Healthcare Cybersecurity

Lack of Encryption Leads to $3 Million HIPAA Penalty for New York Medical Center

Posted by HIPAA Journal

The University of Rochester Medical Center (URMC) has paid a $3 million HIPAA penalty for the failure to encrypt mobile devices and other HIPAA violations.

URMC is one of the largest health systems in New York State with more than 26,000 employees at the Medical Center and various other components of the health system, including Strong Memorial Hospital and the School of Dentistry.

The Department of Health and Human Services’ Office for Civil Rights (OCR) launched an investigation following receipt of two breach reports from UMRC – The loss of an unencrypted flash drive and the theft of an unencrypted laptop computer in 2013 and 2017.

This was not the first time OCR had investigated URMC. An investigation was launched in 2010 following a similar breach involving a lost flash drive. In that instance, OCR provided technical compliance assistance to URMC. The latest investigation uncovered multiple violations of HIPAA Rules, including areas of noncompliance that should have been addressed after receiving technical assistance from OCR in 2010.

Under HIPAA, data encryption is not mandatory. Following a risk analysis, as part of the risk management process, covered entities must assess whether encryption is an appropriate safeguard. An alternative safeguard can be implemented in place of encryption if it provides an equivalent level of protection.

In this case, URMC had assessed risk and determined that the lack of encryption posed a high risk to the confidentiality, integrity, and availability of ePHI, yet failed to implement encryption when it was appropriate and continued to use unencrypted mobile devices that contained ePHI, in violation of 45 C.F.R. § 164.31 2(a)(2)(iv).

OCR’s investigation confirmed that the ePHI of 43 patients was contained on the stolen laptop and as a result of the theft, that information was impermissibly disclosed – 45 C.F.R. §164.502(a). OCR also determined that URMC had failed to conduct a comprehensive, organization-wide risk analysis – 45 C.F.R. § 164.308(a)(1)(ii)(A) – that included all risks to the confidentiality, integrity, and availability of ePHI, and covered ePHI stored on the lost and stolen devices.

Risks had not been sufficiently managed and reduced to reasonable and acceptable level – 45 C.F.R. §164.308(a)(l)(ii)(B) – and policies and procedures governing the receipt and removal of hardware and electronic media in and out of its facilities had not been implemented – 45 C.F.R. § 163.310(d).

In addition to the $3,000,000 financial penalty, URMC is required to adopt a robust corrective action plan to address all aspects of noncompliance identified by OCR. URMC’s compliance efforts over the next two years will be scrutinized by OCR to ensure continuing compliance.

“Because theft and loss are constant threats, failing to encrypt mobile devices needlessly puts patient health information at risk,” said OCR Director Roger Severino. “When covered entities are warned of their deficiencies, but fail to fix the problem, they will be held fully responsible for their neglect.”

This is the sixth financial penalty of 2019 that OCR has issued to resolve violations of the Health Insurance Portability and Accountability Act and it is the fourth enforcement action to cite a risk analysis failure.

The risk analysis is one of the most important elements of HIPAA compliance and a risk analysis failure is the most common HIPAA violation cited in OCRs enforcement actions.

OCR has released a risk assessment tool to help covered entities and business associates comply with this aspect of HIPAA. Further information on the HHS risk assessment tool is available on this page.

The post Lack of Encryption Leads to $3 Million HIPAA Penalty for New York Medical Center appeared first on HIPAA Journal.

Average Ransomware Payment Increased 13% to $41,198 in Q3, 2019

Posted by HIPAA Journal

Ransomware is still one of the biggest cybersecurity threats faced by healthcare organizations. Not only have the attacks increased, ransom demands have increased.

A new analysis by ransomware remediation and incident response firm Coveware has revealed the average ransom payment increased by 13% to $41,198 in Q3, 2019, which is six times as much as in December 2018. Many companies have to pay considerably more. The attackers using Ryuk ransomware tend to demand payments of hundreds of thousands of dollars. Ryuk ransom payments between Q2 and Q3, 2019 ranged from $267,742 to $377,026. Ransom demands issued to large enterprises are often over $1 million.

