Healthcare Cybersecurity

Consumers Concerned About Medical Device Security

Posted by HIPAA Journal

The importance consumers place on the privacy and security of their health information has been explored in a recent nCipher Security survey.

The survey was conducted on 1,300 U.S. consumers and explored attitudes toward online privacy, the sharing of sensitive information, and data breaches.

The survey revealed consumers are more concerned about their financial information being hacked than their health information. 42% of respondents said their biggest cybersecurity concern was their financial information being stolen, compared to 14% whose main concern was the theft of their health data.

Concern about financial losses is understandable. Theft of financial information can have immediate and potentially very serious consequences. Theft of health data may not be viewed to be as important by comparison, but consumers are still concerned about the consequences of a breach of their personal information.

Over one third of consumers said they were worried that hackers would tamper with their data and 44% were concerned about identity theft after a data breach. 22% of consumers said they were concerned that the hacking of a connected device would jeopardize their health.

The survey explored the main privacy and security concerns related to the sharing of personal information. The biggest privacy concerns were providing SSNs or credit card numbers over the phone (46%), online banking (35%) and online shopping (34%). 16% of respondents thought their private information was most vulnerable when downloading health records or using an internet-connected medical device.

An increasing number of people are now using personal devices to track their movements and monitor their health. Only 37% of survey respondents said they do not record health metrics on some kind of internet-connected device.

23% of consumers use smartphones for that purpose, 135 have internet-connected scales, 12% wear fitness trackers, and 10% use an Apple Watch or similar device. 19% of consumers connect to their provider’s website to track and record their health information.

The survey suggests many consumers have strong feelings about medical device security. More than half of respondents (52%) believed the best way to protect personal data on medical devices is encryption. In the event of a cyberattack, personal information would not be put at risk.

35% of consumers said they should be required to validate their devices regularly to better protect privacy and 31% of respondents thought medical devices should be independently certified.  18% are in favor of government-controlled medical devices. 17% of respondents said executives should be fired if personal healthcare data is exposed, including executives at medical device manufacturers.

The post Consumers Concerned About Medical Device Security appeared first on HIPAA Journal.

Critical Vulnerability Identified in Burrow-Wheeler Aligner Genomics Mapping Software

Posted by HIPAA Journal

Researchers at Sandia National Laboratories have discovered a vulnerability in open source software used by genomic researchers. If exploited, an attacker could gain access to and alter sensitive genetic information.

DNA screening is a two-step process. First, a patient’s DNA is sequenced and their genome is mapped. Then, the patient’s genetic information is compared with a standardized human genome. Any differences between the two are assessed to determine whether genetic differences are due to diseases. A software tool is used to make the comparison.

Sandia researchers discovered a stack-based buffer overflow vulnerability – CVE-2019-10269 – in the Burrow-Wheeler Aligner (BWA) program used by many researchers to perform DNA-based medical diagnostics. The vulnerability is present at the point where BWA imports the standardized human genome from government servers. Patient information is transmitted via an insecure channel and could be intercepted in a man-in-the-middle attack.

An attacker could intercept the standardized human genome, combine it with malware, and then transmit both to the BWA user’s device. The malware could alter the information in the patient’s DNA analysis during genome mapping and, as a result, the final DNA analysis could be corrupted.

An attacker could alter DNA mapping data to make it appear that a patient does not have a disease, which would result in a delay in the patient receiving treatment. The DNA analysis could also be altered to indicate a patient has a disease, which would lead physicians to prescribe unnecessary medications which could potentially be harmful to the patient.

After discovering the vulnerability, Sandia notified the software developer and the U.S. Computer Emergency Readiness Team (US-CERT). The software developer has now patched the vulnerability in the latest version of the software. No reports have been received to date to suggest the flaw has been exploited in real-world attacks.

The vulnerability requires a low level of skill to exploit and has been assigned a CVSS v3 base score of 9.8 out of 10 – Critical.

All users of the BWA program should update to the latest version of the software as soon as possible to prevent the flaw from being exploited. The researchers also suggest implementing a solution that prevents sequenced DNA data from being altered and to only ever send sensitive data over secure, encrypted channels.

The researchers have also urged security researchers to analyze genomics software for similar weaknesses. While the BWA vulnerability has been corrected, similar vulnerabilities may exist in other genomics mapping programs.

