Iranian Phishing Technique, China Implicated in Hack, Law Updates

TLP White

 

This week we start by looking at a phishing technique used by Iranian hackers to circumvent two-factor SMS authentication protections.  We then turn to the Marriott data breach and regulators’ claims that China is to blame for the hack, and we discuss a recent Pennsylvania case that could have lasting implications on employers’ efforts to protect employee data.  We end by adding some color to last week’s summary of Australia’s Assistance and Access law, a piece of legislation that allows government agencies to access previously unreachable digital communications in order to assist law enforcement efforts.

Welcome back to Hacking Healthcare.

 

Hot Links –

1. Phishing Scheme Bypasses SMS-Based Two-Factor Authentication Protections.

Last week, state-sponsored hackers from Iran found a way to get around SMS-based two-factor authentication controls used by Gmail and Yahoo Mail.[1]  The hackers began by sending a target a highly detailed spear-phishing email.  The email directed the target to enter his or her Gmail or Yahoo Mail login credentials into a fake Gmail or Yahoo Mail security page.  When the target entered his or her username and password into the fake security page, the hackers simultaneously entered the login credentials they collected from the fake page into a real Gmail or Yahoo Mail login website.  The hackers were then prompted to enter a two-factor verification code that had been sent to the real user via SMS.  To gain access to this code, the hackers shortly thereafter redirected the target user to a new website that requested the one-time verification code from the target.  Once the target entered the verification code into the new webpage, the hackers were able to access the code.  The hackers, therefore, had all the information necessary to access their target’s email account (username, password, and verification code) at their fingertips in a matter of minutes.

 

This attack technique demonstrates yet again that hackers do not need to develop new and sophisticated technical methods to continue their relentless practice of gaining access to users’ protected web portals.  “Phishing attacks are the most popular method of stealing data and hacking accounts amongst Iranian hackers, but the most significant fact about this campaign is its timing.”[2]  The timing of this attack technique demonstrates that hackers can use tried and true methods of accessing user accounts in new ways that exploit the processes users must go through to verify their identities.  As a way to fix the rampant problem of phishing schemes, CERTFA (the research group that discovered this Iranian hack) has suggested that users refrain from clicking on unknown links in their email and that technology companies stop using two-factor authentication by text plain message/SMS.[3] While we understand the spirit of that advice, it is important to note that SMS based MFA is still an improvement over just a username/password combination and it would be unwise to stop using it based solely on the fact that it isn’t perfect.

 

2. S. Investigators Point the Finger at China in Recent Marriott Data Breach.

Last month, Marriott reported a breach of its Starwood hotel reservation system that exposed the private information and travel details of approximately 500 million people.[4]  Now, U.S. government officials are reporting that state-sponsored Chinese hackers likely orchestrated the attack that divulged an atypically broad range of information to hackers, including individuals’ names, phone numbers, addresses, passport numbers, credit card numbers, travel destinations, travel partners, and other data.[5]

 

Government investigators have speculated that the Chinese government’s motivation for this attack was to gain information to enhance the enormous data sets it has worked to curate on U.S. and other world citizens for years.  The information exposed by the Marriott breach could be useful to individual hackers seeking to commit identity theft as well as intelligence agencies seeking to track diplomat, spy, or military personnel movements and build records on particular persons of interest.  U.S. investigators have cited further evidence of the Chinese government’s culpability for this attack by noting that the Marriott breach resulted from a signature Chinese hacking tactic.  The tactic involves accessing a cloud-hosting space and moving from server to server in order to access individuals’ protected information.

 

Experts have also noted that the timing of the Starwood compromise aligns with compromises at both Anthem and Premera healthcare insurance companies, both of which have been attributed to China based hackers. In today’s day and age, information is power, and China has apparently made its goal to amass large volumes of information on US citizens.  From an intelligence standpoint, it’s easy to see how Chinese government access to personal data on U.S. diplomats, intelligence officers, and/or military personnel could compromise U.S. interests.  The U.S. and other world powers have been slow to react on systemic, policy level to cyberattacks from foreign governments, and these attacks have been allowed to grow in number and scope as a result.

