Application Security , Data Breach , Fraud

A famed British computer security researcher has lost several key motions in a federal hacking case that stems from his alleged contribution to two types of banking malware.

See Also: Live Webinar: Building Secure Delivery Pipelines with Docker, Kubernetes, and Trend Micro

The rulings mean that statements made by Marcus Hutchins, 24, of Devon, England, during questioning by FBI agents at a Las Vegas airport can be entered into testimony. Hutchins' defense team challenged the validity of the interrogation on the grounds that he was intoxicated and unfamiliar with U.S. legal procedures.

His defense against the charges may now be more difficult. Hutchins was arrested on Aug. 2, 2017, just before he was to fly back to the U.K. after attending the Black Hat and Def Con security conferences. He is accused of developing and distributing Kronos and UPAS Kit, two types of banking malware, between 2012 and 2015.

Agents escorted him from an airport lounge and handcuffed him. Hutchins admitted to developing code for the banking malware, but denied having a larger role. Hutchins also made two phones calls, both of which were recorded, in which he made further incriminating statements.

Hutchins was indicted by a grand jury in July 2017 on 10 counts of computer-related violations. The case is being heard in federal court in Wisconsin.

Before he rose to fame, Hutchins was known in computer security circles for his deep analysis of malware via his Twitter account, MalwareTechBlog. In May 2017, Hutchins used his expertise to defang WannaCry, a ransomware worm that rapidly spread across the world.

Hutchins discovered WannaCry had been coded in such a way that he could effect a "kill switch" that would cause the malware to stop running if a certain domain name was live. He registered the domain, thus stopping additional computers from being infected.

As a result, Hutchins lost his low profile and suddenly became the subject of worldwide media attention, which he appeared to accept reluctantly but with grace. His world flipped again, however, following his arrest (see: WannaCry 'Accidental Hero' Denies FBI Charges).

'Terrible Hangover'

Hutchins' attorneys filed a motion to suppress the statements he made after his arrest. They challenged whether his Miranda rights were clearly presented and whether Hutchins understood those rights.

They also contended Hutchins was intoxicated at the time of questioning. But FBI agents followed Hutchins the day of his arrest to ensure he had not been drinking prior.

U.S. District Court Judge J.P. Stadtmueller found that Hutchins' did voluntarily waive his Miranda rights, even if he had come off several days' of partying at the security conferences. Although Hutchins was "clearly confused" about the questioning, he knew it had to do with Kronos, Stadtmueller writes.

Judge Stadtmueller's ruling

"There is also no evidence, nor does Hutchins claim, that he was under the influence of drugs that day - only that he was exhausted," Stadtmueller writes. "But a terrible hangover alone does not, as a matter of law, render someone unable to exercise or waive their Miranda rights."

Stadtmueller did note, however, that during questioning, Hutchins appeared to be unaware he'd been indicted, because agents had apparently not told him that during his arrest. He also wasn't immediately provided with the arrest warrant.

"There is no reason why the government could not have told him exactly why he was arrested, as he requested, and as was required of them by Federal Rule of Criminal Procedure 4(c), unless they were concerned that he would not be cooperative with them," the judge writes. "There is certainly an element of deception to this set of events that the court does not endorse."

Even considering Hutchins' tired state, however, "the government has met its burden in proving that the waiver was voluntary," Stadtmueller writes. The judge also denied several other motions that sought to dismiss charges.

Psychological Toll

Hutchins has developed a large and loyal Twitter following. He continues to track botnets, runs the Malware Tech blog and occasionally holds live video workshops showing techniques for reverse-engineering malware. He's also been allowed to continue to work and remains employed by Kryptos Logic in Los Angeles.

Hutchins demonstrates his sharp sense of humor on his Twitter feed, but he occasionally references the psychological toll that's come from the criminal case, which he's been fighting for 18 months.

Artificial Intelligence & Machine Learning , Breach Preparedness , Cybersecurity

Another HIMSS conference is in the rear-view mirror. But what's up the road in terms of top cybersecurity-related challenges facing the healthcare sector?

See Also: Live Webinar: Building Secure Delivery Pipelines with Docker, Kubernetes, and Trend Micro

Based on the variety of sessions that I attended and the many conversations I had with security leaders and regulators at HIMSS19, the consensus is that healthcare organizations still have a lot of work to do to ensure that patient information is kept private and secure.