The post Critical Vulnerability Identified in Burrow-Wheeler Aligner Genomics Mapping Software appeared first on HIPAA Journal.

U.S. Cyber Command Warns of Active Exploitation of 2017 Outlook Vulnerability

Posted by HIPAA Journal

A two-year-old vulnerability in Microsoft Outlook is being exploited by hackers in targeted attacks on U.S. government networks.

U.S. Cyber Command has issued a warning about vulnerability CVE-2017-1174, which is being actively exploited to install remote access Trojans and other forms of malware.  U.S. Cyber Command strongly recommends patching the vulnerability immediately to prevent exploitation.

The flaw is a sandbox escape vulnerability which can be exploited if the attacker has the user’s outlook credentials, which could be obtained via a phishing attack or other means. The attacker could then change the user’s home page to a page with embedded code that downloads and executes malware when Outlook is opened.

U.S. Cyber Command made no mention of the threat actors believed to be behind the attacks, although security researchers at Palo Alto Networks, FireEye, Chronicale, and others have linked the attacks to the Iran-backed cyberespionage group APT33.

APT33 has been exploiting this vulnerability for at least a year, but instead of using phishing, the group conducts brute force attacks using commonly used passwords. A typical attack will see multiple accounts targeted. When multiple passwords have been guessed, the Outlook vulnerability is exploited, and malware is downloaded on multiple devices on the network.

While there have been attacks on U.S. entities in the past, the group has been most active in the Middle East. The rise in attacks on American targets is believed to be linked to the escalating tensions between the two countries.

The U.S. Cyber Command warning on Twitter comes just a few days after the Director of the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Chris Krebs, issued a warning on Twitter about Iran-backed threat groups conducting attacks using wiper malware. That warning was issued following an increase in cyberattacks on U.S. businesses and government entities by threat actors with links to Iran.

Symantec also issued a warning about an increase in attacks by the threat group APT33 in March this year, in which an exploit for a vulnerability in WinRAR was being used.

APT33, also known as Shamoon, was discovered to have links to Iran by FireEye researchers in 2017. The group is believed to have conducted a range of cyberattacks throughout the Middle East. The largest ever cyberattack in the Middle East, on oil firm Saudi Aramco in 2012, involved wiper malware called Shamoon. While the malware shares the name with the threat group, APT33 has not been confirmed as being involved in the attacks, although it is suspected by many.

Brandon Levene, head of applied intelligence at Chronicle, analyzed malware samples released by U.S. Cyber Command and found several similarities between the latest attacks and Shamoon malware campaigns in 2016. The latter leveraged a vulnerability and executed a PowerShell script to download the Pupy remote access Trojan and there are code similarities in the downloaders used in the latest attacks.

Levene also analyzed three malicious tools that were used in the recent attacks. The tools had different purposes but would have allowed the attackers to interact with a server they have compromised and conduct a range of different malicious activities. APT33 has used similar tools in attacks in the past to remotely execute code on compromised devices. FireEye’s Andrew Thompson also attributed the latest attacks to the threat group APT33.

With the U.S. stepping up its cyber offensive against Iran and as tensions continue to rise, retaliatory attacks on U.S. targets are likely to continue.

The post U.S. Cyber Command Warns of Active Exploitation of 2017 Outlook Vulnerability appeared first on HIPAA Journal.

Smaller Healthcare Providers Struggling to Implement Healthcare Cybersecurity Best Practices

Posted by HIPAA Journal

A recent study of cybersecurity best practices adopted by large and small healthcare providers has revealed there is a growing gulf between the two. Larger providers are more likely to have mature, sophisticated cybersecurity defenses, while smaller providers are struggling to follow cybersecurity best practices.

For the study, KLAS and CHIME analyzed responses to the 2018 Healthcare’s Most Wanted survey given by around 600 healthcare providers and assessed each to determine whether they were adhering to healthcare cybersecurity best practices.

One of the requirements of the Cybersecurity Act of 2015 was for the Department of Health and Human Services (HHS) to form a task group to develop guidance for healthcare providers to help them manage and mitigate threats to patient data.

The 405(d) Task Group released the document – Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients (HICP) – which details 10 cybersecurity principles relevant to healthcare providers of all sizes. These principles must be addressed to ensure cybersecurity risks are reduced to a reasonable and acceptable level.

