Lauri Love: NHS Cyber Attack "Top Of The Range Cyber Weapon"

12 May 2017, 17:43 | Updated: 12 May 2017, 17:53

Lauri Love told Iain Dale that the cyber attack was the most serious he could imagine and that the NHS lacks the money to defend against it.

“This is a top of the range cyber weapon, you might call it, used by the spooks in America. Unfortunately they lost it.”

The attack locks and encrypts files on users’ computers, posting a message asking for $300 worth of Bitcoins in order to unlock the files.

So far 16 NHS trusts in England have been affected by the attack, as well the telecoms company Telefonica in Spain.

Lauri explained how the hackers appear to have obtained the ‘weapon’.

“It appears the cyber attack affected so many computers in the UK in the NHS and in Spain by taking advantage of a very nasty vulnerability in Microsoft Windows, which was dumped by hacking group Shadow Brokers who obtained it from the NSA in America.”

These vulnerabilities were meant to be removed with a patch released by Microsoft on March 14th this year, but as Lauri explains: “At very large organisations it can take a long time to role out the patches.”

In some areas the NHS is running such an old version of Windows, Windows XP, that it’s no longer supported for updates. In these instances he says “it would not be possible to make those computers secure against this vulnerability.”

Lauri, who the US government have charged with taking information from NASA, the US Army and Federal Reserve and are currently trying to have extradiated from the UK, said he read a report last year about how NHS computers weren’t being updated with secure operating systems.

In theory organisations can protect themselves from attacks like this by backing up everything. But for an organisation as large as the NHS, Lauri says this would cost a lot.

“Because of funding constraints, there are not enough resources to be able to anticipate and pre-empt this.”

The attack is unprecedented and Lauri made clear how serious it was.

“This is the most serious cyber incident I can imagine happening in this day and age, other than an attack on a nuclear power plant, which have a lot better protections.”

Some hospitals have had to divert emergency patients while some planned operations are delayed. NHS Digital say patient data is not affected, but the full scale of the attack is not yet clear.

“This could be a life or death situation, but I seriously hope we’re overreacting to this.”