Two medium-severity vulnerabilities have been identified in Innokas Yhtymä Oy vital signs monitors which allow communications between downstream devices to be modified and certain features of the monitors to be disabled. The vulnerabilities affect All versions of VC150 patient monitors prior to software version 1.7.15.

Vulnerable patient monitors have a stored cross-site scripting (XSS) vulnerability which allows a web script or HTML to be injected via the filename parameter to update multiple endpoints of the administrative web interface. The vulnerability is due to improper neutralization of input during web page generation. The vulnerability is tracked as CVE-2020-27262 and has been assigned a severity score of 4.6 out of 10.

The second vulnerability, tracked as CVE-2020-27260, is due to improper neutralization of special elements in the output used by downstream components. HL7 v2.x injection vulnerabilities allow physically proximate attackers with a connected barcode reader to inject HL7 v2.x segments into HL7 v2.x messages via multiple expected parameters. The vulnerability has been assigned a severity rating of 5.3 out of 10.

The vulnerabilities were identified by Julian Suleder, Nils Emmerich, and Birk Kauer of ERNW Research GmbH; and Dr. Oliver Matula of ERNW Enno Rey Netzwerke GmbH.

Innokas Yhtymä Oy has released a software update to correct the flaws and recommends only using software version 1.7.15b or later. There have been no cases reported of the vulnerabilities being exploited in the wild.

It is also recommended to adhere to network best practices including segmenting networks, using VLANs, and isolating patient monitors. Physical protections should be implemented to prevent unauthorized access to patient monitors and clinical staff should be instructed to report any cases of unauthorized individuals attempting to login or tamper with the monitors.

The post Vulnerabilities Identified in Innokas Yhtymä Oy Vital Signs Monitors appeared first on HIPAA Journal.

A joint statement has been issued by the Federal Bureau of Investigation (FBI), the DHS’ Cybersecurity and Infrastructure Security Agency (CISA), the Office of the Director of National Intelligence (ODNI), and the National Security Agency (NSA) on behalf of the Trump Administration attributing the supply chain attack on SolarWinds Orion software to Russian threat actors.

Following the attack, the National Security Council created a task force known as the Cyber Unified Coordination Group (UCG) to investigate the breach, which consisted of the FBI, CISA, and ODNI, with support provided by the NSA. The task force is still investigating the scope of the data security incident but has announced that the attack was conducted by an Advanced Persistent Threat (APT) actor and was “likely Russian in origin.”

Evidence has been mounting that the SolarWinds software was compromised as part of an intelligence gathering operation run by Russia. While several media outlets have previously reported the security breach as being a Russia-led operation, and Secretary of State Mike Pompeo and former Attorney General Bill Barr both suggested Russia was behind the campaign, this is the first official public attribution issued by the Trump administration. President Trump had previously stated China may have been involved and has yet to comment on the attribution to Russia. Russia has denied any involvement in the attack.

The hackers compromised the software update feature of SolarWinds Orion software an incorporated a backdoor dubbed Sunburst/Solarigate which remote access the systems of organizations that downloaded the compromised software update.  The investigation confirmed the operation has been active for nine months, during which time the systems of thousands of organizations were compromised. The hackers then picked targets of interest for further compromise. The second stage of the attack saw further malware delivered and the hackers attempt to gain access to victims’ cloud environments. Microsoft said gaining access to the cloud environments of victims was the primary goal of the attack.

The UCG believes the systems of around 18,000 public and private sector companies were breached via the SolarWinds Orion software update; however, a much smaller number experienced follow-on activity on their systems. Amazon and Microsoft have launched investigations in the security breach and have been examining their cloud environments for signs of compromise. Based on their evidence, it appears that the cloud environments of around 250 of the 18,000 victims were compromised. That figure may well rise as the investigation into the attack continues.

A further malware variant called Supernova – a web shell – has also been detected on the networks of some victims. This malware variant was delivered by exploiting a zero-day vulnerability in the SolarWinds Orion software and does not appear to have been delivered by the same threat actors.

Fewer than 10 U.S. government agencies had their systems breached. The Department of Justice is the most recent government agency to announce it was affected. While the hackers had access to its systems, the DOJ said the breach was limited to its Microsoft Office 365 email environment and only around 3% of its mailboxes were accessed. The DOJ said none of its classified systems appear to have been breached.

The post Federal Task Force Says SolarWinds Supply Chain Attack Likely Russian in Origin appeared first on HIPAA Journal.

A vulnerability has been identified in Zyxel devices such as VPN gateways, firewalls, and access point (AP) controllers that could be exploited by threat actors to gain remote administrative access to the devices. By exploiting the vulnerability, threat actors would be able to make changes to firewall settings, allow/deny certain traffic, intercept traffic, create new VPN accounts, make internal services publicly accessible, and gain access to internal networks behind Zyxel devices. Around 100,000 Zyxel devices worldwide have the vulnerability.

Zyxel manufacturers networking equipment and its devices are popular with small to medium sized businesses and are also used by large enterprises and government agencies.