The principles are:

  • Email protection systems
  • Endpoint protection systems
  • Access management
  • Data protection and loss prevention
  • Network management
  • Vulnerability management
  • Incident response
  • Medical device security
  • Cybersecurity policies

KLAS and CHIME assessed the responses against these principles and found large healthcare organizations to be performing well, with mature and sophisticated cybersecurity defenses. Larger healthcare organizations were more proactive and were conducting regular vulnerability scans and application testing, whereas smaller providers were reliant on penetration tests to identify vulnerabilities.

Larger healthcare organizations were more likely to have a dedicated CISO, board-level committees and governance, risk management, compliance committees, and BYOD management, which were often found lacking at smaller organizations.

Smaller providers were less likely to use network segmentation and multi-factor authentication – Two important measures for limiting damage in the event of credentials being compromised. While network access controls had been implemented at virtually all surveyed provider organizations, less than half of smaller providers had implemented network segmentation.

Network segmentation is important for preventing the spread of malware internally and to stop hackers from having full access to the entire network. Without it, a single compromised device could mean the entire network is compromised. Multi-factor authentication is similarly important. In the event of credentials being stolen, in a phishing attack for example, multi-factor authentication should prevent the account from being accessed. Only half of smaller providers had implemented MFA.

There were several positives in the report. Email and endpoint security systems had been implemented at most provider organizations which provide a reasonable level of protection against external threats. The threat from phishing was being addressed through security awareness training and phishing email simulations. 70% of all providers conducted phishing simulations at least every quarter.

Providers are concerned about medical device security and the potential for an attack to cause harm to patients. Most providers have included medical device security in their cybersecurity program, which is supported by strong cybersecurity practices in other areas. Data loss prevention solutions have also been widely adopted, although on-premises DLP solutions have slowed transition to the cloud. Most organizations that use DLP solutions backup data physically rather than using cloud backup services.

Incident response plans have been developed by most providers and most have signed up with information sharing and analysis organizations to participate in threat sharing. It is essential to have a plan in place to ensure a smooth incident response, but that plan must be tested to make sure it works in practice. Only half of organizations conduct an exercise annually to test their incident response plan.

“Today’s security requirements are challenging historical asset management practices, making it increasingly necessary for organizations to establish clear policies that align their IT, information security, healthcare technology management, and procurement teams,” said Steven R. Cagle, CEO of Clearwater, sponsor of the report.

Making improvements to an organization’s cybersecurity posture can be a challenge with too little money and resources often available to address all issues. Consequently, it can be difficult to know where to start. Cagle suggests starting with a comprehensive risk analysis to identify and evaluate all risks. A risk management plan can then be developed to prioritize the most serious vulnerabilities.

Larger healthcare organizations are more likely to use risk management software to support this process and identify the highest risks and optimize deployment of security controls. The result is greater risk reduction for lower costs.

The findings of the KLAS-CHIME study were published in the white paper – How Aligned Are Provider Organizations with the Health Industry Cybersecurity Practices (HICP) Guidelines?

The post Smaller Healthcare Providers Struggling to Implement Healthcare Cybersecurity Best Practices appeared first on HIPAA Journal.

Medtronic Recalls Insulin Pumps Due to Cybersecurity Risk

Posted by HIPAA Journal

The United States Computer Emergency Readiness Team (US-CERT) and the Food and Drug Administration (FDA) have issued alerts about cybersecurity flaws in certain Medtronic insulin pumps.

The affected insulin pumps connect with other devices such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices using wireless RF. Vulnerabilities have been identified in certain MiniMed 508 and MiniMed Paradigm insulin pumps which could allow an attacker with adjacent access to an affected product to intercept, modify, or interfere with the RF communications to or from the product.

Consequently, it would be possible to read data sent to and from the device, alter the settings of the insulin pump, and take control of insulin delivery. An attack could therefore result in hypoglycemia, diabetic ketoacidosis, or death.

The flaw – CVE-2019-10964 – is due to the communications protocol not properly implementing authentication or authorization and has been assigned a CVSS v3 base score of 7.1 out of 10.

The flaw was uncovered by security researchers Nathanael Paul, Jay Radcliffe, and Barnaby Jack, Billy Rios, Jonathan Butts, and Jesse Young, with assistance provided by Medtronic.

