Healthcare Cybersecurity

Scammers Target Healthcare Buyers Trying to Purchase PPE and Medical Equipment

Posted by HIPAA Journal

The Federal Bureau of Investigation (FBI) has issued a warning that cybercriminals are attempting to steal money from state agencies and healthcare industry buyers that are trying to purchase personal protective equipment (PPE) and medical supplies.

Healthcare industry buyers have been told to be on high alert following a rise in the number of scams related to the procurement of PPE and essential medical equipment such as ventilators, which are in short supply due to increased demand.

The FBI has received reports of several cases of advance fee scams, where government agencies and healthcare industry buyers have wired funds to brokers and sellers of PPE and medical equipment, only to discover the suppliers were fake.

There have also been several reported cases of business email compromise (BEC) scams related to PPE and medical equipment procurement. In these scams, brokers and vendors of goods and services are impersonated. The scammers use email addresses that are nearly identical to the legitimate broker or seller and request wire transfer payments for the goods and services. The scams are often only detected after the money has been transferred and withdrawn from the accounts.

The FBI cites one case where an individual was duped by a scammer into wire transferring funds to an entity that claimed to have an existing business relationship with the purchasing agency. When the potential scam was uncovered, the funds had already been transferred beyond the reach of U.S law enforcement and could not be recovered.

Prepayment for goods such as PPE and ventilators is commonplace, but it increases risk of being defrauded and, in many cases, prepayment for goods eliminates potential recourse.

Healthcare equipment buyers should be wary of the following signs of a potential scam:

  • Contact is initiated by a broker or seller of medical equipment or PPE, often through a channel that makes verification of the legitimacy of the seller or broker difficult. I.e. initial contact comes from a personal email address or the offer is received over the phone.
  • The origin of the equipment is not clearly explained, including how the broker or vendor has secured a supply given the current high level of demand.
  • It is not possible to verify with the manufacturer of the goods that the person offering them for sale is a legitimate vendor or distributor of the product, or it is not possible to verify a legitimate supply chain.
  • Any unexplained urgency for payment or last-minute changes to previously used payment methods.

Any contact made by a vendor or broker who claims to have a business relationship with an existing supplier should be verified through previously established communication channels to verify the legitimacy of the relationship.

If contact is made by a known or trusted vendor, carefully check the contact information and email address to make sure it is legitimate. Look out for transposed letters and misspellings in email addresses.

Where possible, arrange for an independent third party to verify that the items being offered for sale are physically present, and of the correct make, model, and type and take delivery immediately when payment is made. If not possible, ensure payment is made through a domestic escrow account which will only release funds when the goods are received and verified to be correct.

The post Scammers Target Healthcare Buyers Trying to Purchase PPE and Medical Equipment appeared first on HIPAA Journal.

Small- and Medium-Sized Healthcare Providers Most Likely to Be Attacked with Ransomware

Posted by HIPAA Journal

Ransomware gangs are concentrating their attacks on smaller healthcare providers and clinics, according to a new report from RiskIQ. Healthcare providers with fewer than 500 employees are key targets for the gangs, with these organizations accounting for 70% of all successful healthcare ransomware attacks since 2016.

RiskIQ’s analysis of 127 healthcare ransomware attacks revealed there has been a 35% increase in attacks between 2016 and 2019. Hospitals and healthcare centers accounted for 51% of ransomware attacks, 24% of attacks were on medical practices, with 17% on health and wellness centers.

The cybersecurity defenses at smaller healthcare organizations are likely to be far less effective than those at larger healthcare systems. RiskIQ reports that 85% of small- and medium-sized hospitals do not have a qualified IT security person on staff, so there is a higher chance of gaps in security being left unaddressed. Ransom payments are more likely to be paid to avoid the costly downtime that is often caused by an attack. It can often take several weeks for an organization to fully recover when the ransom is not paid.

A Perfect Storm of New Targets and Methods

The RiskIQ intelligence brief – Ransomware in the Health Sector 2020 – says there has been “a perfect storm of new targets and methods,” due to the digital revolution in healthcare, but recent events have left the healthcare industry even more exposed to attack. The 2019 Novel Coronavirus pandemic has forced healthcare providers to make major changes. “Almost overnight, workforces and business operations decentralized and were flung around the world, widening the protection gaps and decreasing visibility into their attack surfaces,” explained RiskIQ.

