5 ms·

The lead(lede) is burried in part 2 https://www.protenus.com/blog/a-virtual-goldmine-why-criminals-target-patient-data-part-2 https://www.protenus.com/blog/a-vi

by ch4s3 10y ago

The lead(lede) is burried in part 2 https://www.protenus.com/blog/a-virtual-goldmine-why-criminals-target-patient-data-part-2 https://www.protenus.com/blog/a-virtual-goldmine-why-crimina... the tl;dr is Sell patient info repeatedly on the black market, using the profits to fund other activities Obtain expensive medical equipment, prescriptions, or procedures Commit tax fraud Expose or blackmail specific individuals, such as politicians or celebrities Receive medical care Undergo surgery Purchase or sell prescription or controlled drugs *edit grammar fix

ubernostrum 10y ago
s/lead/lede "Lede" is the newspaper term, "lead" refers to a toxic metal element, or to someone who is followed. Also, the second part basically just says "they sell them, they're worth this much", but doesn't really get into why others are willing to pay that much.
- DanBC 10y ago
  > "Lede" is the newspaper term, "lead" refers to a toxic metal element, or to someone who is followed. If you're going to be pedantic you should at least be correct. Lead here is fine, especially since lede is a neologism. https://www.merriam-webster.com/words-at-play/bury-the-lede-versus-lead https://www.merriam-webster.com/words-at-play/bury-the-lede-... > Although evidence dates the spelling to the 1970s, we didn't enter lede in our dictionaries until 2008. For much of that time, it was mostly kept under wraps as in-house newsroom jargon.
  - tptacek 10y ago
    In fact, lede is a deliberately misspelled version of "lead"; like TK, it exists to be picked easily out of copy without being confused by the real text. So it's especially strange to criticize the use of the word "lead".
- ch4s3 10y ago
  Haha, I always make that mistake when typing. Yeah, I've had this conversation a few times. I think that there are some know reasons for the theft, but the black market for this stuff is pretty opaque. I imagine that if you're in the business of cybercrime, you diversify, and one option is stolen health records.
- pmiller2 10y ago
  "Lead" is also acceptable.[0, 1] -- [0]: https://en.wiktionary.org/wiki/bury_the_lead https://en.wiktionary.org/wiki/bury_the_lead [1]: http://www.yourdictionary.com/bury-the-lead http://www.yourdictionary.com/bury-the-lead
- tedajax 10y ago
  As a daily user of the English language I declare this stupid and will use lead.
  - zeroer 10y ago
    I declare you stupid.
    - sctb 10y ago
      Please don't. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
      - zeroer 10y ago
        Sorry.
MichaelGG 10y ago
Interesting. So an attacker can just get someone's info, then schedule an appointment and pretend to be that person? Seems like this could be blocked just by having the health companies keep a photo on file and verifying it before anything expensive. And are there lots of cases of people stealing ID just to get medical care? That's both sad and pretty interesting. Do they catch a lot of people trying this? Even $1200 for a "kitz" sounds like a great deal given the cost of US medical services. I'd guess there's a fairly low risk of getting caught once you leave the hospital.
- nommm-nommm 10y ago
  Most doctors ask for ID now. Even as recent as 10 years ago that was a rare practice. So, yes, it was possible to get medical services under someone else's name and even possible to execute an illegal adoption that way; I have a cousin (in his 30s now) who was "adopted" like that. My aunt was unable to have children but really wanted them, she also had a minor criminal record and wasn't well off financially so she'd never be able to legally adopt. One of her friends had an unwanted pregnancy. Aunt convinced friend to give birth assuming my aunt's name and my aunt took the baby home.
  - MichaelGG 10y ago
    But if you show the doctor a fake drivers license you're set, right? I mean, the doctor/insurance company isn't verifying your ID against their records.
    - nommm-nommm 10y ago
      >But if you show the doctor a fake drivers license you're set, right? Right. Fake ID and fake insurance card would work just fine.
  - brilliantcode 10y ago
    How is your friend taking the news? I can't imagine the level of sadness at the thought of your own biological birth mother giving you up like that. Freud says they go through their whole life trying to avoid abandonment. I'd imagine the sadness easily turning into some sort of aimless wrath. It's like being told you've lived a lie to save birthgiver's face. Maybe that's what happened to Paul Le Roux when he found out he was not only adopted but that they didn't even bother giving it a name.
tptacek 10y ago
Neither of these articles establish why EHRs are any more valuable than identity information. The same things can be said about any service that stores profiles including SSNs. The article alludes to "medical" abuses of stolen EHRs, but doesn't explain how these abuses rely on anything more than identity information. I'm left skeptical, especially because the author has something to sell.
- csours 10y ago
  How about this: Medical offices have poor infosec practices. There are many small doctors offices where the doctor is the executive. A vendor will convince the doctor that their suite of software and hardware will solve all of their problems. The doctor buys the package, and because they believed the vendor, they don't do anything more about security. Then the doctor finds that the package doesn't work with X supplier or whatever, so the doc buys another package from another vendor, but keeps the old stuff. The surface area is large and fertile. So it's not necessarily that EHRs are particularly valuable, but that they are particularly available.
- PeterisP 10y ago
  There's no need to make a point that EHRs are somehow any more valuable than identity information - being a common source of identity information is sufficient to get targeted, especially as all the other sources of identity data are (slowly) hardening their systems and processes. "any service that stores profiles including SSNs" isn't a particularly wide qualifier. The narrow domain of such services have had a long history in learning how to do that properly, and there really aren't any major new domains that are just starting to have stores of data that's useful for identity theft but weren't electronically available before - except EHRs, which are useful to current criminals, are just recently made electronic, and are poorly secured since this problem is new for them.
ch4s3 10y ago
In the new today: "Greenway Health Reports Criminal Cyber Attack Affecting Certain Customers"[1] [1]https://www.greenwayhealth.com/press-releases/greenway-health-reports-criminal-cyber-attack-affecting-certain-customers/ https://www.greenwayhealth.com/press-releases/greenway-healt...

by ch4s3 10y ago

ubernostrum 10y ago

s/lead/lede "Lede" is the newspaper term, "lead" refers to a toxic metal element, or to someone who is followed. Also, the second part basically just says "they sell them, they're worth this much", but doesn't really get into why others are willing to pay that much.