The following devices are vulnerable:

  • MiniMed 508 pump – All versions
  • MiniMed Paradigm (511 pump, 512/712 pumps, 712E pump, 515/715 pumps, 522/722 pumps, 522K/722K pumps.
  • MiniMed 523/723 and 523K/723K pumps – Software versions 2.4A or lower
  • MiniMed Paradigm Veo 554/754 pumps – Software versions 2.6A or lower
  • MiniMed Paradigm Veo 554CM and 754CM models only – Software versions 2.7A or lower

FDA deputy director of strategic partnerships and technology innovation Suzanne Schwartz said, “The risk of patient harm if such a vulnerability were left unaddressed is significant.” At this stage, no one is known to have exploited the flaw in a real-world attack.

While there are mitigations that can help to reduce the risk of exploitation of the vulnerability, Medtronic has been unable to develop a patch or software update that can correct the flaw. Consequently, the decision was taken to recall all affected insulin pumps and replace them with devices with more robust cybersecurity protections.

Medtronic says there are around 4,000 patients using the vulnerable insulin pumps in the United States. All have been asked to contact their care providers as soon as possible to arrange for their insulin pump to be replaced.

The post Medtronic Recalls Insulin Pumps Due to Cybersecurity Risk appeared first on HIPAA Journal.

DHS Warns of Increasing Risk of Wiper Malware Attacks by Iranian Threat Actors

Posted by HIPAA Journal

The Director of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning following a rise in cyberattacks by ‘Iranian regime actors.’

The warning from Christopher C. Krebs came as tensions are building between the United States and Iran. Iran has been accused of planting magnetic mines to damage commercial shipping vessels and a U.S. surveillance drone was shot as it flew over the Strait of Hormuz. Iran claims the drone was flying in its territory.

The U.S. responded with a planned air strike, although it was called off by President Trump due to the likely loss of life. However, a strike did take place in cyberspace. The U.S. Cyber Command has reportedly launched an attack on an Iranian spying group, Islamic Revolutionary Guard Corps, that is believed to have been involved in the mine laying operation. According to a recent report in the Washington Post, the cyberattacks disabled the command and control system that was used to launch missiles and rockets.

Iranian threat actors have also been highly active. There have been increasing numbers of cyberattacks on United States industries and government agencies.

While cyberattacks can take many forms, Iranian threat actors have increased attacks using wiper malware. In addition to stealing data and money, the threat actors use the malware to wipe systems clean and take down entire networks.

Iran is one of three countries rated by the United States as having highly capable threat actors involved in economic espionage and theft of trade secrets and proprietary data. Iranian hackers are more than capable of conducting devastating cyberattacks.

Iranian hackers were behind the SamSam ransomware attacks on healthcare providers and hackers working for the Iranian regime are believed to be responsible for the cyberattack on the Saudi Arabian oil firm Saudi Aramco in 2012. Shamoon wiper malware was used in that attack to wipe tens of thousands of devices.

The harm caused by these wiper attacks is considerable. In 2017, attacks using NotPetya wiper malware resulted in global financial losses of between $4 billion and $8 billion. The attack on the shipping firm Maersk resulted in losses of around $300 million. The attacks are also common. According to a recent report by Carbon Black, 45% of healthcare CISOs have experienced a wiper malware attack in the past 12 months.

The hackers may be highly capable, but they still use basic techniques and exploit common weaknesses to gain access to networks. These include phishing and spear phishing, social engineering, password spraying, and credential stuffing.

All of these attack methods can be blocked with basic cybersecurity measures such as enforcing the use of strong passwords, changing all default passwords, rate limiting on logins, applying the rule of least privilege when setting permissions, implementing multi-factor authentication, closing unused ports, disabling RDP, prompt patching,  adopting a robust backup strategy, and providing security awareness training to employees.

Krebs warned that all U.S industries, government agencies, and businesses should be alert to the risk of cyberattacks. “If you suspect an incident, take it seriously and act quickly,” said Krebs.

The post DHS Warns of Increasing Risk of Wiper Malware Attacks by Iranian Threat Actors appeared first on HIPAA Journal.

Vulnerabilities in Servers Behind Majority of Healthcare Data Breaches

Posted by HIPAA Journal

Cybercriminals are managing to find and exploit vulnerabilities to gain access to healthcare networks and patient data with increasing regularity. The past two months have been the worst and second worst ever months for healthcare data breaches in terms of the number of breaches reported.

