The hospital chain shut down its systems quickly after discovering the attack, limiting its impact to archives, some imaging and lab files and other duplicate records, according to the person with inside knowledge of the attack.

Tracing the scanning activity preceding an attack typically leads to other hacked computers; logs that might yield identifying clues can be manipulated or deleted and the samsam software is unusually self-sufficient and doesn't require hackers to control it after an infection.