Fraud Management & Cybercrime , Governance , IT Risk Management

Data integrity issues can arise in the wake of a ransomware attack. Case in point: A California podiatrist practice hit by ransomware reports that patient files were possibly "altered" or "corrupted."

See Also: Live Webinar | Sunset of Windows Server 2008: Migrate with Docker

In a notification statement, the Podiatric Offices of Bobby Yee, which has locations in Monterey and Salinas, reports that on Oct. 29, 2018, the practice was "the victim of a ransomware attack which resulted in the unauthorized alteration and potential corruption of their medical files, including patient personal information." The statement adds that "there is no evidence suggesting that personal or medical information was viewed or exfiltrated."

The attack was reported to federal regulators on Dec. 20 as a hacking/IT incident affecting 24,000 individuals and involving a desktop computer, laptop, and other portable electronic devices, according to an entry on the Department of Health and Human Services' HIPAA Breach Reporting Tool website.

Commonly called the "wall of shame," the federal website lists reports of health data breaches impacting 500 or more individuals.

Attacks potentially impacting the integrity of patient data is "is the next 'big risk' issue," predicts former healthcare CIO David Finn, executive vice president at security consulting firm CynergisTek.

"In terms of risk, there is no doubt that data integrity represents a huge risk to patient safety," he says. "We've now moved from confidentiality and availability - which ... impact patient trust and caregiver trust - into the integrity arena and that really represents patient safety."

'Altered Information'

The Podiatric Offices of Bobby Yee's statement notes that the "altered information" may have included first name, last name, address, telephone number, age, gender, date of birth, Social Security number, health insurance policy number and patient medical records.

Once the practice became aware of the incident, it took steps to protect personal information and to determine the nature and scope of the issue, the statement notes. "If there is indeed any alteration or corruption of your personal information, we may need to reconfirm or reconstruct the information, including your medical information," the statement adds.

The practice did not immediately respond to an inquiry from Information Security Media Group requesting additional details about the incident.

Patient Data Integrity

It remains unclear whether the practice hit by ransomware is referring merely to its data being encrypted by hackers, as is common in ransomare attacks, or otherwise altered.

The data alteration reference "is very likely a nicer way of saying the data was encrypted and bricked for money," says Harold Byun, a vice president at application data protection firm Baffle. "In order for ransomware to be successful, it needs to affect multiple users and collect a ransom, which by nature, makes it an attack that is aimed at a widespread population of victims," he notes.

"It is possible that ransomware could be used to modify specific data types or databases, but that would be a much more targeted and advanced attack that would require prior knowledge of the system and application and would likely only be used in a scenario where the risk vs. reward was very large."

But attacks that impact data integrity can also be potentially caused by mistakes made by hackers, notes Ron Pelletier, a partner at Pondurance, LLC, a cybersecurity firm specializing in managed detection and response. "It's further important to perform the necessary forensics to drive clarity. For instance, it is entirely possible that encryption activity initiated by the bad actors was faulty, or otherwise the production data was already in the middle of a routine of some sort, which may inadvertently corrupt some of the datasets," he says.

"If the organization was able to gain a copy of the malware instance, they could reverse engineer it to determine the scope of its payload - [for example to] potentially hide files or steal credentials."

Integrity issues often get less attention than availability and confidentiality, Finn says.

"In terms of security, we are used to dealing with confidentiality, availability and integrity. We've gotten pretty good at availability. We're getting better at confidentiality - new regulations, including the General Data Protection Regulation [in the European Union] will help that," Finn says. "Unfortunately, we tend to think that all the systems, tools and 'built in' integrity checking are taking care of integrity, so it gets taken for granted."

Attacks impacting the accuracy and integrity of data can effect a range of healthcare systems and medical gear, "everything from safety limits on syringe pumps ...calibration settings on lab equipment or imaging machines, and just the critical patient data like allergies, dosages or diagnosis could alter care plans or treatments with grave effects," Finn notes.

Changed But Not Viewed?

Can data be altered or corrupted in ransomware and other cyberattacks without being viewed or exfiltrated, as the podiatry practice of Dr. Bobby Yee says happened at its organization?

"Yes, absolutely," says former healthcare CISO Mark Johnson, a shareholder at consultancy LBMC Information Security. "Viruses or malware in general do this all the time; they infect a file, and that changes the integrity of the file, i.e. the data of that file. The real question is, are there attacks going on that are designed to change the data, not just the operating system or application, and not just to exfiltrate the data?"

In theory, there are attacks with the capabilities to do this, he notes. "If you have enough access to encrypt the data, then you have enough access to change the data," he adds.

What's the Motivation?

While attacks aimed at tampering with data integrity are reason for concern, fortunately, such attacks in the healthcare sector appear to be rare, Johnson says.

"At this point it's hard to imagine an attack that's sole motivation is to change the data," he says. "Ransomware 'changes' the data by encrypting it, but it is blackmail or 'kidnapping' of your data. Attackers in ransomware assaults want to get paid - that's their motivation - so they tell you that the data is safe - unchanged - just taken 'away' from you until you pay."