Some ransomware groups have claimed they will not attack healthcare organizations during the COVID-19 public health emergency, but there are some groups that are making no such allowances. Attacks have become easier and they are taking advantage. “Cybercriminals are capitalizing on coronavirus concerns, which has led to a spike in malicious online activity that we assess will increasingly impact healthcare facilities and COVID-19 responders.”

Paying the Ransom Does Not Guarantee Recovery

16% of healthcare victims have reported they paid the ransom to obtain the keys to unlock their files. The report suggests the average ransom payment in those attacks was $59,000. While paying the ransom is an option, it is discouraged by the FBI as it just encourages further attacks and there is no guarantee that files can be recovered. The RiskIQ report cites a Wall Street Journal article that suggests fewer than 50% of the decryption keys are effective, so some data loss is inevitable even if the ransom is paid. There have also been cases where ransom payments have been made only for the attackers to then demand a further payment to provide the keys to unlock encryption. Paying a ransom also sends a message to other attackers that payment is likely if they are attacked, so the organization may be targeted again by the same or different threat actors.

Ransomware gangs are using a variety of methods to gain access to healthcare networks to deploy ransomware. Spam email is commonly used to trick healthcare employees into clicking malicious links that trigger a ransomware download or opening malicious email attachments containing ransomware downloaders. Vulnerabilities in software are commonly exploited, with many attacks taking advantage of vulnerabilities in Remote Desktop Protocol. The high number of workers now accessing healthcare networks remotely using Virtual Private Networks (VPNs) has seen VPN vulnerabilities targeted by ransomware gangs. Several vulnerabilities have been identified in VPN infrastructure over the past year, and while patches have been released to correct flaws, they are often not applied.

Steps to Take to Reduce Risk and Prevent Ransomware Attacks

The advice to all organizations has long been to ensure backups are regularly made to allow files to be recovered in the event of an attack, but having backups is no guarantee that they can be used to restore data. Several threat groups have been conducting manual ransomware attacks and spend long periods of time with network access before deploying ransomware. In addition to moving laterally and gaining access to large parts of the network, they have also been able to insert their ransomware into backup systems to ensure that backups are also encrypted.

RiskIQ advises healthcare organizations to ensure backups are created often and stored offline, or at least on different networks. Encryption of stored data is also important. There has been an increase in data theft prior to ransomware deployment. If data is encrypted, even if it is stolen it will ensure that the attackers cannot access the data.

RiskIQ emphasizes the importance for having an incident response plan, as this will help ensure attacks can be mitigated quickly to minimize the damage caused. Prompt patching is also essential. The importance of patching cannot be overstated, warns RiskIQ.

It is especially important during the COVID-19 crisis to ensure all digital assets that connect to the organization from outside the protection of the firewall are tracked and protected, as attackers are actively searching for these devices. they often provide an easy entry point to healthcare networks.

It is also important to prepare the workforce and provide training to help employees identify threats such as phishing attacks. Phishing simulation exercises can help to reduce susceptibility to ransomware attacks. IT teams should also keep up to date on the latest attack trends, as they are constantly changing.

The post Small- and Medium-Sized Healthcare Providers Most Likely to Be Attacked with Ransomware appeared first on HIPAA Journal.

Microsoft Patches Three Actively Exploited Flaws and Delays End of Support for Software and Services

Posted by HIPAA Journal

On April 2020 Patch Tuesday, Microsoft released updates to correct 113 vulnerabilities in its operating systems and software solutions, 19 of which have been rated critical. This month’s round of updates includes fixes for at least 3 zero-day vulnerabilities that are being actively exploited in real world attacks.

