Posts by Rob Dyke

UK finally vows to look at 35-year-old Computer Misuse Act

Woohoo! It's great to hear that the Govt is looking to create a "statutory defense" for researchers to spot and share vulnerabilities. I'm grateful to Security minister Dan Jarvis for hearing the concerns raised by Cyberup! and others that the CMA is not-fit-for-purpose.

Major IT outage forces UK emergency call handlers to use 'pen and paper'

Guaranteed availability lolz

I checked out the gCloud for Advanced's products and oh my

To start "Data is synchronously replicated between the two centres using Microsoft and web technologies including Hyper-V Server virtualisation and SQL Availability Groups. With the technology enabling a real time replica to be created at an alternate location, it provides operational continuity in the unlikely event of a partial or complete failure of either centre."

Then "Data is then in turn backed-up using Dell DR4100 Disk Backup Appliances, de-duped and then replicated in the alternate data centre. A full weekly backup is taken and a daily differential backup, each one being automatically verified with any inconsistencies automatically and immediately flagged to our team of database administrators."

And just in case you are not yet convinced "A combination of the data centres’ significant infrastructures and our active/active operating model therefore delivers a flexible, robust and proven approach to disaster avoidance and resilience and provides a high degree of business continuity"

gCloud

UK health secretary confirms end for NHS Digital, architect of the GP data grab debacle

A single FOIA mailbox...

should make it easier to not get answers from The Centre

NHS-backed org reacted to GitHub leak disclosure with legal threats and police call, complains IT pro

Others have found it and validated my description of the contents.

https://twitter.com/sickcodes/status/1385218039734423565?lang=en

Re: Attorney fail

Exactly. My two disclosures were promptly acknowledged with thanks. I thought nothing further of it until the Apperta's lawyer got in touch

I do like you thinking @teknopaul

According to Apperta's information security policy that I committed to uphold back in 2017 It was my responsibility to alert the Apperta Foundation that I suspected there had been a security breach and to *provide as much information as possible (including the date, time, application ) to enable the Foundation to investigate and take appropriate counter-measures.

Although no longer a subcommittee member, I followed the procedure and provided as much information as possible about what looked to be a security breach.

Re: Sorry, Fail - Rob

@shortlegs my rational has been pubic for over a month now

https://robdyke.com/howto-disclose/

Back in 2017 I was part of the group that made NHSbuntu - an open source desktop for the NHS. Apperta made a grant of £30,000 to the project and invited me to join a subcommittee that would oversee development. Subcommittee members have a responsibility to ensure that Apperta policies and procedures are followed and I was provided a copy of the Apperta information security policy when I accepted the invitation.

I found it and re-read it.

It was my responsibility to alert the Apperta Foundation that I suspected there had been a security breach and to provide as much information as possible (including the date, time, application ) to enable the Foundation to investigate and take appropriate counter-measures. Although no longer a subcommittee member, I figured I'd follow the procedure and provide as much information as possible about what looked to be a security breach.

I wrote up what I had discovered, providing screenshots of the repos with notes on the contents of the code and the database dump file, URLs of the third party site, and some notes about published vulnerabilities in the version of Laravel used. It looked something like this (gist and pdf)

I emailed the disclosure to Apperta on 1st March at 12:12hrs. I stated that I would keep the materials used to create the disclosure for 90 days (encrypted) before destroying them. Apperta responded and thanked me. Within the hour the repos were taken down and the portal taken offline. The following day I saw that some of the third-party elements that were referenced in the code (along with API keys!) were still available on public URLs without any authentication. I made a further disclosure and again was thanked by Apperta.

Re: I smell a rat here.....

sev.monster is non-discrimantory and pro-equality.

sev.monster addresses EVERY first poster like that.

sev.monster has a Bronze badge for service.

Re: I smell a rat here.....

I love the Grifters reference btw, nice one.

I no point did I reuse any credentials.

The portal code allowed registration of new accounts (served over HTTP). This has been independently verified.

The financial records were in the repo. There was also a third-party SaaS product that had been configured with public read access. The URLs for the SaaS product were in the repo.

No credential use was necessary.

Re: Go to court

I have not heard anything since providing a signed undertaking and statement at the end of April.

I have not received any confirmation that Apperta consider the matter closed.

one hundred percent

(The post is required, and must contain letters.)

Greetings and welcome to The Register forums.

I have redacted some screenshots, yes.

"They appear to have been provided in terms of showing what court submissions would be made if Dyke would not agree to guaranteeing he had deleted the information he had oddly chosen to keep."

Someone approved the expense and effort in producing 177 pages of evidence, 16 pages of witness statements and 3 court filings despite already having been offered many many confirmations of what I had delted.