 

3. Pennsylvania Supreme Court Holds Employer Has Duty to Reasonably Protect Employees’ Personal Information.

In a precedent-setting decision that could very well have lasting implications on companies and their use of cybersecurity mechanisms to protect employee data, the Pennsylvania Supreme Court decided last Tuesday that the University of Pennsylvania Medical Center (“UPMC”) had an affirmative duty to protect its employees from data breaches by employing reasonable measures to secure employee information.[6]  In Dittman v. UPMC, UPMC employees brought a negligence claim and a breach of implied contract claim against the medical center after it suffered from a data breach that exposed its employees’ personal and financial information.[7]  Claiming that UPMC failed to use “proper encryption, adequate firewalls, and an adequate authentication protocol,” the employees alleged that this lack of data security fell below the reasonable standard of care that employers owe to their employees.[8]

 

Like the vast majority of companies in the world, UPMC required its employees to provide it with personal information in the course of their employment.  This affirmative requirement, the Pennsylvania Supreme Court implied, was the hook that allowed UPMC workers to allege that UPMC breached its duty of care to employees.  The court found in favor of the employees, ruling that an employer must take reasonable measures to defend the sensitive personal information it collects from its agents.  In addition to the affirmative duty this decision places on companies in the realm of data security, this holding also opens up avenues for employees to pursue monetary damages from their employers if they do not exercise “reasonable” measures to protect worker data.  What constitutes such “reasonable” measures, however, is still unclear and is yet to be seen.

 

4. Australia’s “Assistance and Access” Law: A Deeper Dive.

Last week we told you that Australia passed a new telecommunications law in an effort to force companies to help Australian law enforcement agencies access otherwise unintelligible or inaccessible digital information.  Because of the laws potential to influence the global landscape on these issues, we are taking a deeper dive into the “Assistance and Access” statute’s terms and the political back-and-forth that ensued after it was signed into law.  After the bill was passed, a slew of complex amendments were quickly drafted and passed in order to incorporate necessary technical changes, address internal consistencies, and contend with general contradictions within the law.[9]  Many experts have reported that the legislation is flawed and was rushed to pass, so further amendments may be on the horizon.  Despite all of its last minute alterations, the law currently authorizes a number of law enforcement and security agencies that hold a legal warrant for access to data to approach companies for assistance in accessing previously inaccessible data.

 

While the legislation is typically discussed in terms of anti-encryption, access to encrypted data is only one aspect of the law.[10]  After the amendments, the statute now also allows law enforcement agencies to compel an individual, or someone with “knowledge of the [individual’s] device,” (i.e., a company) to reveal that person’s password to the agency.  Law enforcement has also been granted the ability to apply access warrants remotely; officers no longer need to be on the premises specified in order to execute a warrant.  Finally, the law has been extended to include cloud data—data hosted in cloud drives that is not stored, but is accessible, on a given device—to be included in the law’s terms.  Penalties for violating the law include harsh fines and custodial sentences.[11]

 

Congress –

 

Tuesday, December 18:

–No relevant hearings.

 

Wednesday, December 19:

–No relevant hearings.

 

Thursday, December 20:

–No relevant hearings.

 

International Hearings/Meetings –

 

            EU – No relevant hearings.

 

Conferences, Webinars, and Summits –

–Medical Device Security 101 Conference – Orlando, FL (1/21/19-1/22/19) <https://nhisac.org/events/nhisac-events/medical-device-security-101-conference/>

–FIRST Symposium 2019 – London, UK (3/18/19-3/20/19)

<https://nhisac.org/events/nhisac-events/first-symposium-2019/>

–HEALTH IT Summit (Midwest) – Cleveland, OH (3/19/19-3/20/19)

<https://h-isac.org/hisacevents/health-it-summit-cleveland-2019/>

–National Association of Rural Health Clinics Spring Institute – San Antonio, TX (3/20/19-3/22/19)

<https://h-isac.org/hisacevents/national-assoc-of-rural-health-clinics-spring-institute/>

–HEALTH IT Summit (Southern California) – San Diego, CA (4/23/19-4/24/19)

<https://h-isac.org/hisacevents/health-it-summit-southern-california-2019/>

–HEALTH IT Summit (Florida) – Wesley Chapel (5/21/19-5/22/19)