Two of the actively exploited vulnerabilities were announced by Microsoft in March and Microsoft suggested workarounds to limit the potential for exploitation. The flaws – CVE-2020-0938 and CVE-2020-1020 – both affect the Adobe Font Manager Library and can lead to remote code execution on all supported Windows versions. The flaws are partially mitigated in Windows 10 and could only result in code execution in an AppContainer sandbox with limited privileges and capabilities. The flaws could be exploited if a user is convinced to open a specially crafted document or if it is viewed in the Windows Preview pane.

The third actively exploited zero-day is a Windows Kernel vulnerability that was discovered by Google’s Project Zero team. The flaw, tracked as CVE-2020-1027, could allow remote code execution with elevated privileges. The flaw has been exploited in attacks on Windows 10 devices, but older operating systems are also vulnerable.

A further flaw was initially reported as having been exploited but is now marked as “exploitation likely”. The flaw, tracked as CVE-2020-0968, affects Internet Explorer and concerns how the scripting engine handles objects in the memory.

A further vulnerability, CVE-2020-0935, which affects OneDrive for Windows, is rated important but it has been publicly disclosed. The flaw is due to improper handling of shortcut links. Exploitation of the flaw would allow an attacker to further compromise systems and execute additional payloads. Since OneDrive is installed on many devices and is being used extensively by remote workers for sharing and storing files, it would be an attractive vulnerability for hackers. It should therefore be prioritized along with the critical and actively exploited flaws.

Many of the vulnerabilities could be exploited by convincing an employee to visit a malicious website or open a specially crafted document sent via email, which could then result in the installation of malware, backdoors, information disclosure, and access to devices with full user rights.  With so many work-from-home employees during the COVID-19 pandemic, and with cybercriminals targeting those individuals, it is more important than ever for patches to be applied promptly.

End of Support Delayed by Microsoft for Windows 10, Windows Server, and Software and Services

Microsoft has also announced that it will be delaying end of support for certain operating systems, software, and services in 2020, to ease the pressure on IT departments at this difficult time.

Many IT workers have also been forced to work from home and the increased stress of managing IT and providing support to a largely at-home workforce has meant there has been little time to take the necessary steps to prepare for updates to software and operating systems.

“As a member of the global community, we want to contribute to reducing the stress our customers face right now. To that end, we have delayed the scheduled end of support and servicing dates for the following products to help people and organizations focus their attention on retaining business continuity,” explained Microsoft in a recent support article.

End of support dates have been extended for the following operating systems, software, and services.

  • Windows 10 1709/1809: April 14, 2020 >> October 13, 2020
  • Windows Server 1809: May 12, 2020 >> November 10, 2020
  • Configuration Manager version 1810: May 12, 2020 >> November 10, 2020
  • SharePoint Server 2010, SharePoint Foundation 2010, and Project Serer 2010: >> May 27, 2020 >> December 1, 2020
  • Dynamics 365 Cloud Services: October 13, 2020 >> April 13, 2021
  • Basic Authentication in Exchange Online: September 2020 >> December 2020

End of support dates for all other software and services scheduled for 2020 remain unchanged.

The post Microsoft Patches Three Actively Exploited Flaws and Delays End of Support for Software and Services appeared first on HIPAA Journal.

More than 82% of Public-Facing Exchange Servers Still Vulnerable to Actively Exploited Critical Flaw

Posted by HIPAA Journal

On February Patch Tuesday, 2020, Microsoft released a patch for a critical vulnerability affecting Microsoft Exchange Servers which could potently be exploited by threat actors to take full control of a vulnerable system. Despite Microsoft warning that the flaw would be attractive to hackers, patching has been slow.

An analysis conducted by cybersecurity firm Rapid7 revealed more than 82% of public-facing Exchange servers remained vulnerable and had not been patched. The firm’s scan identified 433,464 public-facing Exchange servers, and at least 357,629 were vulnerable to an attack exploiting the CVE-2020-0688 vulnerability.

Exchange administrators may not have prioritized the patch as the vulnerability is a post-authorization flaw; however, attacks could take place using any stolen email credentials or by using brute force tactics to guess weak passwords.

Several proof-of-concept exploits for the flaw have been published on GitHub, and there have been reports of nation state Advanced Persistent Threat groups attempting to exploit the flaw using brute force tactics to obtain credentials and credentials stolen in previous data breaches.

