Archive for April, 2015

Patient information may have been accessed in health care data breach

Partners HealthCare System has begun notifying patients about a data breach that occurred last November that may have given some unauthorized access to emails containing personal information.

According to the company, some of its workers received phishing emails, and provided information in response to the emails believing that they were legitimate.

The company said responding to the phishing emails created an opportunity for unauthorized access to the workers’ email accounts.

A review by Partners HealthCare determined that some of the emails contained patient demographic information, such as names, addresses, dates of birth, telephone numbers, and, in some instances, Social Security numbers, and patients’ clinical information, such as diagnosis, treatment received, medical record numbers, medical diagnosis codes, or health insurance information.

The company said it has no evidence that any patient information in the emails has been misused, but started mailing letters to affected patients on April 30 and have established a call center to answer any questions that patients may have.

Patients are also encouraged to regularly review statements that they receive from their health insurers. Officials encourage people who notice any services listed that were not received to contact their insurance company.

The company said patients who believe they may have been affected but did not receive a letter by May 21 should call 1-877-237-9502, Monday through Friday, between 9:00 a.m. and 7:00 p.m. and provide this 10-digit reference number when calling: 3844042415.

Partners HealthCare System’s affiliated institutions and hospitals include Brigham and Women’s Hospital, Brigham and Women’s Faulkner Hospital, Massachusetts General Hospital, North Shore Medical Center, Partners Continuing Care, and Newton-Wellesley Hospital.

Article source:


No Comments

Campus announces data breach


UC Berkeley officials announced today (Thursday, April 30) that they are sending alert notices to current students and other individuals regarding a computer data breach that may have resulted in unauthorized access to their Social Security numbers or other personal information.

There is no evidence that such information has actually been used, but officials are notifying individuals in accordance with California law and so that they can be alert to signs of any possible misuse of their information.

The data breach involved unauthorized access to a campus Web server maintained by a unit within UC Berkeley’s Division of Equity and Inclusion. The server was used to store information including family financial information submitted by students. This included documents containing Social Security and bank account numbers.

Officials sent letters to all affected individuals on April 30. This included about 260 undergraduate students and some former students, as well as about 290 parents and other individuals, generally family members of the notified students. Current students also received emails, sent April 30. Paul Rivers, UC Berkeley’s interim chief security officer, emphasized that the campus regrets that this occurred and will be offering those individuals free credit monitoring for a year. They also will receive a resource list to aid them in checking for possible suspicious activity on their accounts.

When campus officials learned of the breach on March 14 they immediately removed the server from the network so that it could no longer be accessed. A digital forensics firm was brought in to investigate the matter and determine whether any personally identifiable information was compromised. Once the firm completed that work and confirmed the names of all impacted individuals, the letters were sent.

The investigation revealed that the unauthorized access first occurred in December 2014 and that an additional, separate, unauthorized access occurred in February 2015.

Article source:


No Comments

New Spam Campaign Pushing CTB-Locker Ransomware

A new run of spam messages this week has been spotted dropping CTB-Locker ransomware. CTB-Locker, also known as Critroni, is a fairly new piece of crypto ransomware that encrypts hard drives and demands a ransom paid in Bitcoin to the attackers in exchange for the decryption key.

Two days ago, researchers at the SANS Institute spotted messages sent from a botnet moving the Dalexis dropper which, once it infects a machine, downloads the ransomware.

Crypto-ransomware continues to grow as a worrisome scourge that is turning a profit for criminals. Despite warnings from security professionals against paying ransoms, infected organizations are taking the chance in order to get their files back before they’re irreparably damaged. The most recent publicly known payout was made by the Tewksbury, Mass., police department, which admitted two weeks ago that its systems were infected in December by the Keyholder ransomware and that it paid up after it was unsuccessful at cleaning the infection and recovering the files.

SANS Internet Storm Center handler Brad Duncan, an engineer at Rackspace, posted a list of two dozen sender addresses used in the campaign, most of which he speculates are spoofed. The subject line of each email is similar, warning that a particular account number has been temporarily locked (already yesterday, the subject lines had changed to an account being banned). The email message warns the user that unauthorized login attempts have been detected from several IP addresses, and is signed with a number of international contacts in the signature block. The malicious attachments are .zip files; a number of samples are available in the SANS post, along with their hashes.

Should the user open the infected attachment, a .scr file is extracted from the .zip file that is the Dalexis downloader. The downloader is a .CAB archive which then extracts a .RTF file and opens it on the desktop; soon thereafter, the downloader opens a backdoor connection and grabs the CTB-Locker ransomware and locks files stored on the computer.