Cyberattacks in the healthcare sector are becoming more targeted and more profitable for hackers, said Rod Piechowski, senior director of health information systems at the Healthcare Information and Management Systems Society. That includes attacks involving social engineering, such as business email compromises.

But that's just the tip of the iceberg. Other growing concerns include nation-state attacks with a socio-economic impact, supply chain attacks, compromises related to the internet of things and data-in-motion attacks, said Axel Wirth, a solutions architect of Symantec.

And let's not forget about vulnerabilities of connected medical devices, especially the big gaps in security for those devices running legacy operating systems.

Many hospital security leaders feel like their hands are tied in dealing with those growing medical device risks. That's because penetration testing and network scans of medical devices present potential safety risks to patients if the gear malfunctions as a result.

And many of the older medical devices in service today aren't going to be retired anytime soon.

"It would cost of hundreds of millions of dollars for us to replace everything running Windows 7 or earlier operating systems," Kevin McDonald, director of clinical information security at the Mayo Clinic, told a HIMSS19 audience.

And even if big health systems like Mayo were able to replace all their older devices, the equipment would likely become smaller healthcare providers' problem. "Hand-me-down medical devices are very common," McDonald noted.

What Are the Answers?

When it comes to newer gear coming to market, healthcare entities need to muscle their influence early in the game, suggested Andy Sargent, director of product security at device maker Philips.

"Procurement is a good time to talk security," he told the HIMSS19 audience.

Also, having vendors provide a list of software and components included that are built into the medical devices can also help healthcare entities. Mayo compares lists of key device components and software to a national vulnerabilities database to help keep tabs on potential problems, McDonald said.

Indeed, the Food and Drug Administration, as well as a panel of federal advisers, are pushing for all medical device makers to provide bills of materials to their customers.

Technology Quest

When it comes to emerging security technologies that can help healthcare organizations address an array of worries - including breach detection, response and prevention - artificial intelligence and machine learning were among the hottest topics at HIMSS19.

"The biggest technology stacks we've been implementing are around optimizing our analytics, which includes behavioral analytics, event management platforms [that are] tightly integrated into the process - making sure that people, process and technology are fully implemented in the response strategy, Ron Mehring CISO at Texas Health Resources, told me in an interview.

But another hot technology - blockchain - also holds promise for applications and processes ranging from supply chain management to health information exchange.

Mitch Parker, CISO at Indiana University Health, told me his organization is testing blockchain in hopes of rolling out new applications for security soon.

Regulator Activity

Despite the Trump administration's deregulatory mantra, the healthcare sector likely faces several new regulations as well as ramped-up enforcement activities.

On Feb. 11, two Department of Health and Human Services agencies - the Office of the National Coordinator for Health IT and the Centers for Medicare and Medicaid Services - issued proposed rules that deal with prohibiting the blocking of secure information exchange plus a number of other issues, including improving patients' access to their health records.

At a HIMSS19 press briefing, CMS Administrator Seema Verma said that under the proposals, regulators will "out" organizations that don't play by the new rules prohibiting information blocking.

"We want patients at the center of the healthcare system, and we want to make sure they have all the tools they need to make the decisions that work best for them," she said.

CMS' proposals include a provision to "publicly report the names of clinicians and hospitals who submit a 'no' response to certain attestation statements" about whether they pledge not to engage in information blocking.

When I asked Verma whether HHS' plans to publicly report information blocking offenders might take a road similar to the Office for Civil Right's "wall of shame" website listing health data breaches, she said: "Sure, I think all of that is appropriate. We're trying to use our authority under a penalty program and/or incentive program. ... So for hospitals not to be penalized, and for providers to get incentives, they're payment is tied to how they are performing around interoperability."

Under the 21st Cures Act, which led to the proposed new regulations, "interoperability" refers to "technology that enables the secure exchange of electronic health information with, and use of electronic health information from, other health IT without special effort on the part of the user."

HIPAA Enforcement

The federal government's HIPAA enforcement agency - the HHS Office for Civil Rights - also plans to keep a close eye on whether covered entities and business associates toe the line.

OCR will take enforcement action against those organizations that have "a culture of noncompliance and total disregard for the duty of care that is owed to protecting individuals' protected health information," Nick Heesters, OCR health information privacy and security specialist, told me in an interview.

Clearly, healthcare organizations have a long list of security-related obstacles, obligations and opportunities to navigate.