If the flaw is exploited, hackers would be able to gain access to Exchange Servers and compromise the entire Exchange environment. That would allow them to obtain all email communications, create new email accounts, falsify messages, and remotely execute code on compromised servers with SYSTEM privileges.

Microsoft previously said there are no mitigations or workarounds that can be implemented to prevent exploitation. The only way to prevent the flaw from being exploited is to ensure the patch is applied on all vulnerable servers.

Since attacks are known to have already been conducted, in addition to applying the patch, administrators should also investigate to determine whether attacks have already been conducted and have been successful.

Rapid7 recommends Exchange administrators should check Windows Event and IIS logs for signs of compromise. Any email accounts that have been compromised and used in attacks on Exchange servers will leave traces of the exploit code in log files.

“The exploit attempts show up in the Windows Application event log with source MSExchange Control Panel, level Error, and event ID 4. This log entry will include the compromised user account as well as a very long error message that includes the text Invalid viewstate. What you are seeing is portions of the encoded payload,” explained Rapid7. “You can also review your IIS logs for requests to a path under /ecp (usually /ecp/default.aspx), which contain the string __VIEWSTATE and __VIEWSTATEGENERATOR.”

In addition to discovering a worrying number of Exchange servers vulnerable to the CVE-2020-0688 vulnerability, the researchers also found an alarming number of Exchange servers were missing several updates for other critical flaws. The researchers identified 31,000 Exchange servers that had not received an update since 2012 and 800 Exchange servers that had never been updated.

Come October, Microsoft will be ending support for Exchange 2010. It is concerning that there are still 166,000 public-facing Exchange servers still running Exchange 2010 so close to the end of support date.

The post More than 82% of Public-Facing Exchange Servers Still Vulnerable to Actively Exploited Critical Flaw appeared first on HIPAA Journal.

INTERPOL Issues Warning Over Increase in Ransomware Attacks on Healthcare Organizations

Posted by HIPAA Journal

INTERPOL has issued an alert to hospitals over continuing ransomware attacks during the 2019 Novel Coronavirus pandemic. While some ransomware gangs have publicly stated they will be stopping attacks on healthcare providers that are on the front line dealing with COVID-19, many are still conducting attacks. Further, those attacks have increased.

Attempted Ransomware Attacks on Healthcare Organizations Increased over the Weekend

Last weekend, INTERPOL’s Cybercrime Threat Response (CTR) team detected a significant increase in attempted ransomware attacks on hospitals and other organizations and infrastructure involved in the response to the coronavirus pandemic and issued a ‘Purple Notice’ alerting police forces in all 194 member countries of the increased risk of attacks.

“As hospitals and medical organizations around the world are working non-stop to preserve the well-being of individuals stricken with the coronavirus, they have become targets for ruthless cybercriminals who are looking to make a profit at the expense of sick patients,” said INTERPOL Secretary General Jürgen Stock. INTERPOL also explained that ransomware attacks would cause a delay in providing essential care to COVID-19 patients and could also directly lead to deaths.

The medical research firm, Hammersmith Medicines Research in the United Kingdom, is one of the firms that was recently attacked. The company, which is poised to assist with the development of a vaccine for SARS-CoV-2, was attacked by the Maze ransomware gang, which published sensitive data stolen in the attack when the ransom was not paid. The Maze gang issued a press release explaining that all attacks on healthcare organization would be halted during the COVID-19 crisis and the data stolen in the attack was removed from the Maze website. However, other threat groups remain highly active and are still targeting healthcare organizations.

A recent attack was reported by the Pleasanton, CA-based biotechnology firm 10x Genomics. The Sodinokibi (REvil) ransomware gang claimed to have downloaded 1TB of data from the firm before deploying their ransomware payload. A sample of that data was published online in an attempt to pressure the firm into paying the ransom.

In a recent SEC filing, the company explained that it is working with law enforcement and has engaged a third-party firm to assist with the investigation. 10x Genomics reports that it was able to restore normal business operations quickly, without the attack impacting daily operations. “It is particularly disappointing that we would be attacked at a time when our products are being used widely by researchers around the world to understand and fight COVID-19,” said a 10x Genomics spokesperson.

