3rd Party Risk Management , Compliance , Governance

Federal regulators have issued new guidance clarifying when a business associate can be held directly liable for compliance with the HIPAA privacy, security and breach notification rules.

See Also: 10 Incredible Ways You Can Be Hacked Through Email & How To Stop The Bad Guys

In 2013, as required under the HITECH Act, the Department of Health and Human Services' Office for Civil Rights issued a final rule - frequently referred to the HIPAA Omnibus Rule - that, among other things, identified provisions of the HIPAA rules for which business associates are directly liable for compliance.

Because of confusion about the issue, OCR has issued a fact sheet and a compilation of frequently asked questions about the HIPAA compliance requirements for business associates. "We want to make it as easy as possible for regulated entities to understand, and comply with, their obligations under the law," says OCR Director Roger Severino.

BA Liability

OCR's guidance reiterates that the agency has authority to take HIPAA enforcement action against business associates. For example, the office can take action for BAs' failure to:

OCR also can take enforcement action if a BA retaliates against any individual for filing a HIPAA complaint, participating in an investigation or other enforcement process or opposing an act or practice that is unlawful under the HIPAA rules.

BA Breaches

Business associates have been involved in many of the largest health data breaches, including several large breaches posted to the HHS HIPAA Breach Reporting Tool website so far in 2019.

Commonly called the "wall of shame," the website lists health data breaches impacting 500 or more individuals.

As of Tuesday, some 39 incidents affecting a total of nearly 1.1 million individuals that have been added to the tally so far in 2019 were reported as incidents involving a business associate, or where a business associate was reported as being "present." Those incidents represent about 20 percent of all breaches added to the tally so far this year.

BA Risks

"Business associates still struggle with their HIPAA Security Rule obligations, in many of the same ways as do covered entities, including with regard to risk analysis, risk management and encryption, for example," says privacy attorney Iliana Peters of the law firm Polsinelli. "Business associates struggle with understanding their obligations to flow down the requirements of their business associate agreements with their own vendors that have access to protected health information."

Covered entities and business associates alike must understand the lifecycle of their data so that appropriate HIPAA-required security safeguards are applied, Peters adds. And business associates should periodically conduct "mini-audits" of their security practices to ensure they are meeting obligations spelled out in their BA agreements, she says.

Even though business associates became directly liable for HIPAA compliance nearly six years ago, confusion about their duties persists.

"Some BAs fail to understand the full scope of their compliance responsibilities," says Kate Borten, president of privacy and security consultancy The Marblehead Group.

"For example, some tech companies may claim compliance based on implementing security technologies, such as strong encryption. But we know that technology is only a part of a full-blown information security program as required."

Peters adds: "There may still be some confusion in the regulated community about not only what potential violations for which business associate are directly liable, but also the purposes of ensuring that covered entities and business associate have good business associate agreements in place, given that liability for other potential violations stem from those business associate agreements."

For example, Peters says that anything that a business associate is not directly liable for under HIPAA - but is nonetheless required by a covered entity - should be addressed in the business associate agreement. "So, not only is understanding the direct liability piece important for business associates, it's also important for covered entities to make sure their business associate agreements are appropriately comprehensive."

Longstanding Issues

Privacy attorney Kirk Nahra of the law firm WilmerHale says the guidance from OCR shines a spotlight on BA's longstanding HIPAA compliance requirements.

"The only thing that might be considered a little new - although it mainly makes something clear that is already in the rules - is that business associates don't have a compliance obligation to follow the administrative requirements of the privacy rule," he notes. "They probably should do a lot of those things anyways - like training and policies and procedures - but they aren't compliance obligations because they aren't in a business associate agreement. "

Managing Vendor Risk

Some covered entities have taken steps to raise the bar on their expectations of vendors that handle PHI.