While no industry is immune to ransomware attacks, they tend to be concentrated on certain industries where there is a higher than average chance of the ransom being paid. The most targeted industry sectors are professional services (18.3%), the public sector (13.3%), healthcare (12.8%), software services (11.7%), and the retailers (8.3%).

There has also been an increase in attacks on managed service providers. These attacks tend to require greater effort on the part of the attackers, but the potential rewards are considerable. A successful attack on an MSP can give the attackers access to the systems of all their clients. The threat actors using Sodinokibi and Globelmposter ransomware variants have been targeting MSPs and large enterprises, and large enterprises are commonly attacked by the threat actors using Netwalker, Hidden Tear, and Snatch ransomware variants.

While Coveware has not released information on the number of clients that have paid ransom demands, Coveware CEO Bill Siegel said the number is in the high hundreds.

The tactics used by cybercriminals to spread malware is constantly changing, and ransomware attacks are no different. Coveware’s report shows there has been a marked shift in how attacks are conducted and tactics have become far more sophisticated. When ransomware became popular with cybercriminals, the attacks were largely automated and random. Attacks then started to become more targeted on businesses, and now threat actors are adopting tactics most commonly associated with nation-state threat actors.

Coveware’s clients were most commonly attacked using stolen RDP credentials (50.6%). Phishing is also a common method of attack and was used to attack 39% of clients. In 8.1% of attacks, a software vulnerability was exploited to gain access to the network to deploy ransomware.

It is naturally in the best interests of ransomware developers to ensure that victims’ files can be recovered, as if word spreads that payment is pointless, no further payments would be made. However, payment of a ransom is no guarantee that files will be recovered. According to Coveware, 98% of clients that paid the ransom were supplied with working keys to decrypt data, although on average, they only allowed around 94% of data to be recovered.

The attackers using Dharma and Rapid ransomware variants often do not supply viable keys to unlock files after the ransom is paid and the encryption code used in Mr. Dec ransomware is poorly written and decryptors only work around 30% of the time.

Payment of a ransom is not always necessary, as free decryptors are available to unlock files through the No More Ransom project, although they do not work on the most commonly used ransom variants, which in quarter 3 were Ryuk (22.2%), Sodinokibi (21.1%), and Phobos (19.9%).

Files can also be recovered from backups, but in many cases up-to-date backups do not exist, backups are corrupted and file recovery is not possible, or they too are encrypted in the attacks.

The post Average Ransomware Payment Increased 13% to $41,198 in Q3, 2019 appeared first on HIPAA Journal.

BlueKeep Vulnerability Being Actively Exploited in Real World Attacks

Posted by HIPAA Journal

In May 2019, Microsoft made an announcement about a critical remote code execution vulnerability in Windows Remote Desktop Services named BlueKeep – CVE-2019-0708. As predicted by the cybersecurity community, a weaponized exploit would be developed and used in large-scale attacks. That prediction has now come true. Over the weekend, the first mass attacks using a BlueKeep exploit were discovered.

Soon after Microsoft announced the vulnerability, several security researchers developed proof-of-concept exploits for BlueKeep. One such exploit allowed a researcher to remotely take control of a vulnerable computer in just 22 seconds. The researchers held off publishing their PoC’s due to the seriousness of the threat and the number of devices that were vulnerable to attack. Initially, millions of internet-connected devices were at risk, including around a million Internet of Things (IoT) devices.

The BlueKeep vulnerability can be exploited remotely by sending a specially crafted RDP request. No user interaction is required to exploit the vulnerability. The flaw is also wormable, which means it is possible to use self-propagating malware to spread from vulnerable computer to another on the same network.