Assistance Being Offered to Healthcare Organizations

INTERPOL’s CTR team is working with hospitals and other healthcare providers that have been targeted with ransomware to help them defend against attacks and recover when attacks succeed.

INTERPOL warns that ransomware is primarily being spread via malicious code in email attachments which triggers a ransomware download when opened. Hyperlinks are also commonly used to direct users to malicious websites where ransomware is downloaded.

INTERPOL advises healthcare organizations to take the following steps to protect their systems from attack and ensure a fast recovery is possible in the event of an attack succeeding:

Attacks are also taking place through the exploitation of vulnerabilities in RDP and VPN systems, so it is essential for all software to be kept up to date and for patches to be applied promptly. The Sodinokibi threat group has been exploiting vulnerabilities in VPNs in attacks on healthcare organizations. In a blog post last week, Microsoft stated it has been helping hospitals secure their systems by alerting them to unpatched vulnerabilities in their VPN devices. Microsoft has also suggested best practices for securing systems to prevent attacks.

The post INTERPOL Issues Warning Over Increase in Ransomware Attacks on Healthcare Organizations appeared first on HIPAA Journal.

FBI Warns of Increase in COVID-19 Related Business Email Compromise Scams

Posted by HIPAA Journal

The Federal Bureau of Investigation has issued a warning following a rise in Business Email Compromise (BEC) attacks that are taking advantage of uncertainty surrounding the COVID-19 pandemic.

BEC is the term given to an attempt to fool individuals responsible for performing legitimate transfers of funds into sending money to a bank account controlled by the attacker. This is achieved by impersonating an individual within a company that the victim usually conducts business with. A typical attack scenario will see an email sent to an individual in the finance department requesting a change to bank account information for an upcoming payment.

Several attacks have recently been reported to the FBI’s Internet Crime Complaint Center (IC3) that have a COVID-19 theme and municipalities are being targeted that are purchasing personal protective equipment (PPE) and other essential supplies to use in the fight against COVID-19.

In the alert, the FBI offered two recent examples of COVID-19 BEC scams. The first involved a scammer impersonating the CEO of a company and requesting that a scheduled $1 million payment be brought forward due to the Coronavirus outbreak and quarantine processes and precautions. In the emails to employees at an unnamed financial institution, the scammer provided different bank account details for the payment. The email address used by the scammer was identical to the email address of the CEO apart from a single letter.

The second example saw a scammer pose as a client in China who requested all invoices be paid to a different bank account as the current bank was undergoing Coronavirus audits. Several wire transfers were sent to the new account before the scam was detected, resulting in significant financial losses.

The COVID-19 pandemic has given BEC scammers a plausible reason for requesting urgent payments, bank account changes, and alterations to standard payment practices. Individuals responsible for payroll and bank transfers should be on high alert and should treat any COVID-19 related updates to bank account information or changes to standard payment processes as suspicious.

There are several red flags that individuals should look out for to avoid becoming a victim of a BEC scam. These include unexplained urgency in email requests, last minute changes to bank account information or wire transfer instructions, changes to established payment practices and communications channels, requests to only communicate via email or chat platforms, and requests for advance payments. Scammers also impersonate employees and request changes to direct deposit information.

In all cases, any request for a payment change should be verified by phone using contact information on file. Never use contact information provided in the email. Email addresses should be checked to make sure they are the same as previously used email accounts and domains and URLs should be carefully checked for any misspellings of domain names, transposed letters, and foreign characters.

If you believe you may have been a victim of a BEC scam you should contact your financial institution immediately to recall any transferred funds and your employer should report the incident to the FBI’s Internet Crime Complaint Center at https://bec.ic3.gov/

The post FBI Warns of Increase in COVID-19 Related Business Email Compromise Scams appeared first on HIPAA Journal.

2019 Novel Coronavirus and COVID-19 Themed Attacks Dominate Threat Landscape

Posted by HIPAA Journal

Cybercriminals are now almost exclusively conducting 2019 Novel Coronavirus and COVID-19 themed-campaigns according to a new report published by Proofpoint. 80% of all threats identified by the firm are coronavirus or COVID-19 related.

