Cybercrime , Cyberwarfare / Nation-state attacks , Data Breach

No Signs of Data Theft; Password Resets Ordered(euroinfosec) • February 8, 2019    The Australian Parliament Building in Canberra

Hackers have breached the Australian Parliament's network, although investigators say they have found no evidence that attackers stole any data.

See Also: Sunset of Windows Server 2008: Migrate with Docker

But the presiding officers of Parliament, in Canberra, said all users have been ordered to reset their passwords as a precaution.

"Following a security incident on the parliamentary computing network, a number of measures have been implemented to protect the network and its users," Tony Smith, speaker of the lower House of Representatives, and Scott Ryan, president of the upper house, the Senate, said in a joint statement issued on Friday.

"All users have been required to change their passwords," they said. "This has occurred overnight and this morning."

Parliament's network includes legislators' email archives, The New York Times reported.

The country's signals intelligence agency, the Australian Signals Directorate, as well as the Department of Parliamentary Services are probing the intrusion, according to Australian media reports.

Lawmakers Caution: Don't Rush Attribution

Smith and Ryan cautioned that it's too soon to try and attribute the attack (see Stop the Presses: Don't Rush Tribune Ransomware Attribution).

"Accurate attribution of a cyber incident takes time and investigations are being undertaken in conjunction with the relevant security agencies," Smith and Ryan said. "We are not in a position to provide further information publicly at this stage. Updates will be provided to members and senators and the media as required."

The head of the Australian Cyber Security Center, Alastair MacGibbon, declined to speculate about the identity of the attacker.

"My primary concern is making sure we get that offender out and we keep the offender out," he told Australian Associated Press.

Addressing reporters on Friday, Prime Minister Scott Morrison likewise declined to speculate about the identity of the attacker, and he reiterated that the attack appeared to be limited to targeting Parliament's network.

"I should stress that there is no suggestion that government departments or agencies have been the target of any such incursion," Morrison said, Associated Press reported.

Nevertheless, multiple Australian media reports have offered unsubstantiated speculation as to the identity of the attacker, based on the current geopolitical environment. Notably, Australia has banned China's Huawei and ZTE, and fell out with Moscow over the investigation into Malaysia Airlines Flight MH17, which was shot down by a Russian anti-aircraft missile in July 2014.

Some experts quoted in media reports have also suggested that only a nation-state could guess parliamentarians' passwords. But previous incidents have proven otherwise.

Legislators Routinely Targeted

Indeed, hack attacks that target legislators and their staff are common.

In December 2018, Politico reported that the email accounts of four senior aides within the National Republican Congressional Committee were compromised for several months

In late 2017, the Scottish Parliament, known as Holyrood, alerted 129 Members of the Scottish Parliament, or MSPs, as well as staff, that their email accounts were being targeted in unauthorized login attempts. Holyrood says the attack was not successful (see: Scottish Parliament Repels Brute-Force Email Hackers).

The same was not true in mid-2017, however, when an attacker appeared to have breached 90 email accounts used by British Members of Parliament, as well as staff and civil servants. In response, IT teams disabled remote access to the accounts. An investigation by Parliament blamed users' poor password choices for the breaches (see: Parliament's Email Practices Probed by Privacy Watchdog).

'Rattling Door Handles'

Alan Woodward, a professor of computer science at the University of Surrey, has described these types of email account-targeting attacks as "rattling door handles to see if any are open."

As with the U.K. Parliament breach, weak passwords chosen for email accounts and cloud services were also cited as the method using by an attacker to gather personal information on German politicians and celebrities, which was leaked throughout December 2018.

Following the episode, as some media outlets suggested the leaks might be the work of a nation state, German ministers pointedly declined to speculate about the attacker's potential identity. Shortly thereafter, a 20-year-old suspect, a German citizen, was arrested and police said he confessed to the crimes (see: German Police Identify Suspect Behind Massive Data Leak).

"Bad passwords were one of the reasons he had it so easy," Minister of the Interior Horst Seehofer said.

Beyond better password hygiene, Woodward says an excellent defense against these types of attacks is to use two-factor or multifactor authentication. While it won't provide bulletproof security, it would easily repel the types of low-tech attacks - including brute-force password guessing and spear-phishing - that continue to be leveled at so many legislative bodies (see: Nation-State Spear Phishing Attacks Remain Alive and Well).

It's not clear how many legislators follow recommendations to always use multifactor authentication to protect their email and online accounts.

Compliance , Electronic Healthcare Records , HIPAA/HITECH

Concerns Raised About Potential Impact on Patient Safety(HealthInfoSec) • February 7, 2019    Regulators have slapped electronic health records vendor Greenway Health with a $57 million fine.

For the second time, the Department of Justice has imposed a substantial fine on an electronic health records software vendor in a case that involves data accuracy and integrity issues that could affect patient safety.