Microsoft issued multiple warnings about the vulnerability, which affects older Windows versions such as Windows 7, Windows XP, Windows Server 2003 and Windows Server 2008. Businesses and consumers were urged to apply the patch as soon as possible to prevent the vulnerability from being exploited. Warnings were also issued by the NSA, GCHQ, and other government agencies around the world. The cybersecurity community has also been warning businesses and consumers about the risk of attack, with many believing a weaponized exploit would be developed in a matter of weeks.

Even after multiple warnings had been issued, patching was slow. The patch was released 5 months ago there are still around 724,000 devices that have yet to have the patch applied. The total number of vulnerable devices will be considerably higher as scans do not include devices behind firewalls.

Following the disclosure of the vulnerability, security researcher Kevin Beaumont set up a global network of Remote Desktop Protocol (RDP) honeypots that were designed to be attacked. Weeks and months passed with no attempts made to exploit the vulnerabilities. Then on November 2, 2019 Beaumont discovered the honeypots had been attacked. First, one honeypot was attacked which caused the system to crash and reboot, followed by all the others aside from the Australian honeypot. While the attack was detected this weekend, the campaign has actually been ongoing for at least two weeks. The first attack occurred on October 23, 2019.

The crash dumps from the attacks were analyzed by security researcher Marcus Hutchins, aka MalwareTech. Hutchins was the person responsible for finding and activating a kill switch to block the WannaCry ransomware attacks in May 2017. Hutchins found artifacts in the memory indicating the BlueKeep vulnerability had been used to attack the honeypots and shellcode indicating the vulnerability was exploited to deliver a cryptocurrency miner, most likely for Monero.

Fortunately, the hackers exploiting the vulnerability appear to be unsophisticated, low-level threat actors who have not exploited the full potential of the vulnerability. The attackers have not developed a self-replicating worm and are only using the vulnerability to spread cryptocurrency mining malware on vulnerable devices with an internet-exposed RDP port. The attackers appeared to have conducted a scan for vulnerable devices and a list of IPs is being used for the attacks. The attacker(s) appears to be using a BlueKeep exploit that was published on the Metasploit framework in September.

The honeypot system and the failure to exploit the vulnerability on all 11 honeypots indicates the exploit is not working quite as planned and has not been modified to get it to work properly. However, this is a large-scale attack and at least some of the attacks have succeeded.

This is not the first time the BlueKeep vulnerability has been exploited by threat actors, as smaller more targeted attacks have been conducted and have succeeded, but it is the first mass-exploitation of BlueKeep.

Other threat actors may well discover how to unleash the full potential of the vulnerability and create a self-propagating worm. That would potentially enable all unpatched devices to be attacked, even those on internal networks. Those attacks may do more than slow down computers while cryptocurrency is mined. Wiper attacks similar to NotPetya could also potentially be conducted. The attack on the shipping firm Maersk cost around $300 million.

Preventing these attacks is simple and the advice remains the same as in May 2019 when BlueKeep was first announced. Apply Microsoft’s patch on all vulnerable computers as soon as possible.

The post BlueKeep Vulnerability Being Actively Exploited in Real World Attacks appeared first on HIPAA Journal.

Common Office 365 Mistakes Made by Healthcare Organizations

Posted by HIPAA Journal

An Office 365 phishing campaign has been running over the past few weeks that uses voicemail messages as a lure to get users to disclose their Office 365 credentials. Further information on the campaign is detailed below along with some of the most common Office 365 mistakes that increase the risk of a costly data breach and HIPAA penalty.

Office 365 Voicemail Phishing Scam

The Office 365 voicemail phishing scam was detected by researchers at McAfee. The campaign has been running for several weeks and targets middle management and executives at high profile companies. A wide range of industries have been attacked, including healthcare, although the majority of attacks have been on companies in the service, IT services, and retail sectors.

The emails appear to have been sent by Microsoft and alert users to a new voicemail message. The emails include the caller’s telephone number, the date of the call, the duration of the voicemail message, and a reference number. The emails appear to be automated messages and tell the recipient that immediate attention is required to access the message.

