{"id":36469,"date":"2019-09-13T12:10:30","date_gmt":"2019-09-13T04:10:30","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=36469"},"modified":"2019-09-13T12:10:33","modified_gmt":"2019-09-13T04:10:33","slug":"kaspersky-raises-alarm-over-increasing-targeted-attacks-against-pharmaceuticals","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2019\/09\/13\/kaspersky-raises-alarm-over-increasing-targeted-attacks-against-pharmaceuticals\/","title":{"rendered":"Kaspersky raises alarm over increasing targeted attacks against pharmaceuticals"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Global cybersecurity company Kaspersky reveals an alarming trend observed in the pharmaceutical industry \u2013 a year-on-year steady increase on the number of devices being attacked by cybercriminals. From 44% of machines infected in 2017 and a 1% increase in 2018, this year\u2019s number of detected attempts shows that nearly every 5-in-10 devices inside a pharmaceutical facility are now being targeted globally.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Among the countries which logged the most number of attacks are Pakistan (54%), Egypt (53%), Mexico (47%), Indonesia (46%), and Spain (45%). Four more countries from the Asia Pacific region cap off the top 15 nations with the highest percent of devices infected. These include India, Bangladesh, Hong Kong, and Malaysia with more or less 4-in-10 machines with detected malicious attempts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cWhile it is a known fact that money-hungry cybercriminals can easily earn by attacking banks, we also observe that these hackers as well as cyberespionage groups are slowly paying a lot of attention towards the industry of advanced medicine,\u201d says Yury Namestnikov, Head of Global Research and Analysis Team (GReAT) Russia at Kaspersky.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cThey are slowly realizing that pharmaceutical companies house a treasure trove of highly valuable data such as the latest drugs and vaccines, the newest researches, as well as medical secrets. The rise of internet-connected operational technology (OT) inside these pharmaceuticals also contributes to the widening attack surface inside this sector,\u201d comments Namestnikov.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Among the Advanced Persistent Threat (APT) groups which have been waging sophisticated spying over pharmaceuticals globally include Cloud Atlas and APT10 also known as MenuPass.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cBased on our monitoring of several APT actors\u2019 movements in the Asia Pacific and globally, we figured that these groups infect servers and exfiltrate data from pharmaceutical companies. Their attack techniques and behavior also prove that these attackers\u2019 apparent goal is to get their hands on intellectual properties related to the latest medical formulas and research results as well as the business plans of their victims,\u201d adds Namestnikov.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In his own research, Denis Makrushin, Security Architect at Ingram Micro, revealed the risks that come along with the steady migration of hospitals from paper-based data storage to electronic medical record (EMR) systems. Makrushin further notes that healthcare organizations, scrambling to digitize their data storage, see open source EMR web-portals as an easy and quick option, despite their known security challenges.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cWe are seeing lesser printed or hand-written medical books inside hospitals and clinics worldwide with the advent of open source. Given their limited internal IT workforce, healthcare institutions opt to use convenient services such as OpenEMR, OpenMRS or similar web applications. This technology\u2019s rapid adoption triggers the rise of the threats against this widely-used services,\u201d says Makrushin,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">OpenEMR and OpenMRS are open platforms for medical practice management. Any organization can use this product for business without any restrictions. The source code of this product is also available for any developer. In addition, this software has certifications from trusted organizations (for example OpenEMR is ONC Complete Ambulatory HER certified).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cTheir free and open nature make these EMR-applications highly sensitive to cyberattacks. There have been a lot of security patches released as researchers unmask one exploit after another. I, myself, have discovered vulnerabilities in these applications, hackers can inject malicious code at the initial stage of registration, and portray himself as a patient. From this, malicious actors can infect the portal\u2019s page and collect medical information from all users of the portal, including doctors and admins. These data can be easily exfiltrated,\u201d he adds.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To securely use this platform, Makrushin suggests healthcare facilities to:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>&nbsp;Conduct secure software development lifecycle (Secure SDLC)<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li>Regularly perform architecture analysis, conduct penetration testing, security code review on systems being used<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li>\u00a0\u00a0Control the attack surface<ul><li>\u00a0Try to remove all exposure nodes that process medical data<\/li><li>\u00a0\u00a0Periodically update your installed software and remove unwanted applications<\/li><\/ul><\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li>Raise security awareness for every person involved<ul><li>Conduct regular cybersecurity awareness training for all staff and even patients<\/li><\/ul><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Among the countries which logged the most number of attacks are Pakistan (54%), Egypt (53%), Mexico (47%), Indonesia (46%), and Spain (45%). Four more countries from the Asia Pacific region cap off the top 15 nations with the highest percent of devices infected.<\/p>\n","protected":false},"author":6,"featured_media":36470,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[101,54],"class_list":["post-36469","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-headlines","tag-kaspersky","tag-security"],"_links":{"self":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/36469","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/comments?post=36469"}],"version-history":[{"count":0,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/36469\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media\/36470"}],"wp:attachment":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media?parent=36469"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/categories?post=36469"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/tags?post=36469"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}