Still, many attack victims in the healthcare sector "are looking to see if they can tell if the data was viewed or left the building, he adds "Few, if any, think about what the attacker did to the integrity of the data."

Johnson says healthcare organizations need to be on guard for potential attacks that impact data integrity. "Don't assume that the attacker's only motivation was to take your data," he says. "Assume that all of the data that they could have accessed has been altered."

Steps to Take

Healthcare entities can take a variety of steps to prevent and detect attacks that impact the integrity of data, Finn notes.

"I'd still like to see more encryption ... and multifactor authentication and better backup procedures," Finn says.

Other steps include validating computer software systems with vendors, implementing audit trails, running error detection software and establishing a vendor management security qualification program, Finn suggest.

"If you are developing your own software, you'll also want to adopt a development lifecycle that ensures data quality tasks are designed and built into the software from development through to system maintenance," he says.

The Linux kernel will be tweaked to mitigate data-stealing attacks that exploit system page caches.

As we revealed first over the weekend, a group of experts – including some of the researchers who discovered the Spectre family of chip flaws – worked out how to get operating system page caches to leak information from one application to another. Among other things, a successful exploit would allow malware or rogue logged-in users to swipe sensitive data from application sandboxes that they should not otherwise be able to access.

For Linux environments, the issue has been assigned CVE-2019-5489. That bug database entry notes that remote attacks are possible, for example, by exploiting latency in accessing files via an Apache web server to potentially sniff private data.

The Windows kernel was also vulnerable, and updated for Insider testers ahead of the paper's public reveal on Monday, with the patch due for a formal rollout. Now the Linux kernel has followed suit with this fix to the mincore syscall, which should trickle into distros once it's undergone testing.

Publishing the patch, kernel chieftain Linus Torvalds wrote that mincore's traditional semantic “exposes a lot of system cache state that it really probably shouldn't, and that users shouldn't really even care about.”

That made fixing the issue relatively straightforward, he added: “So let's try to avoid that information leak by simply changing the semantics to be that mincore() counts actual mapped pages, not pages that might be cheaply mapped if they were faulted.”

As is often the case in software projects, something complex that's just working can remain untouched for a very long time, lest someone breaks it. And such is the case for this syscall. Torvalds noted that mincore semantics were ill-defined from the beginning, though, with a code comment from 2000 stating “later we can get more picky about what 'in core' means precisely.”

Torvalds said the patch shouldn't have any downstream effects. While the update is “a real semantic change,” he hoped that nobody has “any workflow that cares.” If fixing mincore breaks someone's software, Torvalds said, it may be necessary to revisit the code. That, to us, sounds like a real-life scream test. ®

Breach Response , Data Breach , Data Loss

Marriott International says its recently discovered mega-breach isn't quite as bad as first advertised, in terms of the total number of victims. But it also warns that hackers stole 5.25 million unencrypted passport numbers that its hotels were storing as well as 8.6 million encrypted payment cards.

See Also: Key Drivers to Enable Digital Transformation in Financial Services

On Nov. 30, 2018, Marriott said it had suffered a breach that began in 2014 with a breach of the reservation database used by Starwood Hotels & Resorts Worldwide, which Marriott acquired in September 2016 for $13 billion (see: Marriott's Mega-Breach: Many Concerns, But Few Answers).

Marriott originally estimated that the breach exposed information for 500 million customers. It also said that for 327 million customers, exposed information included their "name, mailing address, phone number, email address, passport number, Starwood Preferred Guest ('SPG') account information, date of birth, gender, arrival and departure information, reservation date and communication preferences."

But on Friday, Marriott said that instead of its estimate of 500 million customers having had some form of personal information exposed, it now believes that 383 million is the "upper limit" of affected customers.

"We concluded with a fair degree of certainty that information for fewer than 383 million unique guests was involved, although the company is not able to quantify that lower number because of the nature of the data in the database," it says in its revised data breach notification.

Marriott, which is publicly traded on NASDAQ and based in Bethesda, Maryland, owns or franchises more than 6,700 properties across 30 hotel brands located in 129 countries and territories.

Unencrypted Passport Data Stolen

Marriott also says that its breach investigation now counts 25.6 million passport numbers being exposed in the breach, of which 5.25 million were unencrypted. "There is no evidence that the unauthorized third party accessed the master encryption key needed to decrypt the encrypted passport numbers," Marriott says. But that doesn't mean that the attackers couldn't later brute-force decrypt the numbers.

Also exposed in the breach: approximately 8.6 million encrypted payment cards that were being stored by Marriott. If attackers were able to decrypt the card data, they could have been using the stolen card data since 2014 to commit fraud.

By the time that the breach was discovered in late 2018, however, Marriott says many of the payment cards had already expired. Indeed, only about 354,000 were still active as of September 2018, it says. As with the passport data, "there is no evidence that the unauthorized third party accessed either of the components needed to decrypt the encrypted payment card numbers," Marriott says.