See Also: Live Webinar | Underestimated Risk & Overestimated Security: When All You Do Is React, it May Be Too Late

In a settlement announced this week, DoJ slapped Greenway Health with a $57.25 million fine under the False Claims Act, with regulators alleging the company misrepresented the capabilities of its EHR software to meet the certification requirements of the HITECH Act meaningful use incentive program. HITECH has provided organizations with billions of dollars in incentive payments for using EHR software certified for the program.

The Justice Department says Greenway Health was aware that its Prime Suite EHR products did not correctly calculate the percentage of office visits for which its healthcare provider users distributed clinical summaries to patients, thereby causing certain users to falsely attest that they were eligible for HITECH incentive payments.

In a similar case back in 2017, the DoJ signed a $115 million settlement with Massachusetts-based EHR vendor eClinicalWorks, alleging the company falsely claimed it met the HITECH Act EHR incentive program's certification requirements.

The data accuracy and integrity issues in both the Greenway and eClinicalWorks cases raise potential patient safety and healthcare quality concerns, DoJ says.

"These cases are important, not only to prevent theft of taxpayer dollars, but to ensure that the promise of health technology is realized in the form of improved patient safety and efficient healthcare information flow," says U.S. Attorney Christina Nolan for the District of Vermont. "We will be unflagging in our efforts to preserve the accuracy and reliability of Americans' health records and guard the public against corporate greed. EHR companies should consider themselves on notice."

DoJ Allegations

Among the allegations in the Greenway case, the DoJ claims that the company's product did not incorporate standardized clinical terminology necessary to ensure the "reciprocal flow" of information concerning patients and the accuracy of electronic prescriptions.

"Greenway accomplished its deception by modifying its test-run software to deceive the company hired to certify Prime Suite into believing that it could use the requisite clinical vocabulary," the DOJ said in a statement.

"Medical professionals and patients depend on the security and competency of electronic health records as a means to improving both the quality and coordination of health care services," noted U.S. Attorney Byung Pak for the Northern District of Georgia.

In addition, prosecutors also alleged that Tampa, Florida-based Greenway violated the Anti-Kickback Statute by paying money and incentives to its healthcare provider clients to recommend Prime Suite to prospective new customers.

"DOJ's complaint against Greenway ... leaves me stunned by how easy it was for them to game the system," says attorney David Holtzman, vice president of compliance at security consulting firm CynergisTek.

"Organizations should perform a risk assessment of the functions and operability of the EHR to determine if there are vulnerabilities that would indicate inconsistencies in how data is calculated or operations are performed or that the EHR fails to protect the integrity of the data entered into the system. Unfortunately, the certification of EHRs seems to be largely on the honor system for which there appears to be little oversight or testing. "

Corrective Actions

In addition to paying the hefty financial penalty, Greenway also has entered into a five-year corporate integrity agreement with the Department of Health and Human Services' Office of Inspector General.

The agreement requires that Greenway retain an independent review organization to assess Greenway's software quality control and compliance systems and to review its arrangements with healthcare providers to ensure compliance with the Anti-Kickback Statute.

"Greenway must provide prompt notice to its customers of any patient safety related issues and maintain on its customer portal a comprehensive list of such issues and any steps users should take to mitigate potential patient safety risks," OIG notes.

The corporate integrity agreement also requires Greenway to enable Prime Suite customers to:

Obtain the latest versions of Prime Suite at no additional charge; Migrate their data from Prime Suite to another Greenway-developed software product without charge; Have Greenway transfer their data to another EHR software vendor without penalties, service charges, or any other fees other than contractual amounts still owed in connection with goods or services already provided.

In a statement provided to Information Security Media Group, Greenway Health CEO Richard Atkin says: "The settlement is not an admission of wrongdoing by Greenway, and all our products remain [HHS] certified. This agreement allows us to focus on innovation while collaborating with our customers to improve the delivery of healthcare and the health of our communities."

Meaningful Use

Under the HITECH Act meaningful use program, HHS made incentive payments available to eligible healthcare providers that adopted certified EHR technology and met certain requirements relating to their use of the technology. To obtain certification for their EHR software, vendors are required to demonstrate that their products satisfy all applicable HHS-adopted certification criteria.

"In January 2013, Greenway submitted an application for testing and certification of Prime Suite to the 2014 Edition. As part of the application, Greenway represented that Prime Suite satisfied the certification criteria for a complete EHR and was capable of meeting those criteria and using the required standards in the field. This representation was false," the Justice Department alleged in court documents in the Greenway case.

Broken Trust

Healthcare providers who use a certified EHR trust that the products perform as they were certified to do, notes Kate Borten, president of privacy and security consultancy The Marblehead Group.

"Not only does this case shine a spotlight on Greenway, the offending vendor, but it undermines that trust," she says. "It's not unlikely that other vendors will be revealed as deficient in the future. The testing and certifying bodies should re-evaluate their processes, specifically to reduce the possibility of vendors being less than honest."

The Greenway case provides a wake-up call to the healthcare industry and government regulators regarding vulnerabilities in the testing and oversight of the EHR certification system, Holtzman notes.

"Healthcare organizations that attested to meaningful use using Greenway's products will be on bated breath waiting for HHS to decide what it will do," he says.