Live from Black Hat: Healthscare – An Insider’s Biopsy of Healthcare Application Security with Seth Fogie
Healthcare providers heavily leverage technology.ﾂ?In his talk, Seth Fogie,ﾂ?informationﾂ?security director at Penn Medicine takes apart different vendor systemsﾂ?at the ???fictitious??? Black Hat Clinic. Fogie gives a lot of examples and drives home the point that you shouldn???t just look at network security ??ｦ you have to dig deep into the applications to ensure the security of your data.
Following the patient???s journey.
Fogie followsﾂ?the patient???s journey of now geriatric Alice and Bob, our quintessential victims in the security realm. Taking on the perspective of Mallory, the malicious attacker, he goesﾂ?to town taking apart one system after another.
For example, patient entertainment systems not only let you watch television but also give access to patient data.ﾂ?The first system he looks at providesﾂ?access to patient health information without authentication and usesﾂ?client-side authentication for PINsﾂ?that are easilyﾂ?overcome whenﾂ?using a proxy server between the client and the server.ﾂ?ﾂ?
A different system, a clinical productivity system, hasﾂ?a backdoor with a daily password that is generated with a pre-determined algorithm.ﾂ?ﾂ?
Next, he looksﾂ?at the drug dispensary system, which hasﾂ?an unauthenticated network share. Investigating the binaries, he findsﾂ?the SQL decryptionﾂ?key.ﾂ?This leads to full system access of the server, which providesﾂ?access not only to user data but a full table of encrypted passwords that they were able to decrypt using the same decryption key.ﾂ?ﾂ?ﾂ?
Fogie then looksﾂ?at the temperature monitoring system that is used to chill blood bags, insulin, and other drugs. Usingﾂ?WireShark, heﾂ?findsﾂ?a few authentication codes and passwords.ﾂ?(Around this point my head and keyboard startﾂ?to smoke as Fogie speedsﾂ?through his results faster than I canﾂ?screenshot.)
In the end, he compromisesﾂ?all seven systems, mostly through the use of clientﾂ?software. No vendors areﾂ?harmed in this presentation as Fogie blurred out all screens.ﾂ?He also worked with vendors to notify them of the security issues. Where software was no longer maintained, he patched the client software himself by setting a unique and complex password for a backdoor he found.ﾂ?ﾂ?
Managing 225,000 patient records, Black Hat Clinic could have been on the hook for millions of dollars in fines. Healthcare records are particularly popular on the dark web because they often contain a lot of information that helps fraudsters steal the identity of their victims andﾂ?use their credit.
Red flags to keep in mind:ﾂ?
- Default credentials
- Plaintext credentials
- Lack of hashed credentials in database
- Exposed ???secrets??? via client-side file review
- Client/server protocol design errors
- OWASP 101 including APIs
- Client-side binary review issues (e.g. ???backdoor???, decrypt, keys, etc.)
- Client-side authentication (e.g. debug/patchable authentication)
Don???t just try to get to DC,ﾂ?pentestﾂ?your apps.
Fogie???s advice is to not only conduct aﾂ?pentestﾂ?that is trying to get to the domain controller to take over the network but also to dig deep into the applications that hold your data. At Penn Med, they do a ???Lite???ﾂ?pentestﾂ?of all new products. For fellow practitioners in the healthcare space, he recommendsﾂ?participating in H-ISAC.ﾂ?ﾂ?
Plea to healthcare application vendors: ???Pleaseﾂ?don???t make our jobs harder.???ﾂ?
Fogie is asking healthcare application vendors toﾂ?run security testing onﾂ?their applicationsﾂ?prior to release. Of course, being an employee of application security testing vendor Veracode, I completely agree. At Veracode, we???re also seeing the market shift.ﾂ?Application vendors are telling us that their customers are putting more pressure on them to develop secure software than the regulators.ﾂ?ﾂ?
As an educated software buyer, ask your application vendor about their secure development practices.ﾂ?Rather than picking a vendor that has had a single point-in-time penetration test, look for vendors that follow a secure development process to ensure that they are continually trying to reduce risk and are more responsive to security issues.ﾂ?Some vendors may alsoﾂ?have theﾂ?Veracode Verifiedﾂ?seal, an attestation Veracode provides to organizations that follow specific security protocols in their application development.ﾂ?ﾂ?
If you don???t have the resources in house to run the type of tests that Fogie did in his presentation, please reach out to us to have a conversation. Our automated testing can beﾂ?plugged into anyﾂ?DevSecOpsﾂ?process, plus we help you with your program management to bring your stakeholders on board and advise your development team on how to fix flaws.ﾂ?We also do manual penetration tests if that???s what you need.ﾂ?ﾂ?
If you???d like to take your first step in your application security journey, we recommend you download our Ultimate Guide to Getting Started with Application Security. ﾂ?
ﾂ?
*** This is a Security Bloggers Network syndicated blog from Application Security Research, News, and Education Blog authored by [email protected] (ckirsch). Read the original post at: https://www.veracode.com/blog/intro-appsec/live-black-hat-healthscare-insiders-biopsy-healthcare-application-security-seth