The phishing emails include an HTML attachment which will play a short excerpt from the voicemail message if opened. Users will then be redirected to a spoofed Office 365 web page where they must enter their Office 365 credentials to listen to the full message. If credentials are entered, they will be captured by the attacker. Users are then redirected to the Office.com website. No voicemail message will be played.

This is not the first time that voicemail and missed call notifications have been used as a lure in phishing attacks, but the inclusion of audio recordings in phishing emails is unusual. The partial voicemail recording comes from an embedded .wav file in the HTML attachment.

McAfee reports that three different phishing kits are being used to generate the spoofed Microsoft Office 365 websites, which suggests three different threat groups are using this ploy.

While there are red flags that should alert security-aware employees that this is a scam, unfamiliarity with this type of phishing scam and the inclusion of Microsoft logos and carbon-copy Office 365 login windows may be enough to convince users that the voicemail notifications are genuine.

Common Office 365 Mistakes to Avoid and HIPAA Best Practices

This is just the latest of several recent phishing campaigns targeting Office 365 users and attacks on Office 365 users are increasing. Listed below are some steps that can be taken to reduce risk along with some of the common Office 365 mistakes that are made which can increase the risk of account compromises, data breaches and HIPAA penalties.

Consider Using a Third-Party Anti-Phishing Solution on Top of Office 365

Office 365 incorporates anti-spam and anti-phishing protections as standard through Microsoft Exchange Online Protection (EOP). While this control is effective at blocking spam email (99%) and known malware (100%), it doesn’t perform so well at stopping phishing emails and zero-day threats. Microsoft is improving its anti-phishing controls but EOP is unlikely to provide a sufficiently high level of protection for healthcare organizations that are extensively targeted by cybercriminals.

Microsoft’s anti-phishing protections are better in Advanced Threat Protection (APT), although this solution cannot identify zero-day threats, does not include sandboxing for analyzing malicious attachments, and email impersonation protection is limited. For advanced protection against phishing and zero-day threats, consider layering a third-party anti-phishing solution on top of Office 365.

Implement Multi-Factor Authentication

A third-party solution will block more threats, but some will still be delivered to inboxes. The Verizon Data Breach Investigations Report revealed 30% of employees open phishing emails and 12% click links in those messages. Security awareness training for employees is mandatory under HIPAA and can help to reduce susceptibility to phishing attacks, but additional anti-phishing measures are required to reduce risk to a reasonable and acceptable level. One of the most effective measures is multi-factor authentication. It is not infallible, but it will help to ensure that compromised credentials cannot be used to access Office 365 email accounts.

Check DHS Advice Prior to Migrating from On-Premises Mail Services to Office 365

There are risks and vulnerabilities that must be mitigated when migrating from on-premises mail services to Office 365. The DHS’ Cybersecurity and Infrastructure Security Agency has issued best practices that should be followed. Check this advice before handling your own migrations or using a third-party service.

Ensure Logging is Configured and Review Email Logs Regularly

HIPAA requires logs to be created of system activity and ePHI access attempts, including the activities of authorized users. Those logs must also be reviewed regularly and checked for signs of unauthorized access and suspicious employee behavior.

Ensure Your Emails are Encrypted

Email encryption will prevent messages containing ePHI from being intercepted in transit. Email encryption is a requirement of HIPAA if messages containing ePHI are sent outside your organization.

Make Sure You Read Your Business Associate Agreement

Just because you have obtained a signed business associate agreement from Microsoft it does not mean your email is HIPAA-compliant. Make sure you read the terms in the BAA, check your set up is correct, and you are aware of your responsibilities for securing Office 365 and you are using Office 365 in a HIPAA compliant manner.

Backup and Use Email Archiving

In the event of disaster, it is essential that you can recover your email data. Your Office 365 environment must therefore be backed up and emails containing ePHI and HIPAA-related documents must be retained for a period of 6 years. An archiving solution – from Microsoft or a third-party – is the best way of retaining emails as archives can be searched and emails quickly recovered when they are required, such for legal discovery or a compliance audit.

