The sorry state of healthcare cybersecurity has been highlighted by a recent Forescout study. The study revealed the healthcare industry is overly reliant on legacy software, vulnerable protocols are extensively used, and medical devices are not properly secured.

75 global healthcare deployments were analyzed for the study, which comprised more than 1.5 million devices operating on 10,000 virtual local area networks (VLANs).

The majority of those devices were running on legacy systems. While just 1% of devices used unsupported operating systems such as Windows XP, 71% had operating systems that are rapidly approaching end-of-life such as Windows 7, Windows 2008, and Windows Mobile. In January 2020, all three of those operating systems will be at end-of-life and will no longer be supported by Microsoft.

The analysis revealed 85% of Windows devices had SMB running. It was a flaw in SMB that was behind the WannaCry ransomware attacks of 2017. Remote Desktop Protocol (RDP) is commonly used. 35% of devices did not have RDP disabled. The use of File Transfer Protocol (FTP) was also highly prevalent.

There has been a rapid deployment of a diverse range of connected medical devices such as infusion pumps, patient monitors, tracking and identification tools, and imaging systems. The number and variety of devices that connecting to healthcare networks has greatly increased the attack surface. Those devices have introduced considerable security risks which, in many cases, have not been effectively mitigated.

The sheer number of devices and different operating systems is causing major headaches for IT security teams. The study revealed 40% of deployments used more than 20 different operating systems. 41% of VLAN platforms used a variety of mobile, network, and embedded infrastructure and 34% of healthcare deployments had more than 100 vendors connecting to the network. Many vendors are responsible for patching their systems and healthcare IT teams are unaware if those patches have been correctly applied.

While it is important to ensure that all devices are secured, first IT teams must identify all devices that connect to the network, which is a major challenge especially following mergers and acquisitions. There have been many cases of devices being used without the knowledge or oversight of the IT department.

The complexity of healthcare networks makes security difficult to manage and the variety of devices and operating systems makes patching a gargantuan task. It is often not possible to keep on top of patching and software updates. In some cases, medical devices cannot be patched to correct known vulnerabilities and legacy apps may not work on newer operating systems. It is not uncommon for vendor approval to be required before patches can be applied. Acute care providers cannot easily take critical care systems offline without jeopardizing patient care, which means vulnerabilities often cannot be addressed.

One of the solutions to improve security and decrease the attack surface is to segment networks and ensure vulnerable devices and systems are kept separate from other parts of the network and are not Internet-facing. Restrictions also need to be implemented to ensure that devices and systems can only be accessed by individuals who need access for their day to day work duties.

However, this best practice is not particularly evident in the data analyzed for the study. Only a small number of VLANs were being used for medical devices, which suggests many healthcare providers are not using network segmentation to a large extent.

Forescout researchers do concede that applying network segmentation best practices across the organization and managing and enforcing segmentation can be a challenge, but it is necessary to improve security. Forescount also recommends enabling agentless discovery of all devices, identifying and auto-classifying devices, and ensuring all devices are continuously monitored.

“It’s critical for healthcare organization security and risk management leaders to look at securing all devices across the extended enterprise. Solely focusing on securing medical devices rather than securing all device classes can cause significant gaps in your security posture,” wrote the researchers. “A holistic approach to security requires continuous visibility and control over the entire connected-device ecosystem—including understanding the role a device visibility and control platform can play in orchestrating actions among heterogeneous security and IT management tools.”

The post New Report Uncovers Serious Holes in Healthcare Cybersecurity appeared first on HIPAA Journal.

On Tuesday May 14, 2019, Microsoft released a patch to fix a ‘wormable’ flaw in Windows, similar to the vulnerability that was exploited in the WannaCry ransomware attacks in May 2017.

The flaw is a remote code execution vulnerability in Remote Desktop Services – formerly Terminal Services – that can be exploited via RDP.

The flaw (CVE-2019-0708) can be exploited by sending specially crafted requests via RDP protocol to a vulnerable system. No authentication is required and the flaw can be exploited without any user interaction.

If exploited, malware could propagate from one compromised computer to all other vulnerable computers on a network. If ransomware exploited the vulnerability, healthcare organizations could experience widespread file encryption and major disruption to operations.

Microsoft has not received any reports to suggest the flaw is being actively exploited at present, but it is almost certain that exploits will be developed for the vulnerability and that those exploits will be incorporated into malware.

The vulnerability is not present in Windows 8 and Windows 10, only older Windows versions. However, it is of concern for the healthcare industry as many healthcare organizations are still using older, vulnerable operating systems.

Patches have been released for Windows 7, Windows Server 2008, and Windows Server 2008 R2. The flaw is so serious that Microsoft has taken the unusual step of issuing patches for Windows XP and Windows Server 2003, even though both operating systems are no longer supported.

A workaround is available for all organizations that use the above operating systems but are not able to apply the patch. In such cases, TCP port 3389 should be blocked and Network Level Authentication should be enabled to prevent the flaw from being exploited. Given the speed at which vulnerabilities are exploited once a patch has been released, it is imperative that the patch or workaround is implemented as a priority.

It was slow patching that allowed the 2017 WannaCry attacks to succeed. Those attacks clearly demonstrated that many organizations are slow to apply patches, even those that address critical and actively exploited vulnerabilities.