For instance UPMC, a large healthcare system based in Pittsburgh, along with a half dozen other larger healthcare delivery organizations last year launched the Provider Third Party Risk Management Council. Members of the council are requiring their vendors - including cloud services providers - to become certified in the HITRUST Common Security Framework by summer 2020. That framework cross-references standards, regulations and business requirements, including HIPAA.

"What we're pushing as a group is that if you want to do business with us ... you want to deliver services to us through the cloud, you have to be HITRUST-certified," says John Houston, UPMC's vice president of information security and privacy and associate counsel.

Cybercrime , Endpoint Security , Fraud Management & Cybercrime

Reports that the city of Baltimore was attacked using a vulnerability in Windows originally stockpiled by American intelligence agencies has triggered a blame game.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

Not for the first time, the Baltimore incident has given information security watchers cause to debate questions of culpability over finding and stockpiling zero-days and exploits, as well as issues surrounding data breaches, leaks, software flaws and patch speed.

So who's at fault for the ransomware infection that has hit the city, and, more generally, attacks using the weaponized flaw exploit, code-named EternalBlue, that a number of actors continue to wield against numerous targets?

Fresh questions over culpability have resulted from a Saturday report in the New York Times that cites three former NSA operators who said the agency had spent nearly a year discovering the flaw and writing code to exploit it. The flaw was originally dubbed EternalBluescreen because it so often crashed computers. The Times reports that the exploit was used numerous times, and proved very valuable for intelligence operations over a five-year period, before the agency lost control of it. Only then did the NSA alert Microsoft to the flaw, leading to it quickly issuing patches. And now Baltimore is one of the latest victims of attackers exploiting the flaw, the Times reports.

The short list of who to potentially blame for the Baltimore incident now includes: the National Security Agency, for building the exploit and holding onto it for five years, without alerting Microsoft, before losing control of it; the shadowy group - maybe foreign, maybe domestic - calling itself the Shadow Brokers, which leaked the exploit in April 2017; Microsoft, for not building bug-free operating systems; the city of Baltimore, for having failed to apply an emergency Windows security update more than two years after it was released in March 2017 - and two months later for older operating systems - which blocked EternalBlue exploits in every Windows operation system from XP onward; and, of course, the attackers, whoever they might be.

Baltimore Gets Hit

The May 7 attack against the city of Baltimore, meanwhile, was the second ransomware outbreak to hit city systems in 14 months. In this case, the attackers used a knock-off of EternalBlue to install crypto-locking code that splashed a demand for 13 bitcoins - worth $100,000 at the time - across workers' PC screens, written in imperfect English, according to news reports.

"We've watching you for days," read a copy of the ransom demand obtained by The Baltimore Sun. "We won't talk more, all we know is MONEY! Hurry up!"

Officials have refused to pay the ransom and say they're working with the FBI as well as third-party incident responders to investigate and mitigate the attack. But three weeks after the attack, restoration operations have yet to conclude and many city operations remain suspended.

City of Baltimore officials did not immediately respond to a request for comment about whether the SMB_v1 was used to exploit city systems, and if so why they had not yet been patched.

Debate: Vulnerabilities Equities Process

Whenever someone discovers a zero-day flaw and writes code that successfully exploits it, once the code gets out in the wild, anyone can use it. For years, cybersecurity experts have been warning that every leak of a top-secret exploit allows others - from script kiddies to organized crime gangs - to also target the underlying flaw.

The U.S. government maintains a Vulnerabilities Equities Process, via which it can choose to alert vendors to code problems, so they can be patched. But for especially valuable code flaws, the government can also choose to not notify.

Thomas Rid, a cybersecurity expert at Johns Hopkins University, tells the New York Times that the Shadow Brokers leaks were "the most destructive and costly NSA breach in history" - worse even than former NSA contractor Edward Snowden's 2013 leaks - and says the U.S. government has studiously avoided taking any blame.

"The government has refused to take responsibility, or even to answer the most basic questions," Rid said. "Congressional oversight appears to be failing. The American people deserve an answer."

