“A sophisticated hacker took command of large portions of the
University of Washington Medical Center’s internal network earlier
this year, and downloaded computerized admissions records for four
thousand heart patients, SecurityFocus.com has learned.”
“Dittrich acknowledged that the university, including the
medical center, has no perimeter firewall–but added that he didn’t
believe a firewall would fix the problem. The sheer size and
complexity of the medical center, and the rapid rate at which it
embraces new technology, makes it vulnerable. “You can get to a
point where you’re almost too big too survive,” Dittrich said.”
“The hacker gained initial access through a Linux system in
the hospital’s pathology department. That system was running
the client side of a remote administration tool called VNS, which
allowed him access to a Windows NT box. From there he exploited
file shares and remote administration relationships, and used
trojan horses, to expand his access throughout the network.”