Threat Lab

Certain types of cybercrime targets always make headlines. In this two-part series, we’ll get into a pretty serious one: your health, and why hackers are targeting the healthcare industry for profit.

The Short Answer: Medical Data is Worth a Lot

Stolen medical data is valuable, plain and simple. In a Phishlabs study from 2014, healthcare-related credentials were valued at 10 times the worth of stolen credit card numbers on the dark web. The data for sale typically includes names, birthdays, relevant policy numbers, billing details, and more. Criminals can use this data for anything from identity theft to insurance fraud and more.

The More Complex Answer: There’s a Huge Attack Surface

“An average hospital room will have between 15 and 20 medical devices, and almost all of them will be networked.” – Rick Reid, Aruba Networks

Most hospitals are very large organizations. Even smaller hospitals have hundreds of staff members, while larger institutions, such as my local hospital in Dublin, have over 3,000. The sheer number of patients, visitors, and contractors on site at any one time would give any admin team a challenge to monitor, never mind secure. 

Endpoints and Devices are Disparate and Often Unsecured 

The variety of connected devices in a given hospital environment also presents a host of security challenges. Modern IoT medical devices, such as wearable monitors, operate on the same network as ancient un-patchable devices which were developed without any security considerations by companies that have since closed. These factors combine to provide plenty of avenues for attackers to infiltrate sensitive systems. 

According to Christopher Neal, CISO of Australia’s largest operator of private hospitals, Ramsey Healthcare, unsecured medical devices will continue to be a problem in the industry for years to come. After a security audit of the company, which consists of around 30,000 employees and around 9,500 beds, Neal stated:

“[We found] a lot more equipment with default credentials, default configuration, sitting not on the corporate network but [in] DMZs… Anything you’re buying today has not been built secure-by-design, most likely. This is a problem that’s going to live in healthcare for another 15 to 20 years.”

Even keeping a typical Windows® computer secure is tricky in an environment where updating operating systems is notoriously slow. Hospitals worldwide are clinging onto the less secure Windows® 7 and Windows® XP platforms. Unfortunately, the reluctance to upgrade OS’s brings significant security risks; in our own research, we’ve discovered that systems running Windows 7 and older are at least twice as likely to become infected as those running the newer and more secure Windows® 10 operating system. 

Learn how ongoing cybersecurity education and training for end users is a must for businesses to stay secure.

The Operational Structure is Disjointed

Hospitals are complex and sometimes chaotic places. Institutions with a lot of non-elective admissions, especially public hospitals, are usually crowded. A single campus might contain many different hospital organizations, each with its own units, wards, offices, etc. All of these share data between them.

As you might imagine, management structures for such hospitals are very complicated, especially in Europe, where public hospitals are more common than in places like the U.S. Many public health facilities communicate with each other, while, above them, a large national health service coordinates and facilitates data sharing. As a result, planning and implementing security initiatives is often both challenging and slow. 

Medical Research is Valuable

Medical institutions are also targeted for the purpose of stealing research. Medical research can take many years and cost millions to develop, but it can be stolen in minutes. Motives for stealing research may vary, but most are financially based. For instance, some attacks may be state-sponsored initiatives to outpace other nations in pharmaceutical research and, thereby, bring new drugs to market before competitors. Others may simply be to hold potentially life-saving research for ransom or sale to the highest bidder.

Hospitals Provide an Essential Service

Delays or disruption at a care facility could seriously impact patient care or even cost lives. Hospitals simply can’t afford the outages, downtime, or general post-breach scrambling that an attack would cause, making them “easy money” for criminals. That’s why, when we hear about attacks on healthcare organizations, they usually involve some kind of ransomware—hospitals often have no choice but to pay the ransoms. Unfortunately, all targets would seem to be fair game, and reports of attacks on cancer support organizations, cardiology units, and children’s hospitals are not out of the ordinary. 

The Road Ahead

In his book, Black Box Thinking, Matthew Syed outlines how medicine lags far behind other (similarly complex) industries, such as aviation, when it comes to learning from mistakes and improving safety. Syed asserts that the litigation and shame associated with failures in healthcare has led to a negative culture in an industry that tends to bury bad stories, instead of tackling them head on. The healthcare sector is also legally more culpable for any data breaches and is at greater risk from any resulting costs.But it’s not all bad news. Although the gears of government and healthcare may move more slowly, a lot of security-related changes are happening in the sector. For example, the much-maligned NHS in the U.K. has implemented major changes since the WannaCry attacks of 2017. Wide-ranging investigations were undertaken and costly and far-reaching initiatives were put into practice. In fact, the digital wing of the NHS now offers advice to other state healthcare groups on how to tighten up defenses against this global scourge.