The recent analysis was performed on more than half a million email messages, 300,000 malicious URLs, and over 200,000 malicious email attachments. Proofpoint researchers identified more than 140 phishing and malware distribution campaigns and report that the number of active campaigns continues to rise. The coronavirus theme spans virtually every possible threat, with COVID-19 campaigns being conducted by small players to the most prolific APT groups. The email campaigns are diverse and frequently change and Proofpoint researchers believe the diverse nature of attacks will continue and attacks will likely increase.

A report from Check Point tells a similar story. In mid-February, Check Point was seeing a few hundred coronavirus-themed malware attacks a day, but by late March the average number of attacks had increased to 2,600 a day with 5,000 attacks taking place on March 28, 2020. These attacks involved emails with “Corona” or “COVID” in the email subject line, name of an email attachment, or linked to domain or URL containing those words.

In the past two weeks alone, Check Point Research reports there have been more than 30,000 domain names purchased related to the coronavirus or COVID-19. While only 0.4% of those domains have been confirmed as malicious, 9% were suspicious, and many more could be used by cybercriminals in the near future for phishing, malware distribution, or fraud. The researchers note that there have been more than 51,000 coronavirus-related domains registered since mid-January.

An analysis of online threats by Cloudflare revealed there has been a 6-fold increase in online threats over the past month, with hacking and phishing attacks up 37% month-over-month. Barracuda Networks reports there has been a 600% increase in phishing attacks since the end of February and notes a rise in impersonation scams and business email compromise scams.

The FBI has already issued warnings about coronavirus and COVID-19-themed phishing scams and a further alert was issued on April 1, 2020 warning of the threat of attacks on software and computer systems being used to support at-home workers. The increase in the number of at-home workers during the 2019 Novel Coronavirus pandemic has seen many turn to teleconferencing and telework solutions to maintain contact with employers, colleagues and customers.

Cybercriminals are searching for exploitable vulnerabilities in virtual private network (VPN), telework, and teleconferencing solutions and the FBI anticipates increased exploits of vulnerabilities over the coming weeks. These attacks are being conducted to steal sensitive data and spread malware and ransomware.

1,200 complaints about COVID-19-related scams have been received and reviewed by staff at the FBI’s Internet Crime Complaint Center (IC3) as of March 30, 2020, and attacks have been reported on first responders and medical facilities tackling the COVID-19 crisis. The FBI has warned that these attacks will continue, and it is likely these threat actors will also start targeting individuals working from home.

“Carefully consider the applications you or your organization uses for telework applications, including video conferencing software and voice over Internet Protocol (VOIP) conference call systems,” warned the FBI in its April 1 alert. “Malicious cyber actors are looking for ways to exploit telework software vulnerabilities in order to obtain sensitive information, eavesdrop on conference calls or virtual meetings, or conduct other malicious activities.

Echoing the findings of Barracuda Networks, the FBI has warned about BEC scams following several complaints from businesses that cybercriminals are conducting BEC attacks requesting payments be made early due to COVID-19. These scams see new account details provided for payments and changes to regular communication methods. Attempts are also being made to change direct deposit information for employees to divert payroll.

Many businesses have been forced into buying new portable devices to allow their employees to work from home, including purchasing devices from oversees or secondhand devices. The FBI warns that these devices carry a risk of having malware pre-installed, which could easily be transferred to business networks when employees connect remotely.

The post 2019 Novel Coronavirus and COVID-19 Themed Attacks Dominate Threat Landscape appeared first on HIPAA Journal.

OCR Investigators Impersonated to Obtain PHI

Posted by HIPAA Journal

While the majority of social engineering and phishing attacks take place via email, social engineering tactics are also used to convince people to part with sensitive information via other commination channels, including the telephone. Once such campaign is now being conducted over the telephone to convince healthcare employees to divulge protected health information (PHI).

Healthcare workers at several hospitals have reported instances of individuals impersonating HHS’ Office for Civil Rights investigators and requesting the PHI of patients. The attacks prompted OCR to issue a warning to healthcare providers over the weekend.

