Dodgy Kaspersky update borks THOUSANDS of NHS computers

Windows-killing false positive topples networks nationwide, NHS sysadmin tells El Reg


A misfiring antivirus update from Kaspersky Lab "effectively levelled several networks" last months including systems at Britain's NHS, The Register has learned.

A Kaspersky update released on 25 October falsely classified a Windows system file, specifically tcpip.sys, as malign and quarantined it. The procedure left Windows PCs running Kaspersky Anti-Virus 6 for Workstations without network connectivity or otherwise borked after applying the dodgy update, creating all sorts of problems in the process.

A reader who works as a sysadmin in the NHS, who has asked to remain anonymous, explained: "As I work for an enterprise with several thousand computers, many of them in mission-critical areas, you can imagine the overtime that’s been worked over the weekend given that EVERY PC that was affected has to be visited manually and a pain-in-the-ass process has to be done to remove it."

In a statement, Kaspersky Lab acknowledged the issue and apologised for the inconvenience. The Russian security software firm didn't respond directly to our question on whether borked machines had to be fixed manually but did say that it was obliged to develop a "special remediation procedure" in the immediate aftermath of the incident.

On Friday, October 25, several Kaspersky Lab customers using Kaspersky Anti-Virus 6 for Workstations reported a problem with network access as a result of a false positive detection in Kaspersky Lab’s antivirus databases.

Kaspersky Lab technical specialists immediately started investigating the issue and removed the detection in the new antivirus databases, which were released at 8 pm MSK Friday, October 25.

In addition, on Saturday morning, October 26, Kaspersky Lab specialists developed a special remediation procedure to address several cases in which customers encountered loss of network connectivity even if databases were updated. The remediation procedure is available on Kaspersky Lab’s technical support website.

Kaspersky Lab would like to apologise for any inconvenience caused. Actions have been taken to prevent such incidents from occurring in the future.

Other contacts with previous experience in frontline NHS IT work told El Reg that decisions on which antivirus to run are left to individual trusts.

"While I was at the NHS, there was talk from time to time of standardising on a centrally supplied solution throughout the service on the grounds of consistency, easing central support, and economies of scale ... but to my knowledge that never came to fruition," he explained. "The prevailing philosophy was very much that local endpoint/server/network protection was a local responsibility, and the emerging National Programme was focused in security terms on confidentiality of centrally-held data and central services, with the protection of those central services largely outsourced."

False positives involving antivirus signature updates are a perennial problem that have affected nearly every vendor at one time or another. Even though testing procedures have improved, and security software packages these days place a much greater reliance of cloud-based detection and other techniques, the higher volume of updates needed to cope with the rising trojan tide means that screw-ups remain a regular occurrence.

The consequent problems present the biggest headache when Windows operating system files are falsely flagged as potentially malign and quarantined, as happened in the latest case involving Kaspersky Lab. ®


Other stories you might like

  • NASA delays SLS rollback due to concerns over rocky path to launchpad
    The road to the Moon is paved with... river rock?

    NASA's Moon rocket is to trundle back into its shed today after a delay caused by concerns over the crawlerway.

    The massive transporter used to move the Space Launch System between Vehicle Assembly Building (VAB) and launchpad requires a level pathway and teams have been working on the inclined pathway leading to the launchpad where the rocket currently resides to ensure there is an even distribution of rocks to support the mobile launcher and rocket.

    The latest wet dress rehearsal was completed on June 20 after engineers "masked" data from sensors that would have called a halt to proceedings. Once back in the VAB, engineers plan to replace a seal on the quick disconnect of the tail service mast umbilical. The stack will then roll back to the launchpad for what NASA fervently hopes is the last time before a long hoped-for launch in late August.

    Continue reading
  • Datacenter operator Switch hit with claims it misled investors over $11b buyout
    Complainants say financial projections were not disclosed, rendering SEC filing false and misleading

    Datacenter operator Switch Inc is being sued by investors over claims that it did not disclose key financial details when pursuing an $11 billion deal with DigitalBridge Group and IFM Investors that will see the company taken into private ownership if it goes ahead.

    Two separate cases have been filed this week by shareholders Marc Waterman and Denise Redfield in the Federal Court in New York. The filings contain very similar claims that a proxy statement filed by Switch with the US Securities and Exchange Commission (SEC) in regard to the proposed deal omitted material information regarding Switch's financial projections.

    Both Redfield and Waterman have asked the Federal Court to put the deal on hold, or to undo it in the event that Switch manages in the meantime to close the transaction, and to order Switch to issue a new proxy statement that sets out all the relevant material information.

    Continue reading
  • Google to pay $90m to settle lawsuit over anti-competitive behavior on the Play Store
    US developers that qualify could receive more than $200,000

    Google is to pay $90 million to settle a class-action lawsuit with US developers over alleged anti-competitive behavior regarding the Google Play Store.

    Eligible for a share in the $90 million fund are US developers who earned two million dollars or less in annual revenue through Google Play between 2016 and 2021. "A vast majority of US developers who earned revenue through Google Play will be eligible to receive money from this fund," said Google.

    Law firm Hagens Berman announced the settlement this morning, having been one of the first to file a class case. The legal firm was one of four that secured a $100 million settlement from Apple in 2021 for US iOS developers.

    Continue reading
  • Devops tool Jenkins now requires Java 11: This might sting a bit
    Final shift set for version 2.357 of developer automation platform

    It has taken a while, but the Jenkins project confirmed this week that Java 11 will be required from this week's Jenkins 2.357 and for the upcoming September LTS release.

    Jenkins, originally authored by Kohsuke Kawaguchi, recently passed its 10th anniversary. Originally known as Hudson, before the Oracle / Sun deal resulted in a fork, the platform is a veteran of the continuous integration and continuous delivery world. It is also written in Java.

    It's going to be a bit of a wrench. Java 11 itself was released in 2018 as a long-term support version, and the Jenkins LTS core has been Java 11-capable for a while now. The June LTS also supports Java 17 (the latest LTS of Java SE.)

    Continue reading

Biting the hand that feeds IT © 1998–2022