<https://h-isac.org/hisacevents/health-it-summit-florida-2019/>

–2019 NH-ISAC Spring Summit – Ponte Vedra Beach, FL (5/13/19-5/17/19) <https://www.marriott.com/hotels/travel/jaxsw-sawgrass-marriott-golf-resort-and-spa/>

–HEALTH IT Summit (Southeast) – Nashville, TN (6/13/19-6/14/19)

<https://h-isac.org/hisacevents/health-it-summit-southeast-2019/>

–CybSec and Blockchain Health – London, UK (7/11/19-7/12/19)

<https://h-isac.org/hisacevents/cybsec-and-blockchain-health/>

–HEALTH IT Summit (Rocky Mountain) – Denver, CO (7/15/19-7/16/19)

<https://h-isac.org/hisacevents/health-it-summit-rocky-mountain/>

–HEALTH IT Summit (Northeast) – Boston, MA (10/3/19-10/4/19)

<https://h-isac.org/hisacevents/health-it-summit-northeast/>

 

 

Sundries –

 

—Signal app to Australia: Good luck with that crypto ban

<https://arstechnica.com/tech-policy/2018/12/signal-to-australia-good-luck-with-that-crypto-ban/>

—Computing pioneer Evelyn Berezin died this week—she should be remembered

<https://arstechnica.com/gadgets/2018/12/evelyn-berezin-creator-of-the-first-word-processing-computer-dies-at-93/>

— “We’re sorry,” Facebook says, again—new photo bug affects millions

<https://arstechnica.com/tech-policy/2018/12/were-sorry-facebook-says-again-new-photo-bug-affects-millions/>

—U.S. Ballistic Missile Defense Systems Fail Cybersecurity Audit

<https://www.bleepingcomputer.com/news/security/us-ballistic-missile-defense-systems-fail-cybersecurity-audit/>

—Twitter Fixes Bug That Gives Unauthorized Access to Direct Messages

<https://www.bleepingcomputer.com/news/security/twitter-fixes-bug-that-gives-unauthorized-access-to-direct-messages/>

—123456 Is the Most Used Password for the 5th Year in a Row

<https://www.bleepingcomputer.com/news/security/123456-is-the-most-used-password-for-the-5th-year-in-a-row/>

—Shamoon resurfaces, targeting Italian oil company

<https://www.cyberscoop.com/shamoon-saipem-palo-alto-networks/?category_news=technology>

—Can’t hack? You can buy the tools on the dark web instead

<https://www.cyberscoop.com/deloitte-cybercrime-black-market-cost-of-pwnership/?category_news=technology>

—Facebook, under scrutiny, pays out largest bug bounty yet

<https://www.wired.com/story/facebook-bug-bounty-biggest-payout/>

—If China Hacked Marriot, 2014 Marked a Full-On Assault

<https://www.wired.com/story/marriott-hack-china-2014-opm-anthem/>

 

 

 

Contact us: follow @HealthISAC, and email at contact@h-isac.org

[1] https://arstechnica.com/information-technology/2018/12/iranian-phishers-bypass-2fa-protections-offered-by-yahoo-mail-and-gmail/

[2] https://blog.certfa.com/posts/the-return-of-the-charming-kitten/

[3] Id.

[4] https://www.washingtonpost.com/news/powerpost/paloma/the-technology-202/2018/12/13/the-technology-202-trump-and-democrats-signal-support-for-antitrust-action-on-tech-companies/5c114ebb1b326b2d6629d45e/?utm_term=.670e7e4b464b

[5] https://www.washingtonpost.com/technology/2018/12/12/us-investigators-point-china-marriott-hack-affecting-million-travelers/?utm_term=.2f4867120f76

[6] Dittman v. UPMC, __ A.3d __, No. 43 WAP 2017, 2018 WL 6072199 (Pa. 2018).

[7] Id.

[8] https://www.law360.com/articles/1105174/pa-ruling-may-open-floodgates-on-cybersecurity-suits

[9] https://www.itnews.com.au/news/australias-encryption-bill-faces-17-changes-to-pass-parliament-516547

[10] https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r6195

[11] https://arstechnica.com/tech-policy/2018/12/australia-passes-new-law-to-thwart-strong-encryption/