Within minutes, a familiar banner warning is shown on the computer screen warning that personal files on the machine have been encrypted by CTB-Locker and that the victim has 96 hours to submit payment and receive the encryption key, otherwise the files will be unrecoverable.

Another screen provides the victim with payment instructions, including how to download the Tor browser and what link to follow in order to remit payment via Bitcoin—and how to buy Bitcoin to do so, if necessary.

Duncan said the malware makes numerous HTTP POST requests to different command and control servers; he said the one sample he recovered made 124 requests before getting a valid response from a server at gaglianico74[.]it. Duncan posted a number of IP addresses and domain names used as valid CC servers.

CTB-Locker uses elliptic curve crypto to encrypt files on a compromised computer, and is one of the first crypto-ransomware to communicate with command and control over Tor. Other versions of CTB-Locker have been moved via exploit kits, including Angler; most, however, are distributed through spam messages.

Article source:

No Comments

Unpatched Router Vulnerability Could Lead to Code Execution

Article source:

No Comments

Six Senate Dems back new data breach bill

The cascade of Senate data breach bills continues to rain down.

A cavalcade of privacy-minded Senate Democrats led by Patrick Leahy (Vt.) on Thursday will introduce the Consumer Privacy Protection Act.

Like at least three other Senate offerings, the bill would require companies to notify customers following a data breach and set minimum data security requirements.

Unlike some efforts, Leahy’s bill would not supersede stronger state data security requirements, a key sticking point for several Democrats who fear a weak federal standard might lessen consumer protections.

“Companies who benefit financially from our personal information should be obligated to take steps to keep it safe, and to notify us when those protections have failed,” Leahy said in a statement.

Legislators have been seeking a solution to the complex and occasionally overlapping state laws that guide companies’ data security standards and data breach notification guidelines.

Businesses are pushing hard for a federal law after a slate of mammoth data breaches at Target, Home Depot, JPMorgan and Anthem, among many others, exposed the unnecessary high costs and difficulties of complying with various state laws.

A series of Democratic senators is backing Leahy’s bill: Richard Blumenthal (Conn.), Al Franken (Minn.), Ed Markey (Mass.), Elizabeth Warren (Mass.) and Ron Wyden (Ore.).

Their measure will compete with at least three other Senate proposals that are indistinguishable in some regards.

Sen. Mark Warner (D-Va.) said he would release his own bill as early as this week.

Sens. Tom Carper (D-Del.) and Roy Blunt (R-Mo.) introduced the bipartisan bill of the group two weeks ago.

And Sen. Bill Nelson (D-Fla.) has been pushing another offering since January. The White House even issued its own legislative proposal on the topic, which was largely mirrored by Nelson’s bill.

Leahy’s bill is touted as the privacy and consumer advocates’ preferred measure. According to a release, organizations such as the Center for Democracy and Technology and the Consumers Union support the measure.

“All lawmakers who support consumers should support this bill,” Leahy said.

The Consumer Privacy Protection Act specifically delineates what type of information private firms would have to protect: Social Security numbers, financial account data, online login credentials, email addresses, biometric data, medical data, geolocation and photos and videos.

“Today, data security is not just about protecting our identities and our bank accounts; it is about protecting our privacy,” Leahy said. “Americans want to know not just that their bank account and credit cards are safe and secure, they want to know that their emails and their private pictures are protected as well.”

In addition to the notification and security requirements, Leahy’s bill would create civil penalties for companies failing to comply with these standards.

Civil penalties have been a tough sell for Republicans, who worry they would give too much power to zealous federal regulators.

Article source:


No Comments

Congress, Crypto and Craziness

Article source:

No Comments

MySQL Bug Can Strip SSL Protection From Connections

Researchers have identified a serious vulnerability in some versions of Oracle’s MySQL database product that allows an attacker to strip SSL/TLS connections of their security wrapping transparently.

The vulnerability is the result of the way that an option in MySQL handles requests for secure connections. Researchers at Duo Security discovered the bug after noticing some odd behavior in MySQL a few weeks ago. They realized that even when they set the correct option to initiate an SSL connection with the MySQL server, they could not make the client enforce a secure connection. In other words, if the server tells the client that it doesn’t support SSL–even if it does support the protocol–the client will send information over plaintext TCP.