To learn more about how criminals are targeting the healthcare industry, as well as what needs to be done about it, check out the second installment of this blog: Healthcare Cyber Threats That Should Keep You up at Night.

Entrepreneur Jim Rohn once said, “Time is more valuable than money. You can get more money, but you cannot get more time.” I think anyone involved in running a business can relate to this statement, but it carries a particularly deep meaning to those of us who deal with cybersecurity.

When it comes to cyberattacks, even the most minor malware infection can create costly delays and downtime, and the damages from data loss or business disruption can be financially devastating. Dealing with the consequences of denial-of-service attacks, ransomware, and data breaches shouldn’t be an accepted part of your agenda. 

You need to protect your business first. That means having a strong lineup of cyber-defense tools that don’t just mitigate threats, but actually put time back in your day. The key to success is to stop threats before they stop you. One of the most important pieces of that puzzle is the tools you use, particularly to achieve automation.

Learn more about protecting your business first with ADR and other cyber-defense best practices by checking out our Lockdown Lessons podcast series.

What are EDR, MDR, and ADR, and what’s the difference?

I am the first to admit that the cybersecurity world throws around far too many acronyms, and the definitions are not abundantly clear. (I’m definitely guilty of this, myself.) So let’s break down some of the endpoint-related jargon you may have heard lately.

Endpoint Detection and Response (EDR)

Endpoint detection and response (EDR) technology gathers large volumes of data from endpoints and provides security analysts with large amounts of information to help detect and mitigate cyber threats. These solutions significantly improve endpoint visibility, threat remediation, and can even assist with threat hunting. But to take full advantage, a staff of trained security analysts are necessary––and with today’s skills gap, this model does not make sense for the majority of SMBs and MSPs.

Today, EDR is beginning to morph into “enterprise detection and response.” The endpoint telemetry data it produces forms part of a more holistic approach to network security. 

Managed Detection and Response (MDR)

In recent months, cloud-based security service providers have been leveraging EDR data and compensating for the cybersecurity skills gap through managed detection and response (MDR). 

Working around the clock, MDR acts as a security analyst by providing automated threat detection, response, and remediation. It protects the entire network––not just endpoints––and provides the time, commitment, and cybersecurity skills necessary to fully detect, mitigate and resolve issues. The unfortunate truth here is that, for many smaller businesses, MDR is just too expensive. They may need to explore different partnership models or leverage managed services from their vendors.

Automated Detection and Response (ADR)

For businesses and managed service providers without dedicated cybersecurity resources and an ample budget, automated detection and response (ADR) may be the perfect answer. When other solutions become overwhelmed by the vast quantity of incoming malware, ADR leverages AI and machine learning to not only stop threats, but also to proactively predict and prevent them. As a result, this type of solution can actually put time back in your day.

As the cybersecurity landscape evolves and the skills gap continues to grow, MSPs and SMBs must onboard solutions that automate their defenses and offer the missing cybersecurity intelligence that only ADR provides.

ADR: the Next-Gen Evolution of Cybersecurity

As you are probably aware, modern attacks continue to increase in complexity, become more targeted, and are often automated at scale. They can also move unpredictably and laterally, as we have seen with Island Hopping (i.e. the act of compromising one company by infiltrating its affiliates, partner network, and/or supply chain.)

I know that many of you experience challenges that can make your business or clients vulnerable to attack, including:

• Broad attack surfaces
• Limited security expertise
• Lax or inadequate access controls
• Data loss, email spam, and phishing vulnerabilities
• Insufficient understanding of compliance

The best way to combat these types of vulnerabilities is to leverage the power in prediction to stop attacks before they happen, and to quickly and automatically remediate threats that do get through. This is where ADR provides a new way to think about cybersecurity.

Currently, your cybersecurity or IT team needs to manage multiple tasks across multiple systems, which requires in-depth knowledge of computer systems and cybersecurity threats. Consequently, response time is often slow. With ADR, tasks are automated, and threats are investigated, validated, and remediated in the background––greatly boosting your operational efficiency and effectiveness.