The post Common Office 365 Mistakes Made by Healthcare Organizations appeared first on HIPAA Journal.

HHS Releases Updated HIPAA Security Risk Assessment Tool

Posted by HIPAA Journal

The HHS has updated its HIPAA Security Risk Assessment Tool and has added several new features that have been requested by users to improve usability.

The HIPAA Security Risk Assessment Tool was developed by the HHS Office of the National Coordinator for Health Information Technology (ONC) in collaboration with the HHS’ Office for Civil Rights.

The Security Risk Assessment Tool can help small to medium sized healthcare organizations conduct a comprehensive, organization-wide risk assessment to identify all risks to the confidentiality, integrity, and availability of protected health information (PHI).

By using the tool, healthcare organizations will be able to identify and assess risks and vulnerabilities and use that information to improve their defenses against malware, ransomware, viruses, botnets and other types of cyberattack.

The risk assessment is a foundational element of compliance with the Health Insurance Portability Act Security Rule. By conducting a risk assessment, healthcare organizations can identify areas where PHI may be at risk. Any risks can then be assessed, prioritized, and reduced to a reasonable and acceptable level.

Since its initial release, the tool has been updated several times to improve usability and add additional functions. The latest version of the Risk Assessment Tool – Version 3.1 – has been released to coincide with National Cybersecurity Awareness Month and includes several user-requested improvements:

  • Threat and vulnerability validation
  • Incorporation of NIST Cybersecurity Framework references
  • Improved asset and vendor management
  • Question flagging and a new Flagged Report
  • Ability to export Detailed Reports to Excel
  • Fixes for several reported bugs to improve stability

The tool can be downloaded from the HHS for Windows devices, although the latest version is not available for Mac OS.

The HHS points out that the tool is only as useful as the work that goes into conducting and documenting a risk assessment. Use of the tool does not guarantee compliance with the risk assessment requirements of the HIPAA Security Rule and will only help HIPAA-covered entities and their business associates conduct periodic risk assessments.

The post HHS Releases Updated HIPAA Security Risk Assessment Tool appeared first on HIPAA Journal.

Report Suggests Augmented Security Following a Data Breach Contributes to Increase in Patient Mortality Rate

Posted by HIPAA Journal

Healthcare data breaches lead to a reduction in the quality of care provided to patients, according to a study recently published in Health Services Research.

Researchers analyzed data from Medicare Compare which details quality measures at hospitals. Data from 2012-2016 was analyzed and compared with data from the HHS’ Office for Civil Rights on data breaches of more than 500 records over the same period. The researchers analyzed data on 3,025 Medicare-certified hospitals, 311 of which had experienced a data breach.

According to the study, the time it took from a patient arriving at the hospital to an electrocardiogram being performed increased by up to 2.7 minutes at hospitals that had experienced a data breach. A ransomware attack that prevents clinicians from accessing patient data will limit their ability to provide essential medical services to patients, so a delay in conducting tests and obtaining the results is to be expected. However, the delays were found to continue for months and years after an cyberattack was experienced.

The study showed that 3-4 years after a breach had occurred there were still delays in providing electrocardiograms to patients. The waiting time for an electrocardiograms to patients was found to be up to 2 minutes longer than before the breach occurred.

Hospitals that experienced a data breach also saw an increase in the 30‐day acute myocardial infarction mortality rate. The mortality rate at breached hospitals increased by as much as 0.36%.

The increase in mortality rate has not been attributed to the cyberattack itself, as recovery is usually possible without a few days to a few weeks after a cyberattack. The researchers suggest the delays in providing medical services following a cyberattack is due to the steps hospitals have taken to improve the security of their systems and better protect patient data, along with the increased HHS oversight that occurs after a data breach is experienced. These factors can result in a deterioration in the timeliness of care and patient outcomes.