An individual is placing calls to healthcare providers and posing as an OCR investigator in an attempt to get healthcare workers to provide PHI. The caller provides no information that can be used to verify the legitimacy of the call and an OCR compliant transaction number is not provided.

OCR has recommended healthcare providers and their business associates raise awareness of the scam with the workforce and to provide information on the correct course of action to take if such a call is received.

Healthcare employees should take steps to verify the identity that any caller requesting PHI. If a call from someone claiming to be an OCR investigator, healthcare employees should ask for their email address and ask for the request to be confirmed in writing via email from the OCR investigator’s hhs.gov email account. All OCR staff have an email address ending in @hhv.gov.

If an email is received, checks should be performed to confirm that the message has been sent from an official @hhs.gov email account and that the email address has not been spoofed.

OCR has requested any questions or concerns be directed to OCR via email – OCRMail@hhs.gov – and for any suspected cases of impersonation of OCR staff to be reported to the Federal Bureau of Investigation.

The post OCR Investigators Impersonated to Obtain PHI appeared first on HIPAA Journal.

Zoom Security Problems Raise Concern About Suitability for Medical Use

Posted by HIPAA Journal

Teleconferencing platforms such as Zoom have proven popular with businesses and consumers for maintaining contact while working from home during the COVID-19 crisis, but a slew of Zoom security problems have been identified in the past few days that have raised concerns about the suitability of the platform for medical use.

Zoom Security Problems Uncovered by Researchers

Several Zoom security problems and privacy issues have been discovered in the past few days. The macOS installer was discovered to use malware-like methods to install the Zoom client without final confirmation being provided by users. This method could potentially be hijacked and could serve as a backdoor for malware delivery.

Two zero-day vulnerabilities were identified in the macOS client version of Zoom’s teleconferencing platform, which would allow a local user to escalate privileges and gain root privileges, even without an administrator password, and gain access to the webcam and microphone and intercept and record Zoom meetings.

A feature of the platform that is intended to make it easier for business users to find other individuals within the company was discovered to be leaking users’ email addresses, profile photos, and statuses. The Company Directory feature adds other people to a user’s contact list if their email address in on the same domain. Several consumers reported that strangers had been added to their contact lists when they signed up with a personal email address.

There have also been many reported cases of Zoom-bombing, which is where uninvited individuals join meetings using brute force tactics to guess meeting IDs. The FBI recently published a warning following a rise in hijacking attacks. There have been cases of people hacking Zoom meetings, abusing participants, and using the screen sharing feature to display pornography.

There have also been revelations that Zoom has been sharing background data on users with Facebook via the Facebook SDK, even when users do not have Facebook accounts.

Zoom Platform Does Not Offer End-to-End Encryption

A report published in The Intercept revealed the end-to-end encryption that Zoom claims to implement does not extend to video meetings. When The Intercept contacted Zoom for comment, a spokesperson for the company explained that “Currently, it is not possible to enable E2E encryption for Zoom video meetings.” Instead, “Zoom video meetings use a combination of TCP and UDP. TCP connections are made using TLS and UDP connections are encrypted with AES using a key negotiated over a TLS connection.”

The method of encrypting data is similar to that used to secure communications between a web browser and an HTTPS website. This “transport encryption” protects data in transit from one client to the other and means that communications between meeting participants is encrypted, but Zoom has access to unencrypted audio and video content.

Zoom explained to The Intercept that while unencrypted users’ data can be accessed, “Zoom has layered safeguards in place to protect our users’ privacy, which includes preventing anyone, including Zoom employees, from directly accessing any data that users share during meetings, including—but not limited to—the video, audio and chat content of those meetings. Importantly, Zoom does not mine user data or sell user data of any kind to anyone.”

Answers Sought About Recently Disclosed Zoom Security Problems

Sen. Richard Blumenthal (D-Conn) has written to Zoom CEO and founder Eric S. Yuan seeking answers about the company’s response to the massive increase in users, the growing list of Zoom security problems, and Zoom’s handling of personal user data.

