Table of contents exchange of letters with the minister executive summary

Download 5.91 Mb.

View original pdf

Page	132/329
Date	27.11.2023
Size	5.91 Mb.
	#62728

1 ... 128 129 130 131 132 133 134 135 ... 329

Report of the COI into the Cyber Attack on SingHealth 10 Jan 2019

COI Report – Part IV
Page 153 of 425

(a) First, the query could be a legitimately run query which originated from some other automated services b) Second, the query could be a legitimately run query which originated from a SQL-linked server c) Third, the query could have been run by some external program that he did not have knowledge of and that could run on the Citrix servers and d) Fourth, some individual had run the query from the Citrix server.
470. The third and fourth possibilities would have meant that there was some possible misuse of the AA. account.
However, as Sze Chun was still trying to figure out what was happening and could not be sure that the AA. account was being misused, it did not occur to him to report the matter to the SMD at that point.
26.2 Informing Katherine and the Citrix Team
471. Having reached a dead end, Sze Chun emailed Katherine, Kelvin, Lum, Loo, and Robin to seek their advice in the afternoon of 4 July 2018. In his email,
Sze Chun stated that there was a query made using the AA. account from Workstation Band provided the text of the query along with some screenshots supporting his findings.
472. Several minutes later, Sze Chun replied to the same email thread, stating that he “may be contacting assistance to make a visit to that PC”, referring to Workstation B. Sze Chun has explained that there was “a sense of urgency in
(his) mind, because if the query was not run with permission, it would mean that the AA. account had been misused. By then, he had learnt that Workstation B was deployed in SGH, and he thought to ask someone thereto find out if there was an explanation for the query.

COI Report – Part IV
Page 154 of 425

26.3 Detecting active queries to the SCM database
473. Upon receiving Sze Chun’s email, Katherine noticed that the Citrix server in question was Citrix Server 2. She also noted that the account, workstation, and program that were involved were unusual.
474. Katherine then logged into the SCM database to look at the current active sessions running on the database. Her intention was to check if the query mentioned by Sze Chun was still running. She found that very similar queries were being run. The active sessions reflected the hostname of VM 1, and the queries were being run using a different program (referred to in this section as the “second program”). She was of the view that this was indicative of abnormal activity, and called Benjamin to inform him of the active sessions. Following the call, Benjamin checked the active sessions and found the same queries described by Katherine. He thought that perhaps it could be some new modules that were deployed or being tested, and which used the second program to run queries on the SCM database. Benjamin called some colleagues, who confirmed that they were not running any queries, and that they were unaware of the second program.
476. At pm, Katherine emailed Sze Chun with a screenshot showing the SQL sessions on the SCM database involving the second program and running from VM 1. Katherine asked Sze Chun in her email why the hostname was that of VM 1. Shortly after at pm, Katherine also pointed out that that the query had been running since pm, and was still running. At pm, Sze Chun replied Katherine, confirming that the query she identified was still running, and that there was a second query that was running at the time.
477. By this point, Sze Chun had become more concerned, as the probability of the AA. account being misused appeared to be higher, in view of all the unusual circumstances.

Download 5.91 Mb.

Share with your friends:

1 ... 128 129 130 131 132 133 134 135 ... 329