Phishing attacks on healthcare organizations have increased and email is now the most common location of breached protected health information. However, a recent analysis of the data breaches reported to the Department of Health and Human Services’ Office for Civil Rights (OCR) in the past 12 months has revealed servers to be the biggest risk. Servers were found to be involved in more than half of all healthcare data breaches.

Clearwater Cyberintelligence Institute (CCI) analyzed the 90 healthcare data breaches reported to OCR in the past 12 months. Those breaches resulted in the exposure, impermissible disclosure, or theft of the records of more than 9 million individuals.

The CCI analysis revealed 54% of all reported breaches of 500 or more healthcare records were in some way related to servers.

Servers house essential programs that are used across the healthcare organization. As a central repository of programs and data, they are an attractive target for hackers. Once access has been gained, data can be viewed, copied, altered, or deleted, systems can be sabotaged, and healthcare organizations can be subjected to extortion using ransomware.

CCI performed a risk analysis to determine high and critical risks facing health systems and hospitals. CCI determined 63% of all identified risks were related to the failure to adequately address vulnerabilities in servers.

The high number of server-related data breaches clearly shows that those flaws are being exploited by hackers to gain access to healthcare networks.

According to CCI, one of the most common server vulnerabilities is the failure to keep on top of user account management. When employees leave the company their accounts must be deleted. Dormant accounts are a major risk and are often used by malicious actors to access systems and mask their activities. CCI notes the risk increases with the number of accounts that are left dormant. The longer those accounts are left open, the greater the likelihood that at least one will be used for illicit or malicious purposes.

To address this risk, security controls should be implemented that automatically disable or delete accounts when the HR department changes the status of an employee. If that is not possible, CCI recommends conducting frequent, periodic reviews to ensure all unused accounts are disabled.

In an ideal world, an account would be disabled instantly. In practice, CCI recommends having the systems, policies, and procedures in place to ensure no account remains open for more than 48 hours after it is no longer required.

Reviews of system activity logs should also be conducted to determine whether dormant accounts have been used inappropriately or if any actively used accounts have been compromised or are being misused.

Excessive permissions on user accounts is another serious server vulnerability. Excessive permissions can result in accidental or deliberate access, alteration, or deletion of data. The failure to restrict access rights is also a violation of the HIPAA principle of least privilege.

CCI reports that the risk of excessive user permissions is highest in organizations that do not regularly review user permissions (43.6%), perform user activity reviews (43.6%), or when there is a lack of proper user account management (43.1%).

Regular reviews of user activity will help healthcare organizations to quickly identify anomalies in user data that could be indicative of account misuse or a cyberattack. The frequency of those reviews should be dictated by several factors, including staff turnover and the number of users. CCI suggests user permission and user activity log reviews at least every quarter for an organization with 100 or more users.

The post Vulnerabilities in Servers Behind Majority of Healthcare Data Breaches appeared first on HIPAA Journal.

May 2019 Healthcare Data Breach Report

Posted by HIPAA Journal

In April, more healthcare data breaches were reported than in any other month to date. The high level of data breaches has continued in May, with 44 data breaches reported. Those breaches resulted in the exposure of almost 2 million individuals’ protected health information.

Healthcare data breaches by month 2014-2019

On average, 2018 saw 29.5 healthcare data breaches reported to the HHS’ Office for Civil Rights each month – a rate of more than one a day.

From January 2019 to May 2019, an average of 37.2 breaches have been reported each month. Up until May 31, 2019, 186 healthcare data breaches had been reported to OCR, which is more than half (52%) the number of breaches reported last year.

It remains to be seen whether the increase in data breaches is just a temporary blip or whether 40+ healthcare data breaches a month will become the new norm.

Healthcare records exposed by month 2017-2019

May saw a 186% increase in the number of exposed records compared to April. Across the 44 breaches, 1,988,376 healthcare records were exposed or compromised in May. So far this year, more than 6 million healthcare records have been exposed, which is more than half of the number of records exposed in 2018.

Healthcare records exposed by year 2014-2019

In terms of the number of records exposed, May would have been similar to April were it not for a massive data breach at the healthcare clearinghouse Inmediata Health Group. The breach was the largest of the year to date and resulted in the exposure of 1,565,338 records.

A web page which was supposed to only be accessible internally had been misconfigured and the page could be accessed by anyone over the internet.