This means that an attacker with a man-in-the-middle position could force an unencrypted connection and passively sniff all of the unencrypted queries from the client to the MySQL database. The flaw is very similar to the SSLstrip attack developed by Moxie Marlinspike several years ago. Oracle implemented a fix for the flaw more than a year ago, but it was only fixed in a branch of the product that isn’t generally available yet.

“Now, if you’re an avid MySQL user, you might be thinking ‘but wait – I can just use the REQUIRE SSL option on my server…’ Nope! That’s the beauty of ssl-stripping attacks: Mallory can initiate a bona-fide TLS session with the server, while continuing to speak plaintext with the client,” researcher Adam Goodman said in a blog post explaining the bug.

“Actually, the good news is that the MySQL team has already realized this was a problem, and implemented a fix. Like, over a year ago. The bad news? The fix was only applied to MySQL 5.7.3 and later; 5.7.x is not yet even a GA release! (Also, the fix was applied to version 6.1.3 of the standalone libmysqlclient distribution). The worse news? In many cases, the “fix” is not enabled by default! So, while we haven’t collected any real data on the subject, we’re pretty confident that the vast majority of libmysqlclient users are affected by this issue.”

The vulnerability is nicknamed BACKRONYM (Bad Authentication Causes Kritical Risk Over Networks Yikes MySQL) by the Duo researchers, who also put up a site that riffs on the recent trend of researchers putting up sites for major vulnerabilities.

“The most serious risk is posed by adversaries with passive monitoring capabilities like the NSA, intelligence agencies, or other capable attackers who may have a foothold on your network. Many MySQL clients will use a DNS hostname (eg. to connect to the database server, triggering a DNS query that may traverse monitored links on the Internet. A global passive adversary like the NSA can spoof a reply to this DNS request in order to hijack the MySQL connection, perform the downgrade, and steal/manipulate database contents,” the Duo researchers said in an FAQ on the site.

The vulnerability affects MySQL 5.7.2 and earlier versions, along with MySQL Connector versions 6.1.2 and earlier, all versions of Percona Server and all versions of MariaDB. The Duo researchers said that while the bug could be a problem, it may not be a huge risk.

“Now, for most MySQL users, this vulnerability probably isn’t panic-worthy: as mentioned earlier, Mallory has to be in a position to perform a Man-In-The-Middle attack between the database and its client(s). It’s pretty typical for a database server to be adjacent to (or even on the same box as) its client – e.g. a web application server – so MITM attacks might not be a serious concern. We also expect that many MySQL users don’t bother to enable SSL at all,” Goodman said. 

The oCERT open source security team has posted an advisory about the vulnerability, too.

Article source:

No Comments

Illinois data breach law expands definition of PII, passes state Senate

The Illinois Senate approved a bill to include “consumer marketing information” as personal information in the state’s existing data breach law, that proponents say would greatly increasing the liability burden on companies, according to Lexology

Illinois Bill SB1833 is expected to have substantial support in the state’s House of Representatives as well.

The bill, drafted by Illinois’s Attorney General, will require notification in the event of a breach of “information related to a consumer’s online browsing history, online search history, or purchasing history.” If passed, the legislation could cost companies millions of dollars to protect information that clearly is not sensitive and, if compromised, would pose no financial or material risks.  

The Association of National Advertisers (ANA) along with industry groups are lobbying for federal legislation that will pre-empt this and similar legislation across the country.

Article source:


No Comments

What Walmart Learned From the Target Data Breach

Walmart CIO Karenann Terrell offers provocative comments about retail security and what the Target data breach taught the industry.

LAS VEGAS—The Target data breach in 2013 sent shock waves through the retail industry that reached all the way to Walmart, the world’s largest retailer. In a keynote speech on April 28 at the InformationWeek Conference, co-located with the Interop conference here, Walmart CIO Karenann Terrell (pictured) answered a question from the audience about the impact of the Target breach.
“What Target taught the entire industry was that you can’t have any single point of failure,” Terrell said.
The ability to protect against every single potential breach vector is zero; that’s why layered security with a hard, crusty exterior protection layer is needed on each individual component, including infrastructure, data and applications, Terrell said. As part of a layered approach to security, analytics and data that tracks what is happening on a network from a threat-vector perspective is needed, she said, adding that it’s also important to watch the movement of data across an organization to see what happens.
Before the Target breach, Walmart knew about the need for multi-layered defensive strategy.

