Millions of Medical Documents for Addiction and Recovery Patients Leaked

As if wrestling with addiction and recovery weren’t difficult enough, tens of thousands of patients of a rehab clinic in Pennsylvania may find their personal information hijacked and manipulated by identity thieves or extortionists. An ElasticSearch database that was left open to the internet...

This Week in Security News: Medical Malware and Monitor Hacks

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn how baby monitors may be susceptible to hacking. Also, learn about a medical flaw that enables hackers to hide malware. Read on: Is Yo...

Ubiquitous Bug Allows HIPAA-Protected Malware to Hide Behind Medical Images

A bug in a 30-year-old standard used for the exchange and storage of medical images has been uncovered; it allows an adversary to embed fully-functioning executable code into the image files captured by medical devices such as CT and MRI machines. This results in hybrid files that allow malware...

A week in security (April 8 – 14)

Last week on Labs, we said hello to Baldr, a new stealer on the market, we wondered who is managing the security of medical management apps, discussed the different perceptions of personal information, and we looked at fake Instagram assistance apps found on Google Play that are stealing password...

Maliciously Tampering with Medical Imagery

In what I am sure is only a first in many similar demonstrations, researchers are able to add or remove cancer signs from CT scans. The results easily fool radiologists. I don't think the medical device industry has thought at all about data integrity and authentication issues. In a world where...

CVE-2019-5024

Capsule Technologies SmartLinx Neuron 2 devices (firmware 9.0.3 and older) contain a restricted environment escape vulnerability in kiosk mode. A specific sequence of USB keyboard inputs can escape the restricted environment and grant full administrator access to the underlying Windows OS. Affect...

Who is managing the security of medical management apps?

One truth that is consistent across every sector—be it technology or education—is that software is vulnerable, which means that any device running software applications is also at risk. While virtually any application-running device could be compromised by an attacker, vulnerabilities in medical...

A week in security (April 1 – 7)

Last week, Malwarebytes Labs took readers on a brief tour of some of the world's most notable data privacy laws, explored how gamers can protect themselves against cyberthreats, and offered thoughts about the reports that a 23-year-old Chinese woman gained access to President Donald Trump’s...

Capsule Technologies SmartLinx Neuron 2 restricted environment protection mechanism failure vulnerability

Summary A restricted environment escape vulnerability exists in the “kiosk mode” function of Capsule Technologies SmartLinx Neuron 2 medical information collection devices running versions 9.0.3 or lower. A specific series of keyboard inputs can escape the restricted environment, resulting in ful...

New malware can modify CT and MRI scan results

By Waqas Call it killer malware? Israeli researchers have developed a new malware that highlights some very critical and dangerous security vulnerabilities in medical imaging equipment, which is commonly used to diagnose serious health conditions like cancer and hypertrophic cardiomyopathy HCM. N...

Medical Weed Dispensary Exposes Health Data for Thousands

A data breach at a medical marijuana dispensary company operating in Canada has sent the personal health privacy of about 34,000 patients up in smoke. An electronic medical record system used by Natural Health Services – a self-described “cannabinoid medical clinic that specializes in cannabis...

Medtronic Defibrillators Have Critical Flaws, Warns DHS

The Department of Homeland Security has issued an emergency alert warning of critical flaws allowing attackers to tamper with several Medtronic medical devices, including defibrillators. The two vulnerabilities – comprised of a medium and critical-severity flaw – exist in 20 products made by the...

RSA Conference 2019: Ultrasound Hacked in Two Clicks

SAN FRANCISCO – Researchers have highlighted the endemic insecurity of the hospital environment by executing a proof-of-concept attack on an ultrasound machine. In doing so, they were able to gain access to the machine’s entire database of patient ultrasound images. Check Point Research worked wi...

CVE-2019-9607

PHP Scripts Mall Medical Store Script 3.0.3 allows Path Traversal by navigating to the parent directory of a jpg or png file...

CVE-2019-9607

PHP Scripts Mall Medical Store Script 3.0.3 allows Path Traversal by navigating to the parent directory of a jpg or png file...

Path traversal

PHP Scripts Mall Medical Store Script 3.0.3 allows Path Traversal by navigating to the parent directory of a jpg or png file...

CVE-2019-9607

PHP Scripts Mall Medical Store Script 3.0.3 allows Path Traversal by navigating to the parent directory of a jpg or png file...

CVE-2019-9607

CVE-2019-9607 affects PHP Scripts Mall Medical Store Script 3.0.3 and enables Path Traversal by navigating to the parent directory of a JPG or PNG file. The NVD describes this as a Medium severity issue (CVSS v2 base 5.0; CVSS v3 base 5.3) with network access, low attack complexity, no authentica...

Medical Store Script 3.0.3 Cross Site Scripting

Exploit Title: Medical Store Script 3.0.3 - Cross Site Scripting Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: February 20, 2019 Vendor Homepage: http://www.phpscriptsmall.com/ Software Link : https://www.phpscriptsmall.com/product/medical-store-script/ Teste...

Stryker Medical Beds

1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Public exploits are available Vendor: Stryker Equipment: Secure II MedSurg Bed, S3 MedSurg Bed, and InTouch ICU Bed Vulnerability: Reusing a Nonce 2. RISK EVALUATION Successful exploitation of this vulnerability could allow data traffic manipulation,...