The WannaCry attacks occurred in May 2017 yet the patch to address the flaw – MS17-010 – was released by Microsoft in March. Had the patch been applied promptly, the attacks would not have been possible.

The UK’s National Health Service (NHS) was badly affected by WannaCry. Around one third of all NHS Trusts and 8% of GP practices were affected. The attacks cost the NHS an estimated £92 million and resulted in the cancellation of 19,000 appointments. The global cost of WannaCry has been estimated to be $4 billion.

Attacks exploiting CVE-2019-0708 have potential to be much worse than WannaCry. It is unlikely that a malware variant will be developed to exploit the vulnerability that contains such an easily activated kill switch as WannaCry.

In addition to the wormable vulnerability, Microsoft has issued updates to correct a further 21 critical flaws, including one that is being actively exploited and another that was disclosed publicly prior to a patch being released. Patches have also been released to address a new type of vulnerability in Intel processors. The Microarchitectural Data Sampling (MDS) flaws could allow a threat actor to deploy malware that can obtain sensitive data from applications, virtual machines, operating systems and trusted execution environments.

The post Microsoft Patches Critical Flaw That Could be Exploited in WannaCry-Style Malware Attacks appeared first on HIPAA Journal.

Malwarebytes has released a new report detailing the current tactics and techniques being used by cybercriminals to gain access to business networks and sensitive data.

Malwarebytes’ Cybercrime Tactics and Techniques Q1 2019 was compiled using data collected by its intelligence, and data science teams and telemetry from its consumer and business products between January 1 and March 31, 2019.

The report reveals there has been a 235% increase in cyberattacks on corporate targets in the past 12 months. There has also been a marked decline in cryptomining and other threats on consumers, which fell by 40% in 2018. It is clear from the report that cybercriminals are concentrating their efforts on attacking businesses and SMBs are most at risk as they typically lack the resources to significantly improve their cybersecurity defenses.

The report shows that Trojans are currently the biggest malware threat. Attacks involving Trojans are up 650% from the same time last year and attacks increased by 200% in Q1, 2019. The biggest threat is Emotet, which Malwarebytes describes as the “most fearsome and dangerous threat to businesses today.”

Emotet is now almost exclusively used to attack businesses. Emotet is an information stealer most commonly spread via phishing emails and the EternalBlue exploit. It has self-propagation functionality and can send copies of itself via email to contacts. It can also download other malware variants such as Ryuk ransomware.

While ransomware attacks on businesses declined in 2018, they are now on the rise and increased by 195% in the first quarter of 2019. Compared to this time last year, ransomware detections at businesses are up by more than 500%. Malwarebytes notes that the large increase in detections in 2019 is, to a large extent, due to a massive Troldesh ransomware campaign targeting U.S businesses in Q1. There were 336,634 detections of ransomware at businesses in Q1, 2019. As is the case with Trojans, ransomware attacks on consumers have also declined and are down 33% on this time last year.

Even though ransomware attacks were down in 2018, the FBI’s Internet Crime Complaint Center (IC3) indicates losses are up. $3.6 million in losses were reported to IC3 in 2018, although it should be noted that not all businesses declare ransomware attacks or the losses sustained, so the true figure is likely to be considerably higher. Further, those losses concern ransom payments, not other losses associated with the attacks.

Crytocurrency mining malware is still a major threat for businesses, although attacks on consumers are essentially negligible since CoinHive shut down its operations in March.

The use of adware has increased, in particular on mobile and Mac devices. Mac malware detections were up 60% in Q1, 2019 while adware detections were up 200% on Q4, 2018.

Cybersecurity protections have improved in the healthcare industry, although there is still considerable room for improvement. “The healthcare industry is no longer circling the drain, but it’s still in critical condition,” explained Malwarebytes.

As with other industry sectors, Trojans are the biggest malware threat and account for 79% of malware detections at healthcare organizations. Riskware is the second biggest threat. While riskware is not inherently malicious, it is capable of altering the functionality of other programs and can prevent patches from being installed which leaves healthcare organizations vulnerable to attack.  Ransomware, spyware, and worms each account for 3% of malware detections at healthcare organizations.

Emotet accounted for 37% of all healthcare industry Trojan detections. 34% were Trojans that posed as legitimate Microsoft files.

Cryptocurrency mining malware is also commonly used in attacks on healthcare organizations. Malwarebytes notes that 17% of healthcare systems showed signs of having this type of malware installed.

Ransomware attacks continue to plague the healthcare industry. While many variants are used, what is worrying is that WannaCry (WannaCrypt)  is still in use and is affecting a wide range of industry sectors, including healthcare. This threat can be blocked with the MS17-010 patch that was released in March 2017, yet many healthcare organizations are still vulnerable as the patch has not been applied.

The most common spyware infections were secondary infections that occurred following infection with either Trickbot or Emotet. The spyware serves as information stealers that run in the background and capture keystrokes and send them back to the attackers’ C2 servers.

Worm.Parite is the only worm threat affecting the healthcare sector, which is most commonly distributed via emailed .exe. and .scr files. Worms can spread rapidly across a network and leaves systems vulnerable to further exploitation and malware attacks.

The post Ransomware Attacks Increased by 195% in Q1, 2019 but Trojans Remain the Biggest Threat appeared first on HIPAA Journal.