Following a cyberattack, hospitals augment their security controls to prevent further cyberattacks from succeeding. Those measures include multi-factor authentication, stronger passwords, and other security enhancements. While these additional measures improve the security posture of hospitals and make breaches less likely to occur in the future, they can also impede clinicians.

“Over the past few years, overall improvements in AMI treatment have resulted in the 30‐day AMI mortality rate decreasing about 0.4 percentage points annually from 2012 to 2014,” wrote the researchers. “A 0.23‐0.36 percentage point increase in 30‐day AMI mortality rate after a breach effectively erases a year’s worth of improvement in the mortality rate.”

The researchers suggest hospitals should carefully evaluate the security measures they implement to prevent further breaches to ensure they do not unduly impede clinicians and negatively affect patient outcomes.

The study – Data breach remediation efforts and their implications for hospital quality – was published in the October edition of Health Services Research: DOI: 10.1111/1475-6773.13203.

The post Report Suggests Augmented Security Following a Data Breach Contributes to Increase in Patient Mortality Rate appeared first on HIPAA Journal.

57% Rely on Multi-Factor Authentication to Improve Security but MFA is Not Infallible

Posted by HIPAA Journal

A recent study conducted by the password manager provider LastPass has revealed only 57% of businesses use multi-factor authentication, even though it is one of the best ways of ensuring stolen credentials cannot be used to gain access to email accounts and corporate networks.

Multi-factor authentication requires a second factor to authenticate users in addition to a password. In the event of credentials being stolen, via a phishing attack for example, they could not be used to access an account unless the attacker also has an additional authentication factor – A one-time code sent to a mobile phone or a token, for example.

The study, which was conducted on 47,000 businesses, showed use of multi-factor authentication has increased by 12% since last year. According to the report, 95% of companies that have implemented multi-factor authentication use a software-based system such as a mobile app. 4% use a hardware-based multi-factor authentication solution, and 1% use biometrics such as a fingerprint scan. Software-based solutions are usually the most cost-effective to implement which accounts for the high percentage of businesses that use this MFA method.

The threat from phishing can be reduced through anti-phishing solutions such as spam filters and susceptibility to phishing attacks can be reduced by providing user security awareness training and conducting phishing simulation exercises. Multi-factor authentication should also be implemented as an additional security layer to protect against phishing attacks.

According to Microsoft’s Director of Identity Security, Alex Weinert, companies that implement multi-factor authentication are 99.9% less likely to be compromised than companies that do not use MFA. Considering how effective MFA can be at preventing data breaches, it is surprising that Microsoft’s figures show fewer than 10% of enterprise users per month use MFA on their accounts.

While MFA can certainly reduce the risk of a data breach, it can give companies a false sense of security. Multi-factor authentication is not infallible and should not be seen as a substitute for end user training on social engineering and phishing attacks.

Knowledge-based MFA authentication can be bypassed by obtaining information via social engineering scams and since MFA tokens are stored somewhere, they could be stolen and be used by attackers to access resources. MFA tokens can also be manipulated through techniques such as SIM swapping. The FTC has recently issued guidance on SIM swapping following an increase in attacks.

As the number of organizations using multi-factor authentication has increased, so too have attacks that bypass MFA. The rise in attacks prompted the FBI to warn businesses that they should not rely on MFA to secure their accounts. In a Private Industry Notification issued in September, the FBI explained that cybercriminals are managing to bypass multi-factor authentication using a variety of different methods.

The advice of the FBI is to use biometric methods of authenticating users rather than software-based MFA solutions, tokens, or one-time codes. Biometric means of authenticating users is the most secure MFA method, provided that all biometric information used for authentication is stored securely.

The post 57% Rely on Multi-Factor Authentication to Improve Security but MFA is Not Infallible appeared first on HIPAA Journal.

FBI Issues Warning About E-Skimming Threats and Tips for Reducing Risk

Posted by HIPAA Journal

The Federal Bureau of Investigation has issued a warning about e-skimming threats, following an increase in attacks on small and medium sized businesses and government agencies.

