5 ms·

This is seriously concerning and requires a response from Microsoft. People use O365 for healthcare/HIPAA data and Microsoft signs a BAA for this use

tptacek 4y ago
I seriously doubt this will cause HIPAA problems.
- throwoutway 4y ago
  > Since Micosoft has no plans to fix this vulnerability the only migiration is to avoid using Microsoft Office 365 Message Encryption. Should clinicians just ignore this or should they demand a response?
  - tptacek 4y ago
    Clinicians will certainly just ignore this.
    - throwoutway 4y ago
      Of course they will, but I said “should” not “would” for a reason
infamouscow 4y ago
Having worked in healthcare tech for over a decade, it's extremely common for healthcare facilities to send medical records over fax. HIPAA and BAAs are for lawyers to argue about after your medical records has been exposed, and if attempts to remedy the situation deteriorate.
- ealexhudson 4y ago
  You're allowed to assume the phone network is not being eavesdropped, you're not allowed to assume that for Internet transmission. Whether that's true or not, that's the accepted position. If this encryption genuinely allows structural data retrieval - eg common invoice templates or medical reports - then this is absolutely a HIPAA problem, and once a facility is made aware of it they would need to respond. FWIW, this message encryption is also accepted by UK NHS, in fact it's virtually the standard. The mitigating factor is that typically the user is fully authenticated before being allowed to access the encrypted data...
  - tomnipotent 4y ago
    Explain to me how this is a bigger risk than just physical burglary and stealing a computer with encrypted drives? The effort required to MITM and take advantage of this exploit is considerably more costly and time-consuming than just breaking into a building. AS OP mentioned, this is not about assumptions but laws and their interpretation during consideration in a court of law.
autoexec 4y ago
The amount of sensitive data Microsoft must be collecting from all manner of organizations is insane. As far as I can tell companies just don't care at all about the data they leak to third parties anymore. They seem to either trust that they'll know when that data is abused or leaked or that they can lawyer their way out of being responsible for any fallout. It must be an endless gold mine for MS though to have that level of insight into what damn near every corporation is involved in.
comprambler 4y ago
Not really, the current method of secure Microsoft “email” via Exchange Online is receiving a message that you have “secure mail”. You then have to click on a link to view the message stored on a webserver behind SAML/LDAP auth with a username/password hopefully provided by offline methods. Usually best if behind corp vpn, but that is going away now. Sounds spammy, but this is industry norm from personal experience on Ironport and Exchange. Downside is the spam imitations of this that are likely quite successful at phishing creds from corporate users.

tptacek 4y ago

I seriously doubt this will cause HIPAA problems.

throwoutway 4y ago
> Since Micosoft has no plans to fix this vulnerability the only migiration is to avoid using Microsoft Office 365 Message Encryption. Should clinicians just ignore this or should they demand a response?
- tptacek 4y ago
  Clinicians will certainly just ignore this.
  - throwoutway 4y ago
    Of course they will, but I said “should” not “would” for a reason

infamouscow 4y ago

Having worked in healthcare tech for over a decade, it's extremely common for healthcare facilities to send medical records over fax. HIPAA and BAAs are for lawyers to argue about after your medical records has been exposed, and if attempts to remedy the situation deteriorate.

ealexhudson 4y ago
You're allowed to assume the phone network is not being eavesdropped, you're not allowed to assume that for Internet transmission. Whether that's true or not, that's the accepted position. If this encryption genuinely allows structural data retrieval - eg common invoice templates or medical reports - then this is absolutely a HIPAA problem, and once a facility is made aware of it they would need to respond. FWIW, this message encryption is also accepted by UK NHS, in fact it's virtually the standard. The mitigating factor is that typically the user is fully authenticated before being allowed to access the encrypted data...
- tomnipotent 4y ago
  Explain to me how this is a bigger risk than just physical burglary and stealing a computer with encrypted drives? The effort required to MITM and take advantage of this exploit is considerably more costly and time-consuming than just breaking into a building. AS OP mentioned, this is not about assumptions but laws and their interpretation during consideration in a court of law.

autoexec 4y ago

The amount of sensitive data Microsoft must be collecting from all manner of organizations is insane. As far as I can tell companies just don't care at all about the data they leak to third parties anymore. They seem to either trust that they'll know when that data is abused or leaked or that they can lawyer their way out of being responsible for any fallout. It must be an endless gold mine for MS though to have that level of insight into what damn near every corporation is involved in.

comprambler 4y ago

Not really, the current method of secure Microsoft “email” via Exchange Online is receiving a message that you have “secure mail”. You then have to click on a link to view the message stored on a webserver behind SAML/LDAP auth with a username/password hopefully provided by offline methods. Usually best if behind corp vpn, but that is going away now. Sounds spammy, but this is industry norm from personal experience on Ironport and Exchange. Downside is the spam imitations of this that are likely quite successful at phishing creds from corporate users.