“We have multiple businesses, and in some areas, we look more like a bank than a retailer,” Terrell said. “So what we learned is that single points of failure anywhere can have really drastic effects, and the ability for an attack to go undetected for a period of time, just exponentially increases the damage that can occur.”

The Target breach had a greater impact on the public than many had expected, she said.
“What we learned is we have to have white-hat testing capability on staff for continual testing,” Terrell said.
In the post-Target breach era, Terrell has also focused on the malicious insider threat, which she sees as a real threat (though the Target breach was not caused by a malicious insider). Malicious insiders are extremely difficult to identify today, and that’s where data analytics can play a big role, she said.
Terrell’s keynote focused mostly on how to organize IT to deliver on business objectives. She described technology is a continuum, with a constant evolution of processes and tools.
Walmart has a different view on how it looks at legacy IT assets.
“We prefer to call it classic rather than legacy,” Terrell said.
Using the term “classic” is respectful for the people who are keeping the lights on, and Walmart doesn’t want to alienate people by labeling technology as “legacy” systems.
In addition, Terrell said, rolling IT modernization is just a new way of working. “We are in a continuous build-and-operate cycle now,” she said. “I think there will be a constant modernization of environments.”
Sean Michael Kerner is a senior editor at eWEEK and Follow him on Twitter @TechJournalist.

Article source:


No Comments

HIPAA Rules and Procedures in the Event of a Data Breach, Part One

As discussed in my prior post, recent massive data breaches at major retailers and health insurance providers paint a bleak picture of modern data and emphasize the importance of strong security safeguards and plans for handling suspected security breaches for electronic protected health information (“ePHI”). In the healthcare context, a security breach of a covered entity or a Business Associate’s (BA) data security system triggers the Security Rule and can trigger certain breach notification requirements under Health Insurance Portability and Accountability Act (“HIPAA”) and Health Information Technology for Economic and Clinical Health Act (“HITECH”). This post will discuss the investigation needed to determine whether a breach has taken place, while the next post will discuss the necessary notifications in the event of a breach.

Determining Whether an Actionable Breach Has Taken Place

HIPAA defines a security breach as “the acquisition, access, use, or disclosure of protected health information in a manner not permitted…which compromises the security or privacy of the protected health information.”[1] Pursuant to this definition, the first thing a CE must do is investigate the breach and determine whether unsecured PHI has been compromised. Data is compromised when there is “a significant risk of financial, reputational, or other harm to the individual.”[2]

PHI is unsecured when the PHI “is not … unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or mComputer hacker stealing data from a laptop concept for networkethodology specified by the Secretary…”[3] Thus, PHI is secure when the data is either encrypted to certain technology standards or the ePHI has been destroyed, which means breach notification is not required.[4] However, encrypted PHI is only secure if the key to decrypt the data is secure and remains confidential.

If ePHI is not encrypted or the decryption key is no longer secure, the data is not secure and data breach will trigger breach notification.

Thus, the best compliance practice is to encrypt all ePHI, whenever practicable, to take advantage of this regulatory safe harbor. Because breach notification can cause irreparable harm to an entity’s reputation and financial status, encryption is an important means to mitigate damages and risks of a data security breach.

In the case of a suspected security breach, covered entities need to take steps to thoroughly investigate the incident, determine if a security breach of unsecured PHI occurred, and determine the extent of the security breach or leak of information and the amount of PHI breached before the covered entity can take steps to stop the leak of PHI and reduce the damage caused by the security breach.

In 2013, the Omnibus Final Rule (“Final Rule”) released by the Department of Health and Human Services (“HHS”) redefined what was considered a security breach. Now, a security breach is presumed unless the entity can demonstrate that there is a low probability that any unsecured ePHI has been compromised.

The only way to show a low probability of compromise is by conducting a risk assessment to consider at least four significant factors:

(i) The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification;

(ii) The unauthorized person who used the protected health information or to whom the disclosure was made;

(iii) Whether the protected health information was actually acquired or viewed; and

(iv) The extent to which the risk to the protected health information has been mitigated.[5]

If a covered entity cannot identify a low probability that unsecured ePHI has been compromised, breach notification is triggered.

Come back Thursday for a discussion of breach notification provisions that apply in the event of a compromise of unsecured ePHI.

[1] 45 CFR § 164.402

[2] 45 CFR § 164.402(1)(i)

[3] 45 CFR § 164.402

[4] HHS guidance on the processes and standards for securing ePHI can be found on the HHS website: (last accessed April 21, 2015)

[5] 45 CFR § 164.402(2)

Article source:


No Comments