E-skimming is the introduction of malicious code on websites that process online payments. The code captures debit and credit card information when it is entered into payment portals and the information is silently transmitted to an attacker-controlled domain in real-time.

Attacks can be performed on any company that has an online payment system, most commonly on companies in the retail, travel, and entertainment industries and utility companies. Attacks are also conducted on third-party vendors, such as those that provide web analytics and online advertisements.

Recently, an e-skimming attack was reported by a healthcare organization – Mission Health in Western North Carolina. Code had been loaded onto its e-commerce websites which allowed the attackers to obtain the credit card information of individuals when they purchased health products. The malicious code was active on the websites for three years before it was detected.

There are several methods that attackers use to access to a website to load their malicious code. An attack could start with a phishing email containing a link to a website that captures login credentials to the company’s e-commerce platform. Access could also be gained using brute force tactics to guess the e-commerce system password, or vulnerabilities in the e-commerce platform or website could be exploited. Attacks could also occur through compromised supply chains or via a third-party vendor with access to the e-commerce platform, such as an IT company or managed service provider.

These attacks often come to light when multiple complaints are received from customers who have suffered financial losses after using an e-commerce website. Credit card companies may identify patterns in fraud and trace them back to a specific online payment portal, or companies may identify a suspicious domain in their website code or notice that JavaScript code on the website has been edited.

There are several steps that can be taken to reduce risk. The payment software used on an e-commerce site, plugins, and the content management system should be kept up to date and patches issued by payment software companies should be applied as soon as possible. Third-party resource integrity checks should be activated via Content Security Policy (CSP) to limit the loading of JavaScript to trusted domains.

Code integrity checks should be performed regularly to identify any changes to the code on the e-commerce platform and web logs should be monitored and regularly analyzed. Anti-virus software or plugins should be used on websites to help identify malicious code and businesses should ensure they are PCI DSS compliant.

To protect against brute force attacks, strong, unique passwords should be created, and multi-factor authentication should be implemented to help ensure stolen credentials cannot be used to gain access to the e-commerce platform.

The post FBI Issues Warning About E-Skimming Threats and Tips for Reducing Risk appeared first on HIPAA Journal.

Vulnerability Identified in Philips IntelliSpace Perinatal Information Management System

Posted by HIPAA Journal

A vulnerability has been identified in the Philips IntelliSpace Perinatal obstetrics information management system.

The vulnerability – CVE-2019-13546 – could be exploited remotely by an authorized remote desktop session host application user or by an individual with physical access to a locked application screen. The vulnerability affects IntelliSpace Perinatal Versions K and earlier and requires a low level of skill to exploit. The flaw has been assigned a CVSS v3 base score of 6.1 out of 10 (medium severity).

Exploitation of the vulnerability would allow an attacker to break out of the containment of the application and access resources from the Windows operating system as the limited-access Windows user. If an attacker used exploits for vulnerabilities in Windows once access to the operating system had been achieved, the attacker could potentially elevate operating system privileges to administrator level.

Once access to the operating system has been achieved, an attacker could execute software and view, update or delete files, directories, and alter the system configuration. This could compromise the confidentiality, integrity, and availability of the system and application. If the Document Export (DOX) function has been installed on the application server, protected health information would also be at risk of exposure.

The vulnerability was identified by Brian Landrum of Coalfire LABS who reported it to Philips. Under the Philips’ Coordinated Vulnerability Disclosure Policy, an advisory was issued to raise awareness of the flaw and allow users to implement mitigating controls to prevent exploitation.

Philips is assessing whether the vulnerability can be corrected in the next product update, which is scheduled to be released at the end of 2020. In the meantime, Philips has issued guidance on mitigations that can be implemented to reduce the potential for exploitation, which are available to users of the obstetrics information management system through Philips InCenter and on the US-CERT website. Product documentation will also be updated to include details of the mitigations.

The post Vulnerability Identified in Philips IntelliSpace Perinatal Information Management System appeared first on HIPAA Journal.