 

Rank Name of Covered Entity Covered Entity Type Individuals Affected Type of Breach
1 Inmediata Health Group, Corp. Healthcare Clearing House 1,565,338 Unauthorized Access/Disclosure
2 Talley Medical Surgical Eyecare Associates, PC Healthcare Provider 106,000 Unauthorized Access/Disclosure
3 The Union Labor Life Insurance Company Health Plan 87,400 Hacking/IT Incident
4 Encompass Family and internal medicine group Healthcare Provider 26,000 Unauthorized Access/Disclosure
5 The Southeastern Council on Alcoholism and Drug Dependence Healthcare Provider 25,148 Hacking/IT Incident
6 Cancer Treatment Centers of America® (CTCA) at Southeastern Regional Medical Center Healthcare Provider 16,819 Hacking/IT Incident
7 Takai, Hoover, and Hsu, P.A. Healthcare Provider 16,542 Unauthorized Access/Disclosure
8 Hematology Oncology Associates, PC Healthcare Provider 16,073 Hacking/IT Incident
9 Acadia Montana Treatment Center Healthcare Provider 14,794 Hacking/IT Incident
10 American Baptist Homes of the Midwest Healthcare Provider 10,993 Hacking/IT Incident

Causes of May 2019 Healthcare Data Breaches

Hacking/IT incidents were the most numerous in May with 22 reported incidents. In total, 225,671 records were compromised in those breaches. The average breach size was 10,258 records with a median of 4,375 records.

There were 18 unauthorized access/disclosure incidents in May, which resulted in the exposure of 1,752,188 healthcare records. The average breach size was 97,344 records and the median size was 2,418 records.

8,624 records were stolen in three theft incidents. The average breach size 2,875 records and the median size was 3,578 records. There was one loss incident involving 1,893 records.

causes of May 2019 healthcare data breaches

Location of Breached PHI

Email continues to be the most common location of breached PHI. 50% of the month’s breaches involved at least some PHI stored in email accounts. The main cause of these types of breaches is phishing attacks.

Network servers were the second most common location of PHI. They were involved in 11 breaches, which included hacks, malware infections and ransomware attacks.  Electronic medical records were involved in 7 breaches, most of which were unauthorized access/disclosure breaches.

Location of breached PHi (may 2019)

May 2019 Healthcare Data Breaches by Covered Entity Type

Healthcare providers were the worst affected covered entity type in May with 34 breaches. 5 breaches were reported by health plans and 4 breaches were reported by business associates of HIPAA-covered entities. A further two breaches had some business associate involvement. One breach involved a healthcare clearinghouse.

May 2019 healthcare data breaches by covered entity type

May 2019 Healthcare Data Breaches by State

May saw healthcare data breaches reported by entities in 17 states.  Texas was the worst affected state in May with 7 reported breaches. There were 4 breaches reported by covered entities and business associates in California and 3 breaches were reported in each of Indiana and New York.

2 breaches were reported by entities base in Connecticut, Florida, Georgia, Maryland, Minnesota, North Carolina, Ohio, Oregon, Washington, and Puerto Rico. One breach was reported in each of Colorado, Illinois, Kentucky, Michigan, Missouri, Montana, and Pennsylvania.

HIPAA Enforcement Actions in May 2019

OCR agreed two settlements with HIPAA covered entities in May and closed the month with fines totaling $3,100,000.

Touchstone Medical Imaging agreed to settle its HIPAA violation case for $3,000,000. The Franklin, TN-based diagnostic medical imaging services company was investigated after it was discovered that an FTP server was accessible over the internet in 2014.

The settlement resolves 8 alleged HIPAA violations including the lack of a BAA, insufficient access rights, a risk analysis failure, the failure to respond to a security incident, a breach notification failure, a media notification failure, and the impermissible disclosure of the PHI of 307,839 individuals.

Medical Informatics Engineering settled its case with OCR and agreed to pay a financial penalty of $100,000 to resolve alleged HIPAA violations uncovered during the investigation of its 2015 breach of 3.5 million patient records. Hackers had gained access to MIE servers for 19 days in May 2015.

OCR determined there had been a failure to conduct a comprehensive risk analysis and, as a result of that failure, there was an impermissible disclosure of 3.5 million individuals’ PHI.

