One Article Review
| Source |  Veracode |
|---|---|
| Identifiant | 2103331 |
| Date de publication | 2020-08-06 10:16:00 (vue: 2020-12-15 21:05:43) |
| Titre | Live from Black Hat: Healthscare – An Insider\'s Biopsy of Healthcare Application Security with Seth Fogie |
| Texte |  Healthcare providers heavily leverage technology.ﾂ?In his talk, Seth Fogie,ﾂ?informationﾂ?security director at Penn Medicine takes apart different vendor systemsﾂ?at the ???fictitious??? Black Hat Clinic. Fogie gives a lot of examples and drives home the point that you shouldn???t just look at network security ??ｦ you have to dig deep into the applications to ensure the security of your data.
Following the patient???s journey.
Fogie followsﾂ?the patient???s journey of now geriatric Alice and Bob, our quintessential victims in the security realm. Taking on the perspective of Mallory, the malicious attacker, he goesﾂ?to town taking apart one system after another.
For example, patient entertainment systems not only let you watch television but also give access to patient data.ﾂ?The first system he looks at providesﾂ?access to patient health information without authentication and usesﾂ?client-side authentication for PINsﾂ?that are easilyﾂ?overcome whenﾂ?using a proxy server between the client and the server.ﾂ?ﾂ?
A different system, a clinical productivity system, hasﾂ?a backdoor with a daily password that is generated with a pre-determined algorithm.ﾂ?ﾂ?
Next, he looksﾂ?at the drug dispensary system, which hasﾂ?an unauthenticated network share. Investigating the binaries, he findsﾂ?the SQL decryptionﾂ?key.ﾂ?This leads to full system access of the server, which providesﾂ?access not only to user data but a full table of encrypted passwords that they were able to decrypt using the same decryption key.ﾂ?ﾂ?ﾂ?
Fogie then looksﾂ?at the temperature monitoring system that is used to chill blood bags, insulin, and other drugs. Usingﾂ?WireShark, heﾂ?findsﾂ?a few authentication codes and passwords.ﾂ?(Around this point my head and keyboard startﾂ?to smoke as Fogie speedsﾂ?through his results faster than I canﾂ?screenshot.)
In the end, he compromisesﾂ?all seven systems, mostly through the use of clientﾂ?software. No vendors areﾂ?harmed in this presentation as Fogie blurred out all screens.ﾂ?He also worked with vendors to notify them of the security issues. Where software was no longer maintained, he patched the client software himself by setting a unique and complex password for a backdoor he found.ﾂ?ﾂ?
Managing 225,000 patient records, Black Hat Clinic could have been on the hook for millions of dollars in fines. Healthcare records are particularly popular on the dark web because they often contain a lot of information that helps fraudsters steal the identity of their victims andﾂ?use their credit.
|
| Notes | ★★ |
| Envoyé | Oui |
| Condensat | 000 101 225 able about access advice advise after agree algorithm alice all also alsoﾂ andﾂ another anyﾂ apart apis application applications applicationsﾂ apps are areﾂ around ask asking attacker attestation authentication automated backdoor bags because been being between beﾂ binaries binary biopsy black blood blurred board bob bring but buyer can canﾂ chill client client/server clientﾂ clinic clinical codes completely complex compromisesﾂ conduct contain continually controller conversation could course credentials credit customers daily dark data database debug/patchable decrypt decryption decryptionﾂ deep default design determined develop development devsecopsﾂ did different dig director dispensary dollars domain don download drives drug drugs easilyﾂ educated employee encrypted end ensure entertainment errors etc example examples exposed faster fellow fictitious file findsﾂ fines first fix flags flaws fogie follow following followsﾂ found fraudsters from full generated geriatric get getting give gives goesﾂ guide had harder harmed has hashed hasﾂ hat hat: have head health healthcare healthscare heavily help helps heﾂ himself his hold home hook house how identity including information informationﾂ insider insulin investigating isac issues jobs journey just keep key keyboard keys lack leads let leverage like lite live longer look looks looksﾂ lot maintained make malicious mallory management managing manual market may med medicine millions mind:ﾂ monitoring more mostly need network new next not notify now often one only onﾂ organizations other out over overcome owasp participating particularly password passwords patched patient penetration penn pentestﾂ perspective picking pinsﾂ plaintext plea please pleaseﾂ plugged plus point popular practices practitioners pre presentation pressure prior process productivity products program protocol protocols providers provides providesﾂ proxy putting quintessential rather reach realm recommend recommendsﾂ records red reduce regulators release resources responsive results review risk run same screens screenshot seal secrets secure security seeing server seth setting seven share shift shouldn side single smoke software some space specific speedsﾂ sql stakeholders started startﾂ steal step system systems systemsﾂ table take takes taking talk team technology television telling temperature test testing tests than them then theﾂ through time town toﾂ try trying type ultimate unauthenticated unique use used user usesﾂ using usingﾂ vendor vendors vendors: veracode verifiedﾂ victims watch web what whenﾂ where which wireshark without worked your |
| Tags | Guideline |
| Stories | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.