The vulnerability, tracked as CVE-2020-29583, was identified by Niels Teusink of the Dutch cybersecurity firm EYE, who discovered a hidden user account in the latest version of Zyxel firmware (4.60 patch 0).  The user account, zyfwp, which was not visible in the user interface of the products, was discovered to have a hardcoded plain-text password which Teusink found in one of the product binaries. The hardcoded administrative password was introduced in the latest version of the firmware.

Teusink was able to use the credentials to login to vulnerable devices over SSH and the web interface. Since the password is hardcoded, users of the devices are unable to change the password. An attacker could use the credentials to login remotely and compromise a vulnerable Zyxel device.

“As SSL VPN on these devices operates on the same port as the web interface, a lot of users have exposed port 443 of these devices to the internet,” said Teusink.

The vulnerability was reported to Zyxel and a patch has been released to correct the flaw. Zyxel explained that the account had been included to allow the company to deliver automatic firewall updates to connected access points through FTP.

The flaw is present in several Zyxel products including the Zyxel Advanced Threat Protection (APT) firewall, Unified Security Gateway (USG), USG Flex, and VPN version 4.60 and Zyxel AP Controllers NXC2500 and NXC5500 version 6.10.

The Multi-State Information Sharing and Analysis Center (MS-ISAC) issued an alert about the vulnerability which was rated high risk for large and medium government entities and large and medium business entities, and medium risk for small government entities and small business entities.

All users of the vulnerable products have been advised to apply the patch as soon as possible to prevent exploitation. While there have not been any reported cases of exploitation of the vulnerability in the wild, exploitation of the flaw is likely.

MS-ISAC has made the following recommendations to mitigate the threat.

• Apply appropriate updates provided by Zyxel to vulnerable systems, immediately after appropriate testing.
• Run all software as a non-privilege user (one without administrative privileges) to diminish the effects of a successful attack.
• Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources.
• Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources.
• Apply the Principle of Least Privilege to all systems and services.

The post Hidden Backdoor Identified in 100,000 Zyxel Devices appeared first on HIPAA Journal.

The Federal Bureau of Investigation (FBI) has issued a private industry notification warning of an increase in DoppelPaymer ransomware activity and a change in tactics by the threat actors to pressure victims into paying.

DoppelPaymer ransomware first emerged in the summer of 2019 and has since been used in attacks on a range of verticals including healthcare, education, and the emergency services. The ransomware is believed to be operated by the Evil Corp (TA505) threat group, which was behind Locky ransomware and the Dridex banking Trojan.

Like many human-operated ransomware operations, the threat group exfiltrates data prior to the encryption of files and uses the stolen data as leverage to get the ransom paid. While victims may be able to recover encrypted files from backups, the threat of the public release or sale of stolen data is sufficient to get them to pay the ransom demand.

The threat group is known for demanding large ransom payments, often as high as seven figures. The gang is also believed to have been the first to start cold calling victims to pressure them into paying; a tactic that has now been adopted by several ransomware gangs including Ryuk, Conti, and Sekhmet.

The DoppelPaymer gang has been calling victims since at least February 2020 to issue threats if payment is not made, such as the public release of stolen data, sale of stolen data, and even threats of violence. In one case, a call was made using a spoofed U.S. number by an individual claiming to be in North Korea who threatened to send an individual to an employee’s home if the ransom was not paid. Subsequently, calls were made to several of the individual’s relatives.

The FBI explained in the alert that several attacks have been conducted in recent months that have caused significant disruption to critical services. Many healthcare providers have been attacked causing disruption to patient services. One attack on a hospital in Germany resulted in patients being redirected to alternative facilities, with one patient dying before treatment could be provided. Law enforcement officials later determined that the patient would likely have died due to poor health irrespective of the attack and the FBI notes that when the threat group was notified that lives were being put at risk, the extortion attempt was withdrawn, and the digital decryption keys were provided without charge.

Another attack on a large U.S. healthcare provider in July 2019 saw 13 servers impacted by the attack. While the ransom was not paid and files were recovered from backups, the recovery process took several weeks. In September 2020, the ransomware gang attacked a 911 dispatch center which prevented the county from accessing its computer-aided dispatch (CAD) system. In a separate attack on a different country, servers were encrypted that prevented access to systems used for emergency dispatch, patrol, jail, and the payroll departments. A U.S. city was attacked in the summer of 2020 causing major disruption to emergency services, the police department, and government functions.

Ransomware attacks on healthcare organizations have increased as the year has gone on, with Kroll reporting a 75% increase in attacks on healthcare providers in October 2020. Ransom payments are similarly increasing. Beazley has reported ransom demands in attacks on its clients doubled in the first 6 months of 2020, while Coveware reported the average ransom demand rose to $234,000 in the third quarter of 2020, up 31% from Q2.

The advice of the FBI is never to pay ransom demands unless there is no alternative, as payment does not guarantee the recovery of files or prevent data exposure. Payment of the ransom also encourages the attackers to conduct further attacks and incentivizes others to get involved in ransomware operations.

The post FBI Warns of DoppelPaymer Ransomware Attacks Targeting Critical Infrastructure appeared first on HIPAA Journal.