But other intelligence experts note that there can be clear cause for holding onto exploits. "There are substantial security benefits to retention and use and disclosure isn't always a cure," says Susan Hennessey, a senior fellow in national security at the Brookings Institution who formerly served as an attorney in the NSA's Office of General Counsel.

EternalBlue Knockoffs

While this might be splitting hairs, attackers often don't use the exact EternalBlue tool to attack targets. David Maynor, a security researcher at Cisco Talos, notes that attackers typically use "a knocked off copy" of the exploit code "written after the leak" to target the SMB_v1 flaw. Regardless, targeting the flaw is the point, and the flaw didn't come to public attention until the Shadow Brokers leaked it in April 2017.

Since then, attacks that utilize the flaw have been blamed on apparent criminal gangs as well as nation-state attackers. North Korea was allegedly behind crypto-mining attacks as well as the WannaCry outbreak that began in May 2017 and exploited the flaw in a worm-like fashion (see After 2 Years, WannaCry Remains a Threat).

Russia, meanwhile, has been blamed for launching NotPetya, which targeted the SMB_v1 flaw.

Earlier this month, however, a report from Symantec said Chinese attackers were targeting the flaw before the Shadow Brokers ever leaked it. That suggests intelligence agencies beyond the NSA knew about the flaw and were targeting it before Microsoft received a heads-up from the U.S. government and rushed out patches.

Baltimore Failed to Patch

So for more than two years, why hadn't Baltimore patched its systems against the SMB_v1 vulnerability that EternalBlue exploited, despite global alerts about the severity of the flaw? Robert Graham, head of offensive security firm Errata Security, says the city is clearly at fault for not doing so. He also stresses that the SMB_v1 exploit is just one tool in attackers' attack toolkit, and that they'll use whatever works. And so long as it works, they'll keep using it.

Likewise, Beau Woods a cyber safety innovation fellow with the Atlantic Council, says one of the main takeaways from the WannaCry outbreak - and now the recent Baltimore ransomware attack - is that attackers will use whatever works.

Patch or Perish Redux

Patching is the obvious fix. But patching isn't easy, or else everyone would be experts at it, and exploits of a well-publicized and long-patched SMB_v1 flaw in Windows would never succeed (see Why Attackers Keep Winning at 'Patch or Perish').

"For some organizations, patching can be a non-trivial exercise, even with a couple of years of lead time," data breach expert Troy Hunt tells the BBC.

"Specialized systems such as medical devices, for example, often go unpatched for long periods of time," he says. "Given we're still seeing infections due to EternalBlue two years after it was patched, evidently there are still systems out there both unpatched and exposed."

Hunt says he's surprised that large organizations such as the city of Baltimore are continuing to get exploited via unpatched SMB_v1.

But Baltimore is far from the only entity that appears to be behind on its Windows SMB_v1 patching. And security firm ESET reports that more attackers than ever have been searching for vulnerable systems.

Blame Attackers

When it comes to disrupting Baltimore, Robert M. Lee, a former U.S. Air Force cyber warfare operations officer who's now CEO of industrial control system security firm Dragos, says attackers are clearly to blame, regardless of which exploits they might be using or who may have discovered them first.

"NSA seems to get blamed for everything," Lee tweets. "They deserve blame and critique for some things. But not for everything, and two years after an exploit is patched, it feels to me that we should focus more on the adversary than the origin of an exploit."

News aggregation app Flipboard has publicly confessed that hackers accessed personal data about its members.

Although the biz did not say how many customers had been affected, the app has been installed more than half a billion times, according to its Google Play Store listing.

The databases that got away, according to a Flipboard statement, included account credentials, names, hashed and salted passwords, and email addresses. Some of these passwords were SHA-1 hashed, while those created after March 2012 were hashed and salted with the more modern and tougher-to-crack bcrypt algorithm.

The app's makers do not collect financial data or government ID card information.

