Gary McGraw on Scalable Software Security and Medical Device Security

Dennis Fisher talks to Gary McGraw about the challenges of scaling software security programs, the FTC’s security programs, and the current push for better security in medical devices. Download: digitalunderground220.mp3 Music by Chris Gonsalves...

Health Insurer Excellus Hacked; 10.5 Million Records Breached

Health Care Hacks — the choice of hackers this year! In a delayed revelation made by Excellus BlueCross BlueShield BCBS, which says that about 10.5 Millions of their clients' data and information has been compromised by hackers. Excellus BCBS headquartered in Rochester, New York, provides finance...

GE Healthcare Discovery NM 750b Trust Management Vulnerability

The GE Healthcare Discovery NM 750b is a high-end molecular breast imaging device from General Electric GE for the healthcare industry. A security vulnerability exists in the GE Healthcare Discovery NM 750b that stems from the use of '2getin' as a password for the Telnet and FTP insite accounts. ...

Medical Website Design SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title : Medical Website Design SQL Injection Vulnerability Exploit Author : Ashiyane Digital Security Team Vendor Homepage : http://www.medicalpracticewebsitedesign.com/ Google Dork : "Medical Practice Website Design" inurl:.php?newsid...

Many Drug Pumps Open to Variety of Security Flaws

In April, a security researcher disclosed a litany of severe vulnerabilities in the PCA3 drug-infusion pump manufactured by a company named Hospira. He went so far as to call the pump “the least secure IP enabled device I’ve ever touched in my life.” As it turns out, those same vulnerabilities...

Researchers, IEEE Release Medical Device Security Guidelines

A collection of research scientists, with help from the IEEE Cybersecurity Initiative, have released a new set of guidelines for developers to take into account to ensure security figures into how medical devices are coded. The paper, “Building Code for Medical Device Software Security,” .PDF was...

Vulnerability-Riddled Drug Pumps Open to Takeover

One medical device company’s line of drug pumps is so fraught with vulnerabilities that the researcher that discovered the flaws claims the pump is the least secure IP-enabled device he’s ever come across. Certain versions of Hospira’s Lifecare PCA3 Drug Infusion pumps are susceptible to multiple...

openEMR 4.2.0 Cross Site Scripting / SQL Injection

Advisory: Multiple reflecting/stored XSS- and SQLi-vulnerabilities in openEMR v.4.2.0 Advisory ID: SROEADV-2015-08 Author: Steffen Rösemann Affected Software: openEMR v.4.2.0 Release-date: 28th Dec 2014 Vendor URL: http://www.open-emr.org Vendor Status: patched CVE-ID: to be assigned after releas...

Anthem Hack May Implicate 18 Million Non-Customers

In addition to roughly 80 million Anthem customers, nearly 20 million more individuals who aren’t customers of the health insurer could ultimately wind up implicated in this month’s massive data breach. The company disclosed yesterday that between 8.8 million and 18.8 million Blue Cross Blue Shie...

Anthem Data Breach — 6 Things You Need To Know

The Nation’s second largest Health insurer company, Anthem, alerted its customers on Wednesday that hackers had stolen the personal information of over 80 Millions of its customers, making it the largest data breach and double the number of payment cards affected by Target data breach occurred in...

OpenMRS 2.1 Access Bypass / XSS / CSRF

Exploit Title: OpenMRS 2.1 Standalone version Multiple Security Vulnerabilities Date: 20/10/2014 Remote: Yes Exploit Author: Mahendra Vendor Homepage: http://openmrs.org Software Link: http://sourceforge.net/projects/openmrs/files/releases/OpenMRS2.1/openmrs-2.1-standalone.zip/download Version: 2...

Information disclosure

The MedQuiz: Medical Chat and MCQs aka com.pdevsmedd.med application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6713

Summary : The MedQuiz: Medical Chat and MCQs (com.pdevsmedd.med) Android app, version 1.5, does not verify X.509 certificates for SSL servers. This allows MITM attackers to spoof servers and exfiltrate sensitive information via a crafted certificate. Documented impacts include partial confidentia...

Chinese Groups Found Targeting Govt, Military Systems

Two Chinese cyber espionage campaigns are working in tandem in hopes of sniffing out trade secrets from surrounding nations. Researchers from FireEye outlined information about the two attack groups yesterday in advance of a more comprehensive report. One of the groups, Moafree, operates out of t...

Community Health Systems APT Data Breach Medical Espionage

At first blush, the Community Health Systems data breach by Chinese hackers seems to be an anomaly. State-sponsored attackers generally target intellectual property for the purposes of military or economic gain; stealing healthcare credentials and personal patient records seems incongruous. But...

Podcast: Black Hat News Wrap, Day Two

Dennis Fisher, Mike Mimoso and Brian Donohue discuss the news from day two of Black Hat, including a CryptoLocker working group, a medical device security and privacy roundtable and overview of the various security and privacy improvements at Yahoo over the last year. Image via Black Hat USA 2014...

Connected Medical Devices Increase Risk and Safety

LAS VEGAS – A few years ago the media was inundated with reports that former Vice President Dick Cheney had his pacemaker removed and replaced with a custom, presumably less connected one. The assumed reason for that procedure was to minimize the risk Cheney is exposed to in a world where it is...

CareFusion Pyxis SupplyStation System Vulnerabilities

OVERVIEW Independent researcher Billy Rios identified authentication vulnerabilities in CareFusion’s Pyxis SupplyStation system. CareFusion has implemented additional controls to mitigate some of these vulnerabilities in the SupplyStation system. Some of the reported vulnerabilities could be...

OpenEMR Electronic Medical Record Software 3.2 - Multiple Vulnerabilities

No description provided by source. Redspin Security Notice -- RSN-2010-01 Multiple vulnerabilities in OpenEMR Electronic Medical Record Software Overview ---------------- Quote from http://www.oemr.org/ OpenEMR is a free medical practice management, electronic medical records, prescription writin...

McKesson ActiveX File/Environmental Variable Enumeration

No description provided by source. html !-- McKesson ActiveX File/Environmental Variable Enumeration Vendor: McKesson Version: 11.0.10.38 Tested on: Windows XP SP3 / IE Download: N/A Author: Blake Additional Details: This activex control is packaged with the Horizon Rad Station software used by...