In December 2019, there were around 10 million Zoom meeting participants every day. In March 2020, the number had expanded to an astonishing 200 million a day. The company has been working to continue to provide support for users to ensure there is an uninterrupted service, but the massive increase in consumers using a platform that was designed for business users has been a challenge.

“Zoom is increasingly being used by schools and healthcare providers that have shut down or limited their operations to stop the spread of Coronavirus, raising questions about how its services comply with federal and state privacy laws protecting students, patients, and consumers,” wrote Sen. Blumenthal in the letter.

Sen. Blumenthal also expressed concern about Zoom’s “troubling history of software design practices and security lapses,” referencing the slow response to the vulnerability in the Mac client, which was not fully addressed and took months before it was finally resolved, and then only due to the intervention of Apple.

Sen. Blumenthal seeks answers about the steps being taken to detect and stop Zoom-bombing, the level of encryption used to protect users’ privacy, and the data that is collected, used, and shared with third parties such as Facebook.

New York Attorney General Letitia James is also concerned about the recent Zoom security problems and the company’s response to the massive increase in users. In the letter, Attorney General James expressed concern that the existing security practices at Zoom may no longer be sufficient given the sudden surge in the number of users and the sensitivity of data that is now passing through the platform. She also wants to know whether a broader review of Zoom security practices has been undertaken considering the massive increase in popularity.

CEO Responds to Criticism of Zoom Security Problems

In an April 1, 2020 blog post, Zoom CEO Eric S. Yuan explained that the company is experiencing some growing pains as a result of the massive rise in popularity of the platform this year. In response to criticism of Zoom security problems, Yuan said, “we recognize that we have fallen short of the community’s – and our own – privacy and security expectations. For that, I am deeply sorry, and I want to share what we are doing about it.”

The massive rise in popularity of the platform was not anticipated, neither having a quarter of the world’s population in lockdown and working and socializing from home. “We now have a much broader set of users who are utilizing our product in a myriad of unexpected ways, presenting us with challenges we did not anticipate when the platform was conceived,” said Yuan.

It should be noted that all software solutions have vulnerabilities and some of the recently disclosed Zoom vulnerabilities have been made public without giving Zoom much time to respond and fix the issues. Zoom has responded quickly and addressed some of the issues that have come to light in recent days, although several privacy and security issues remain.

Zoom has publicly committed to fix privacy and security issues and proactively assess the platform for other vulnerabilities. Over the next 90 days, Zoom will cease all regular development work and will shift all engineering resources to focus on the biggest trust, safety, and privacy issues. The bug bounty program is being enhanced and penetration tests are being conducted to assess the security of the platform.

Use of Zoom for Healthcare Communications

Enterprise-class communication solutions require enterprise-grade privacy and security protections. This is especially important in healthcare to ensure HIPAA compliance. Zoom offers an enterprise package for healthcare organizations – Zoom for Healthcare – which has been developed to incorporate the necessary safeguards to comply with the HIPAA Privacy and Security Rules; however, the latest security vulnerabilities and privacy issues cast doubt on the level of protection provided.

During the COVID-19 public health emergency, the HHS’ Office for Civil Rights has stated it will be exercising enforcement discretion and will not impose sanctions or penalties for the good faith provision of telehealth services and that applications that may not satisfy all requirements of HIPAA Rules can be used. While there is nothing to suggest OCR would make an exception for Zoom – it is not a public-facing platform – healthcare providers should exercise caution.

There are other teleconferencing solutions available for use by healthcare organizations for the provision of telehealth services, many of which do offer true end-to-end encryption and do not have the security issues that have been uncovered in Zoom. Many of those solutions are also available free of charge, and even the HIPAA-compliant secure messaging platform provider, TigerConnect, has made its platform available to healthcare organizations free of charge following the declaration of the COVID-19 public health emergency.

Since more secure videoconferencing and communications platforms are available, it is strongly advisable to use an alternative solution for telehealth and other healthcare communication during the COVID-19 crisis, and certainly until Zoom addresses its privacy and security issues and completes its platform review.

The post Zoom Security Problems Raise Concern About Suitability for Medical Use appeared first on HIPAA Journal.