As the threat environment continues to evolve, you will need to keep pace and ADR changes the security equation by improving the accuracy of detection and speed of response, saving you a lot of time and hassle—not to mention money.

E-Scooter Security Vulnerability

A security researcher recently found an API vulnerability within the software of Voi e-scooters that allowed him to add over $100,000 in ride credits to his account. The vulnerability stems from a lack of authentication after creating an account which allows users to enter an unlimited number of promo codes offering ride discounts through several of the service’s partners. The writeup of steps to replicate flaw was temporarily taken down by the researcher until the company resolves the issue.

MageCart Strikes Volusion Sites

Thousands of sites using Volusion software have been affected by malicious MageCart scripts going back to mid-September. The scripts have been running from a non-descript API bucket and are using filenames that would appear benign to most security software and site admins. While victims will likely begin monitoring for stolen payment card data, it is still unclear how many sites have been compromised in total.

Brazilian Database for Sale

A database containing extremely sensitive information belonging to more than 92 million Brazilian citizens was found up for auction on several marketplaces on the dark web. Included in a sample of the data were driver’s license numbers and taxation info for the 93 million Brazilians currently employed within the country. Unfortunately for those involved, Brazil’s recently introduced data protection law won’t be in effect until halfway through next year.

Twitter 2FA Leak

Twitter announced earlier this week that many email addresses and phone numbers customers were using for two-factor authentication had been provided to third-parties for use in targeted advertisements. The company is still working to determine how many users are involved in this apparently unintentional misuse of their sensitive information. Twitter has fixed the main issue, though they still require a phone number for 2FA regardless of the method used to verify the account.

New Zealand Health Organization Hacked

Following a cyber attack in August of this year, officials discovered evidence of multiple intrusions into their systems going back nearly three years. The health organization has been working with law enforcement to determine the extent of the unauthorized access, as well as attempting to contact all affected individuals.

First and foremost, endpoint protection must be effective. Short of that, MSPs won’t succeed in protecting their clients and, more than likely, won’t remain in business for very long. But beyond the general ability to stop threats and protect users, which characteristics of an endpoint solution best set its administrators for success?

Get the 2019 PassMark Report: See how 9 endpoint protection products perform against 15 efficiency benchmarks.

Consider the world of the MSP: margins can be thin, competition tight, and time quite literally money. Any additional time spent managing endpoint security, beyond installing and overseeing it, is time not spent on other key business areas. Performance issues stemming from excess CPU or memory usage can invite added support tickets, which require more time and attention from MSPs. 

So, even when an endpoint solution is effective the majority of the time (a tall order in its own right), other factors can still raise the total cost of ownership for MSPs. Here are some metrics to consider when evaluating endpoint solutions, and how they can contribute to the overall health of a business. 

1. Installation Time

We’ve written recently about the trauma “rip and replace” can cause MSPs. It often means significant after-hours work uninstalling and reinstalling one endpoint solution in favor of another. While MSPs can’t do much about the uninstall time of the product they’ve chosen to abandon, shopping around for a replacement with a speedy install time will drastically reduce the time it takes to make the switch. 

Quick installs often also make a good impression on clients, too, who are likely having their first experience with the new software. Finally, it helps if the endpoint solution doesn’t conflict with other AVs.  

2. Installation Size

Few things are more annoying to users and admins than bulky, cumbersome endpoint protection, even when it’s effective. But cybersecurity is an arms race, and new threats often require new features and capabilities. 

So if an endpoint solution is still storing known-bad signatures on the device itself, this can quickly lead to bloated agent with an adverse effect on overall device performance. Cloud-based solutions, on the other hand, tend to be lighter on the device and less noticeable to users.

3. CPU Usage During a Scan

Many of us will remember the early days of antivirus scans when considering this stat. Pioneering AVs tended to render their host devices nearly useless when scanning for viruses and, unfortunately, some are still close to doing so today. 

Some endpoint solutions are able to scan for viruses silently in the background, while others commandeer almost 100 percent of a device’s CPU to hunt for viruses. This can lead to excruciatingly slow performance and even to devices overheating. With such high CPU demand, scans must often be scheduled for off-hours to limit the productivity hit they induce. 