Flipboard is a news aggregator. Rather than visiting your favourite news website and reading their glorious headlines, beautiful stock images and cutting-edge captions the way the gods journalists intended, Flipboard allows you to create a personalised "news magazine" that you swipe your way through.

It's not just Flipboard accounts that may be vulnerable, the company warned. "If users connected their Flipboard account to a third-party account, including social media accounts, then the databases may have contained digital tokens used to connect their Flipboard account to that third-party account."

All such tokens have been deleted or replaced.

All passwords have been reset, though Flipboard insisted that not all of its users had been compromised and that it was still "identifying the accounts involved". Law enforcement agencies have, it added, been told of the breach and an unidentified third-party security firm is analysing what happened.

The fallout from this hack is likely to persist. With such a large userbase, the number of affected accounts seems likely to fall into the six-figure bracket – or, if luck is not on their side, a heck of a lot more. ®

Endpoint Security , Governance , Legacy Infrastructure Security

A security researcher warns that nearly 1 million devices running older versions of Microsoft Windows remain vulnerable to a recently discovered flaw in Microsoft's Remote Desktop Protocol service that could enable attackers to use a worm-like exploit to take over unpatched machines.

See Also: Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

Even though Microsoft issued a fix for this flaw, which is called BlueKeep, for its Patch Tuesday update on May 14, some 950,000 unpatched devices running older Windows operating systems remain vulnerable to it, Robert Graham of the security firm Errata Security writes in a blog published Tuesday.

Although Microsoft says it's seen no evidence of the flaw being exploited in the wild, Graham warns attackers could develop a robust exploit within the coming weeks, which makes patching urgent.

Potential Impact

The vulnerability, listed as CVE-2019-0708, was first spotted by the U.K.'s National Cyber Security Center. If exploited, an attacker could "execute arbitrary code on the target system. An attacker could then install programs; view, change or delete data; or create new accounts with full user rights," according to Microsoft's May 14 alert.

The flaw affects many older versions of the company's operating system, including Windows XP, Windows 7, Windows 2003 and Windows Server 2008, the company notes. Newer versions of Windows, including Windows 8 and Windows 10, are not affected.

And while Microsoft issued a patch for these older systems on May 14, Graham warns that nearly 1 million unpatched devices remain vulnerable to the flaw. As a result, attackers could create a worm-like exploit reminiscent of the WannaCry or NotPetya ransomware incidents of 2017 (see: After 2 Years, WannaCry Remains a Threat).

"That means when the worm hits, it'll likely compromise those million devices," Graham writes. "This will likely lead to an event as damaging as WannaCry and NotPetya from 2017 - potentially worse, as hackers have since honed their skills exploiting these things for ransomware and other nastiness."

Potential Danger

In a May 14 post, Microsoft warned that because the BlueKeep vulnerability does not require user interaction, an exploit could spread malware from one vulnerable machine to another within a network in the same way that the WannaCry ransomware is "wormable."

"While we have observed no exploitation of this vulnerability, it is highly likely that malicious actors will write an exploit for this vulnerability and incorporate it into their malware," Microsoft says.

Security firm GreyNoise Intelligence warned on Friday that at least one threat actor is scanning networks looking for systems that are vulnerable to BlueKeep.

ZDNet reports that several other cybersecurity firms, including Zerodium, McAfee, Kaspersky, Check Point, MalwareTech and Valthek, have developed exploits for BlueKeep but are keeping those private. This demonstrates, however, that a determined attacker could take advantage of the vulnerability.

Scanning for Vulnerabilities

For his research, Graham used a masscan internet port scanner tool to search for any open ports - in this case port 3389 - that are used by Microsoft's Remote Desktop Protocol service. It's through these open ports that an attacker could exploit the BlueKeep flaw.

At first, Graham's scan found more than 7 million devices using port 3389 for Remote Desktop Protocol. After checking for honeypots and eliminating systems that had already been patched, he concluded that "roughly 950,000 machines are on the public Internet that are vulnerable to this bug."