DanBC 10y ago
> "Lede" is the newspaper term, "lead" refers to a toxic metal element, or to someone who is followed. If you're going to be pedantic you should at least be correct. Lead here is fine, especially since lede is a neologism. https://www.merriam-webster.com/words-at-play/bury-the-lede-versus-lead https://www.merriam-webster.com/words-at-play/bury-the-lede-... > Although evidence dates the spelling to the 1970s, we didn't enter lede in our dictionaries until 2008. For much of that time, it was mostly kept under wraps as in-house newsroom jargon.
- tptacek 10y ago
  In fact, lede is a deliberately misspelled version of "lead"; like TK, it exists to be picked easily out of copy without being confused by the real text. So it's especially strange to criticize the use of the word "lead".
ch4s3 10y ago
Haha, I always make that mistake when typing. Yeah, I've had this conversation a few times. I think that there are some know reasons for the theft, but the black market for this stuff is pretty opaque. I imagine that if you're in the business of cybercrime, you diversify, and one option is stolen health records.
pmiller2 10y ago
"Lead" is also acceptable.[0, 1] -- [0]: https://en.wiktionary.org/wiki/bury_the_lead https://en.wiktionary.org/wiki/bury_the_lead [1]: http://www.yourdictionary.com/bury-the-lead http://www.yourdictionary.com/bury-the-lead
tedajax 10y ago
As a daily user of the English language I declare this stupid and will use lead.
- zeroer 10y ago
  I declare you stupid.
  - sctb 10y ago
    Please don't. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
    - zeroer 10y ago
      Sorry.

MichaelGG 10y ago

Interesting. So an attacker can just get someone's info, then schedule an appointment and pretend to be that person? Seems like this could be blocked just by having the health companies keep a photo on file and verifying it before anything expensive. And are there lots of cases of people stealing ID just to get medical care? That's both sad and pretty interesting. Do they catch a lot of people trying this? Even $1200 for a "kitz" sounds like a great deal given the cost of US medical services. I'd guess there's a fairly low risk of getting caught once you leave the hospital.

nommm-nommm 10y ago
Most doctors ask for ID now. Even as recent as 10 years ago that was a rare practice. So, yes, it was possible to get medical services under someone else's name and even possible to execute an illegal adoption that way; I have a cousin (in his 30s now) who was "adopted" like that. My aunt was unable to have children but really wanted them, she also had a minor criminal record and wasn't well off financially so she'd never be able to legally adopt. One of her friends had an unwanted pregnancy. Aunt convinced friend to give birth assuming my aunt's name and my aunt took the baby home.
- MichaelGG 10y ago
  But if you show the doctor a fake drivers license you're set, right? I mean, the doctor/insurance company isn't verifying your ID against their records.
  - nommm-nommm 10y ago
    >But if you show the doctor a fake drivers license you're set, right? Right. Fake ID and fake insurance card would work just fine.
- brilliantcode 10y ago
  How is your friend taking the news? I can't imagine the level of sadness at the thought of your own biological birth mother giving you up like that. Freud says they go through their whole life trying to avoid abandonment. I'd imagine the sadness easily turning into some sort of aimless wrath. It's like being told you've lived a lie to save birthgiver's face. Maybe that's what happened to Paul Le Roux when he found out he was not only adopted but that they didn't even bother giving it a name.

tptacek 10y ago

Neither of these articles establish why EHRs are any more valuable than identity information. The same things can be said about any service that stores profiles including SSNs. The article alludes to "medical" abuses of stolen EHRs, but doesn't explain how these abuses rely on anything more than identity information. I'm left skeptical, especially because the author has something to sell.

csours 10y ago
How about this: Medical offices have poor infosec practices. There are many small doctors offices where the doctor is the executive. A vendor will convince the doctor that their suite of software and hardware will solve all of their problems. The doctor buys the package, and because they believed the vendor, they don't do anything more about security. Then the doctor finds that the package doesn't work with X supplier or whatever, so the doc buys another package from another vendor, but keeps the old stuff. The surface area is large and fertile. So it's not necessarily that EHRs are particularly valuable, but that they are particularly available.
PeterisP 10y ago
There's no need to make a point that EHRs are somehow any more valuable than identity information - being a common source of identity information is sufficient to get targeted, especially as all the other sources of identity data are (slowly) hardening their systems and processes. "any service that stores profiles including SSNs" isn't a particularly wide qualifier. The narrow domain of such services have had a long history in learning how to do that properly, and there really aren't any major new domains that are just starting to have stores of data that's useful for identity theft but weren't electronically available before - except EHRs, which are useful to current criminals, are just recently made electronic, and are poorly secured since this problem is new for them.

ch4s3 10y ago

In the new today: "Greenway Health Reports Criminal Cyber Attack Affecting Certain Customers"[1] [1]https://www.greenwayhealth.com/press-releases/greenway-health-reports-criminal-cyber-attack-affecting-certain-customers/ https://www.greenwayhealth.com/press-releases/greenway-healt...