4. Memory Usage During a Scheduled Scan 

Similar to CPU use during a scan, RAM use during a scheduled scan can have a significant effect on device performance, which in turn has a bearing on client satisfaction. Again older, so-called legacy antiviruses will hog significantly more RAM during a scheduled scan than their next-gen predecessors. 

While under 100 MB is generally a low amount of RAM for a scheduled scan, some solutions on the market today can require over 700 MB to perform the function. To keep memory use from quickly becoming an issue on the endpoints you manage, ensure your chosen AV falls on the low end of the RAM use spectrum. 

5. Browse Time

So many of today’s threats target your clients by way of their internet browsers. So it’s essential that endpoint security solutions are able to spot viruses and other malware before it’s downloaded from the web. This can lead to slower browsing and frustrate users into logging support tickets. It’s typically measured as an average of the time a web browser loads a given site, with variables like network connection speed controlled for. 

Effectiveness is essential, but it’s far from the only relevant metric when evaluating new endpoint security. Consider all the above factors to ensure you and your clients get the highest possible level of satisfaction from your chosen solution.

Copyright Phishing Campaign Hits Instagram

Many Instagram accounts were recently compromised after receiving a notice that their accounts would be suspended for copyright infringement if they didn’t complete an objection form within 24 hours. By setting a timeframe, the attackers are hoping that flustered victims would quickly begin entering account credentials into a phony landing page before being redirected to the authentic Instagram login page to appear legitimate.

WordPress Plugin Exploited

Rich Reviews, a vulnerable WordPress plugin that was removed from the main WordPress repository more than six months ago, has been found still active on thousands of websites. This vulnerability allows attackers to download malicious payloads, then redirect victims to phony websites that could further infect their systems. Fortunately, several security companies are working with the plugin’s creators to fix the current vulnerabilities, though these updates won’t reach users until it’s put back on the repository.

Banking Malware Campaign

Hundreds of malware samples have been discovered that target ATMs and can be deployed to obtain sensitive banking information from infected systems. Dtrack, the name of the malware tools, can also be used to steal local machine information, such as keystrokes and browser history, by using known vulnerabilities in network security. This type of attack comes from the Lazarus Group, who have been known to target nations and major financial institutions around the world.

Click2Gov Site Hacked

An online bill paying site used in dozens of cities across the U.S. was recently hacked in at least eight cities, already compromising more than 20,000 individuals from all 50 states. This will be the third breach affecting Click2Gov, all of which used an exploit allowing attackers to gain both remote access to the system and upload any files they choose. Many of the cities that were targeted recently were part of the prior attacks on the Click2Gov portal.

Wyoming Healthcare Hit with Ransomware

Campbell County Health’s computer systems were brought to a halt after suffering a ransomware attack this week. Nearly 1,500 computers were affected and all currently scheduled surgeries and other medical care must be delayed or diverted to another facility. Fortunately, CCH is working quickly to restore all of their systems to normal and determine the exact infection point for the attack.

When you’re running a business, it’s important to stay connected, whether you’re in the office or not. Modern technology has made this easier than ever, ensuring you can answer emails and stay on top of tasks in hotels, coffee shops, wherever. Social media influencer and serial entrepreneur Gary Vaynerchuk has even said, “The airplane is disproportionately the place where I get the most tangible amount of work done.” 

But if you’re going to get anything done outside the office or on the road, there are a few essentials to have on hand. Here are five must-haves to make sure you are prepared and productive.

#1 Protect Your Devices and Your Data

No, this is not at the top just because you’re reading this on a security blog. Anytime you’re accessing the internet in a hotel, coffee shop, or other public space, your data and devices are at risk. While security may not be at the top of your list of concerns, a whopping 58% of data breaches happen to SMBs, and 60% of those who are attacked fold within 6 months.

This is why security, at the very least endpoint security, should be your number one consideration when working on the go. But not all endpoint security solutions are created equal.

Explore fast and effective endpoint security designed for business.

Modern endpoint security is cloud-based, lightweight (won’t slow your device down), and is powered by 24/7 threat intelligence to make sure you are protected against all known threats. In fact, some do what is known as “journaling” when they encounter an unknown threat so if it is deemed malicious, every action the malware took can be rolled back, step by step.

It’s also worth considering implementing a VPN to secure your connection to your office software and data as well as secure your communications with colleagues. Public WiFi is a favorite target of malicious attacks, including man-in-the-middle attacks, so the more you can anonymize your activity, the better.