The hotel chain has signaled that its investigation, which began after it confirmed on Nov. 19, 2018, that the Starwood reservation system had been breached, has now nearly concluded.

"As we near the end of the cyber forensics and data analytics work, we will continue to work hard to address our customers' concerns and meet the standard of excellence our customers deserve and expect from Marriott," Arne Sorenson, Marriott's president and CEO, says in a statement.

It isn't unusual for breached organizations to revise their assessment of how many customers or records were impacted by a breach, as their investigation continues (see: Data Breach Notifications: What's Optimal Timing?).

Probes Underway

The FBI is leading the U.S. law enforcement investigation into the Marriott breach, which continues.

Multiple state attorneys general have also launched investigations into the breach, and European privacy regulators have said they're also probing the incident (see: Marriott Mega-Breach: Will GDPR Apply?).

Marriott, meanwhile, does not appear to have been unprepared for the possibility of a data breach. In an 8-K filing with the U.S. Securities and Exchange Commission on Nov. 30, Marriott noted: "The company carries insurance, including cyber insurance, commensurate with its size and the nature of its operations. The company is working with its insurance carriers to assess coverage."

Email and Self-Service Notification

Marriott says it's emailing all affected customers for which is has an email address on file. "Please note that the email you may receive from us will not contain any attachments or request any information from you, and any links will only bring you back to this webpage," it says, adding that all of its communications will list "This email address is being protected from spambots. You need JavaScript enabled to view it." as the sender.

Customers who want to know if their personal details - including passport numbers - were exposed can also contact Marriott's call center or visit Marriott's data breach notification website. Marriott says that full information about exposed passport numbers has not yet been added to the site, but soon will be.

The hotel company has set up dedicated data breach call centers for 55 countries and regions, ranging from Argentina, Australia and Austria to the U.K., U.S. and Vietnam.

It is also offering one year of prepaid identity theft monitoring services to breach victims in 13 countries and regions. Such services may help customers whose personal details get stolen and used for fraud to try and fix the damage, although they do not compensate victims for their effort or lost time (see: Congratulations: You Get 'Free' Identity Theft Monitoring).

"Where available in your country/region, Marriott is offering affected guests the opportunity to enroll in a personal information monitoring service free of charge for one year," Marriott says. "This will be provided by Experian, a global data and information service provider. This service (IdentityWorks Global Internet Surveillance) is available to residents of Australia, Brazil, Germany, Hong Kong SAR China, India, Ireland, Italy, Mexico, New Zealand, Poland, Singapore, Spain and the Netherlands. (Experian does not currently offer this service in all countries or regions.)"

Passport-Replacement Questions

Following Marriott's warning that its breach exposed customers' passport data, the company faced calls to cover passport-replacement costs for all breach victims. The company has declined to do so, unless victims can prove that they suffered fraud as a result of Starwood or Marriott mishandling their passport number.

"The website lists phone numbers to reach the company's dedicated call center and includes information about the process to be followed if guests believe that they have experienced fraud as a result of their passport numbers being involved in this incident," Marriott says (see: After Mega-Breach, Marriott May Pay for New Passports).

One of the most active U.S. lawmakers on data privacy and protection, Sen. Mark Warner, D-Virginia, says the breach highlights a failure by many organizations to minimize the amount of data they routinely store on consumers, and he has slammed the company in particular for mishandling passport numbers.

"It's unacceptable that Marriott was retaining sensitive data like passport numbers for so long, and it's unconscionable that it kept this data unencrypted," said Warner, who co-chairs the Senate Cybersecurity Caucus, the Wall Street Journal reported.

The Marriott breach has renewed calls by some members of Congress for the country to pass strong privacy legislation. Bills from Sen. Brian Schatz, D-Hawaii, and Sen. Joe Kennedy, R-La., are among the legislation that Congress is expected to consider this year, The Hill reports.

Marriott Retires Starwood Reservation System

Two years after it acquired Starwood, meanwhile, Marriott reports that as of Dec. 31, 2018, Starwood-branded hotels are no longer using the Starwood reservation system. "With the completion of the reservation systems conversion undertaken as part of the company's post-merger integration work, all reservations are now running through the Marriott system," it says.

Starwood brands include: W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotels & Resorts, Four Points by Sheraton and Design Hotels.

Investigators Eye China

Last month, The New York Times, Reuters and Washington Post, all citing anonymous sources with knowledge of Marriott's investigation, reported that U.S. officials have been eying hackers working from China as culprits. The Times, in particular, reported that investigators had found "computer code and patterns familiar to operations by Chinese actors" that suggested they might be connected to China's Ministry of State Security, a civilian intelligence agency (see: Gartner's Avivah Litan on Impact of Marriott Breach).

U.S. Secretary of State Mike Pompeo, in an interview on Fox, also appeared to suggest that officials believed China might be behind the attack.

Chinese government officials, however, have denied that anyone from their country was involved (see: Reports: China Suspected in Marriott Database Breach).