Re: I smell a rat here.....

I told Apperta about the repos promptly after I found them.

I immediately deleted the repos after being contacted by the lawyers.

I also provided an inventory of the screenshots and notes made to produce the disclosure.

Re: Go to court

If you can GoFundMe @steamnut.... https://www.gofundme.com/f/responsible-rob

Re: Learn from the ransomeware bods...

Although Apperta and I have not always seen things the same way, I had no desire to embarass them or exploit the GitHub leak or the open access fiunancial reports published via Zoho.

I sent a quiet advisory. I didn't name them when I started to speak about the legal threats received in March. It only named Apperta after the decided to report this sorry circumstrance to the police.

close

If there was badly written code, in, for example, a Registration Form calling the RegistrationController@create(), this wouldn allow someone to create a new user account, login and elevate priviledges.

Retained materials

I told Apprta I had a copy of the repos (encrypted). I deleted the repos when contacted by lawyers.

I retained the PDF of the security disclosure(s) as a record - with screenshots heavily redacted. I later deleted those and provided confirmtion of the same.

Apperta, for those that don't know, was created by NHS England in 2015 and given £500k to support open source projects. At the time Peter Coates, NHS England's Open Source Programme Manager and now a Director of Apperta, told Digital Health News that Apperta would: 'be fully transparent, with information published online regarding where money has come from and where it has gone.'

See https://www.digitalhealth.net/2015/06/open-source-super-cic-created/

For some reason NHS England don't want to talk about the funding granted to Apperta: https://www.whatdotheyknow.com/request/the_apperta_foundation_cic_3

Oh good. They're looking for an NHSX CTO. Hopefully they'll see off 'snake oil' pushers, says GP

Let's hope that NHSX can keep this job post up longer than the last one: https://www.digitalhealth.net/2019/10/nhsx-removes-job-criticism-excludes-bame-applicants/

Scumbags cram Make-A-Wish website with coin-mining malware

Surely you mean...

"One or more completely feckless scumbags neglected to update the Make-A-Wish foundation's international website allowing it to be compromised by 6 month old "Drupalgeddon 2" exploit."

UK rail lines blocked by unexpected Windows dialog box

The post is required, and must contain letters.

NHS deploys Microsoft threat detection service on just 30,000 devices

You forgot to mention...

that all the thanks you get is an empty feeling in your pancreas.

UK's NHS to pilot 'Airbnb'-style care service in homeowners' spare rooms

I see that the TTL...

I see that the Time To Lift from El Reg to The Guardian has got lower...

El Reg: 13:34

Big G: 14:21

Ubuntu 'weaponised' to cure NHS of its addiction to Microsoft Windows

Re: About cost.....

/me won't feed AC posters....

Re: Not a *buntu fan, but more power to 'em!

Thanks!

We thought about using an rpm base, but NHSdora didn't sound as good as NHSbuntu.

Re: Good luck.

Our 80/20 operational/clinical split has been validated by many a CIO.

Re: Good luck.

Could not have put it better myself.

Why hacking and platforms are the future of NHS IT

Re: More openness....

Except of course they have, actually, released code publicly.:

http://www.ehealthopensource.com/codeforge/

Github is not the only code publishing service ... or are you a one true way zealot?

There is plenty more code inside N3 as well ... so I guess it depends on how people choose to define community....

Re: HL7

Having successfullly developed four ITK projects over the last 6 months I can testify to both the complexity and the business value of the ITK. The interoperability promise of the ITK can really help to deliver value and savings to a Trust so its worth getting behind if you want your product to be considered by NHS organisations as more than an another silo.

More openness....

The NHS is starting the benefit from leading hospitals such at Leeds Teaching Hospital and Kings College Hospital who are developing in-house and then releasing these developments as open source code bases. Examples of these include the Clinical Portal at Leeds and two projects from Kings; Wardware, en electronic observations system, and some recent work around Apache Service Mix for systems integration.

I'm a big fan of Carl. He doesn't brook any nonsense or failure in healthcare IT. NHS Hackday highlights the art of the possible and has successfully produced one system that is (nearly?) in production use at a Trust: CellCountr. See http://www.cellcountr.com/about/.

With the support of commercial organisations like Tactix4, not-for-profit projects like HANDI Health and openGPSoC and with the leadership of these exemplary trusts, opensource is becoming less of a 'perceived risk' for Trusts and is becoming a business decision that Trusts and other Healthcare providers are taking with increased confidence and, most importantly, understanding more often than ever before.

Declaration of interest: I have been at each of the last three NHS Hackdays, led eHealthOpenSource (an industry/NPfIT JV), am co-founder of HANDIHealth and openGPSoC and a Director of Tactix4.