#2 Stay Connected

When you’re on the road, there’s no guarantee that you’ll have reliable WiFi. Coffee shop WiFi can vary depending on how many people are using it, and hotel WiFi often costs money. To make sure you can always stay connected to high-quality WiFi, you’ll want to invest in a mobile WiFi device, which will work much better than using your smartphone as a hotspot. Plus, using a mobile WiFi device will help save your phone battery and will free it up for any phone calls you need to make. 

In addition, by using your own WiFi hotspot, you will avoid some of the security risks that come from using public WiFi. 

#3 Stay Charged

The last thing you want when working on the go is for your devices to run out of battery. Of course, you must remember to bring your basic laptop and smartphone chargers. However, you might not always have convenient access to an outlet. In which case, you’re going to want to bring a portable charger. Smartphones and laptops have different battery needs so you might want to get a portable charger for each.

Here is a list of the top portable chargers for smartphones and another for the top power banks for your laptop.

#4 Stay in the Zone

If you’re out of the office, chances are it might be more difficult to find some peace and quiet. Because of this, you’ll want to make sure you have a good set of headphones to help you get in the zone. 

If you’re choosing headphones, you’ll need to consider whether you want to go with over-the-ear or in-ear models. Over-the-ear models tend to have higher sound quality and better noise canceling features, but there are a variety of high-quality earbuds these days that may be easier to travel with. Whichever you go with, they’ll be useless without productivity-enhancing music to go along with them.

A study published on the psychology of music found that those who listened to music completed their tasks more quickly and experienced better creativity. If you want to make your own playlist, it’s largely accepted that classical and other instrumental types of music work best for productivity. However, there are a variety of curated work playlists already in existence that you could use.

#5 Travel with the Right Bag

Now that you have your laptop, smartphone, chargers, portable batteries, headphones, and WiFi hotspot, you’ll need a way to carry it all around. But not just any bag will do. Since you’re traveling, you’ll want something that is compact, organized, and comfortable to carry, even if it’s heavy.

While the briefcase is a classic, it is not very efficient and can be cumbersome when also trying to carry coffee or talk on the phone. Backpacks are definitely the way to go if you want to carry everything comfortably while keeping your hands free. Just make sure to choose a bag made of durable materials with adequately wide and cushioned straps. The last thing you want in a bag is one you wince at the thought of carrying again after a long day.

TFlower Ransomware Exploiting RDP 

Ransomware attacks seem to be earning larger payouts by focusing on big businesses and governments, and a new variant dubbed TFlower might be no exception. TFlower has been proliferating by hacking into compromised networks through various remote desktop services. Attackers can reportedly execute the malware and begin encrypting most file types and removing all local backups. It is still unclear how much the demanded ransom is, but researchers have found that TFlower doesn’t append the encrypted files’ extensions.  

Ransomware is evolving. Click here to learn more on the threat.

Lion Airline Data Leak 

More than 30 million customer records belonging to two Lion Air-owned companies Malindo Air and Thai Lion Air were found in a publicly accessible database and later on several underground forums earlier this month. Among the available data are names, birthdates, and passport information, all of which could easily be used to commit identity fraud. While the data was available for nearly a month, it is still unclear how many individuals may have obtained copies of the data. 

White Hat Hackers Expose Webcam Security Flaws 

Over 15,000 unique webcams from several different manufacturers have been found to be using default security settings while connected to the internet. Many of the compromised devices have been identified in the U.S., Europe, and Southeast Asia. This recent discovery should prompt manufacturers to implement additional security settings and require users to set their own passwords.  

Medical Patient Images and Data Unprotected 

In a recent research study of 2,300 healthcare systems, nearly 25 percent were publicly accessible on the internet, containing a total of 24.3 million patient healthcare records from at least 52 countries. Over 400 million medical images were available for access or download through a system that allows medical workers to share patient documents. These systems date back to the 1980s and need to be brought up to current security standards, as the current system has virtually none.  

Ecuadorian Data Analytics Breach 

An Ecuadorian data analysis firm, Novaestrat, is under investigation after it was discovered that the company left personally identifiable information for nearly every Ecuadorian citizen exposed in an unsecured database. Records for 2.5 million car owners and nearly 7.5 million financial and banking transactions were included in the records. Immediately upon the revelation of the breach, Ecuadorian government officials arrested the CEO for possessing the data illicitly.