It did not end there for MIE. MIE also settled a multi-state lawsuit filed by 16 state attorneys general. A multi-state investigation uncovered several HIPAA violations. MIE agreed to pay a penalty of $900,000 to resolve the case.

The post May 2019 Healthcare Data Breach Report appeared first on HIPAA Journal.

High and Critical Severity Vulnerabilities Identified in Certain BD Alaris Gateway Workstations

Posted by HIPAA Journal

Two vulnerabilities have been identified in certain Becton Dickinson (BD) infusion pumps. One of the vulnerabilities is rated critical and has been given the maximum CVSS v3 score of 10 out of 10.

BD has a history of proactively searching for vulnerabilities, addressing cybersecurity issues, and communicating details of the vulnerabilities in a timely fashion. BD voluntarily disclosed the two vulnerabilities in recent security bulletins and shared details of the flaws with information Sharing and Analysis Organizations (ISAOs). In this instance, the vulnerabilities were discovered by Elad Luz of CyberMDX and reported to BD. The Department of Homeland Security’s Industrial Control System Computer Emergency Response Team (ICS-CERT) has also issued a security advisory about the flaws.

Both flaws affect BD Alaris™ Gateway Workstations, but not any gateway workstations that are sold or used in the United States. The affected devices are used in around 50 countries, mostly in Europe in Germany, Spain, the Netherlands, and the United Kingdom. The vulnerability affects fewer than 3,000 devices in each country, and have fewer than 1,000 affected devices. The flaws affect older firmware versions. The latest versions of the firmware – 1.3.2 and 1.6.1 – are not affected.

No reports have been received to suggest the vulnerabilities have been exploited in the wild, but due to the seriousness of the flaws, affected users are advised to upgrade to the latest version of the firmware and take the recommended steps to mitigate the vulnerabilities.

Information Exposure Vulnerability – High Severity

An improper access control vulnerability has been identified that could be exploited on a vulnerable Gateway Workstation that is used in its standalone configuration. If an attacker discovered the IP address of the workstation terminal it would be possible to gain access to the web user interface and gain read-only access to information such as monitoring, configuration, event logs and the user guide. The vulnerability is being tracked as CVE-2019-10962 and has been assigned a CVSS v3 base score of 7.3 out of 10 – high severity.

Vulnerable versions are:

  • 0.13
  • 1.3 Build 10
  • 1.3 MR Build 11
  • 1.5
  • 1.6

 

Unrestricted Upload of Unauthorized Firmware – Critical Severity

A critical vulnerability has been identified that could be exploited by an attacker to upload unauthorized firmware to a compromised device. If successfully exploited an attacker could gain control of the device and its functions, including the infusion rate, dosage, and could even stop infusions entirely. It would also be possible to silence devices to prevent any alerts from being generated.

According to ICS-CERT, “Exploitation of these vulnerabilities could allow unauthorized arbitrary code execution, which could allow an attacker to view and edit device status and configuration details as well as cause devices to become unavailable.”

The flaw is tracked as CVE-2019-10959 and has been assigned a CVSS v3 base score of 10 out of 10 – Critical severity.

Exploitation of the flaw would require access to first be gained to the hospital network. A vulnerable device would need to be located, and the attacker would need to have intimate knowledge of the product. An attacker would also need to be able to update and manipulate a CAB file.

A custom file would need to be developed that could run in a CE environment, an attacker would need to correctly use the internal communications protocols and create a specific installer for the manipulated CAB file and set it to run the program. The complicated nature of the attack and knowledge and skill required make this a difficult vulnerability to exploit.

The Dangerous file upload vulnerability affects the following firmware versions

  • 1.3 Build 10
  • 1.3 MR Build 11
  • 3.0 Build 14
  • 3.1 Build 13

And the following products if running software version 2.3.6

  • Alaris GS
  • Alaris GH
  • Alaris CC
  • Alaris TIVA

The information disclosure can be fully mitigated by updating to the latest firmware version. BD recommends also restricting access to devices and isolating their network from untrusted systems.

The dangerous file upload vulnerability can be addressed by updating to the latest firmware version. If this is not possible, BD will be issuing a patch within 60 days.

BD also recommends blocking SMB protocol, segregating the VLAN network, the use of access controls and restricting the number of associates who have access to the customer network.

The post High and Critical Severity Vulnerabilities Identified in Certain BD Alaris Gateway Workstations appeared first on HIPAA Journal.