Graham predicts that attackers are likely to create a robust exploit for this vulnerability within the next month or two.

In his blog post, Graham warned large enterprises to fix security issues related to PsExec - a command-line tool that enables IT administrators to execute processes on remote systems. It's through this tool that a worm can spread throughout the entire network from one infected machine.

"You may have only one old WinXP machine that's vulnerable, that you don't care if it gets infected with ransomware. But that machine may have a Domain Admin logged in, so that when the worm breaks in, it grabs those credentials and uses them to log onto the Domain Controller," Graham writes. "Then, from the Domain Controller, the worm sends a copy of itself to all the desktop and servers in the organization, using those credentials instead of the vuln."

Application Security , Breach Response , Data Breach

A security researcher has discovered a way to skirt around an Apple security feature that could be leveraged to trick people into downloading a malicious application.

See Also: 10 Incredible Ways You Can Be Hacked Through Email & How To Stop The Bad Guys

The researcher, Filippo Cavallarin, published details of the issue on his website after giving Apple a 90-day disclosure period. Cavallarin is CEO and chief security researcher at Segment, a cybersecurity company based near Venice, Italy.

The issue concerns Gatekeeper, which is Apple's feature for keeping bad apps off a machine. Gatekeeper, which was launched in 2012 with OSX Mountain Lion, checks if an application has a digital signature from Apple, which means the app is trusted. Untrusted apps are blocked or require more user interaction to run.

Cavallarin's method takes advantage of trust that's built into Gatekeeper. For example, Gatekeeper considers external drives and network shares to be "safe" locations to run apps from, Cavallarin writes.

But this is actually problematic. The automount feature allows a user to mount a network share via any path that starts with /net/, Cavallarin writes. The file path could be written to include a hostile destination, such as this: /net/evil-attacker.com/sharedfolder/.

There's also another legitimate behavior that can also be abused. Cavallarin writes that a zip archive can contain a symbolic link, which is essentially a file path. When the zip archive is unpacked, macOS doesn't check the symbolic links, he writes.

Working Exploit

The exploit would work like this: An attacker sends a zip file to a victim with a symbolic link that leads to an end point the attacker controls. The victim unpacks the archive and follows the link, Cavallarin writes.

"Now the victim is in a location controlled by the attacker but trusted by Gatekeeper, so any attacker-controlled executable can be run without any warning," he writes. "The way Finder is designed (ex hide .app extensions, hide full path from titlebar) makes this technique very effective and hard to spot."

Apple officials contacted in Sydney on Tuesday didn't have an immediate comment. Cavallarin writes he reached out to Apple on Feb. 22 and understood the issue was to be fixed by May 15, "but Apple started dropping my emails."

Expert: 'Broader Attack Capabilities'

Gatekeeper bypasses have been found before by Patrick Wardle, a macOS security expert who is co-founder of Digita Security. Wardle has also create a suite of free, specialized tools for macOS on his Objective-See website.

Wardle tells ISMG that Gatekeeper was designed to essentially protect users from themselves, such as if someone downloaded an app that looked legitimate but turned out to be malicious, such as a fake updater or a document.

Patrick Wardle's report

"Being able to bypass Gatekeeper in this scenario definitely opens up some broader attack capabilities and could be used in one such attacks (i.e. tricking users into downloading and running malware)," he says.

Gatekeeper's overly trusting nature has been noted by Wardle, who described how it works in a paper he presented at the Virus Bulletin conference in 2014.

When an app is downloaded from the internet, Gatekeeper attaches a quarantine attribute to it. But there are quite a few scenarios in which that attribute may not be set, posing risks to users.

Mitre's ATT&CK knowledge database summarizes the research around Gatekeeper, including Wardle's: "Apps loaded onto the system from USB flash drive, optical disk, external hard drive, or even from a drive shared over the local network won't set this flag. Additionally, other utilities or events like drive-by downloads don't necessarily set it either. This completely bypasses the built-in Gatekeeper check."