4 ms·

Change Healthcare hackers used stolen credentials and no MFA, says UHG CEO

15 points by skilled 2y ago

skilled 2y ago
Related, Hackers Broke into Change Healthcare's Systems 9 Days Before Cyberattack (https://news.ycombinator.com/item?id=40127483 https://news.ycombinator.com/item?id=40127483) - Apr 2024 (27 comments) BlackCat ransomware group implodes after apparent payment by Change Healthcare (https://news.ycombinator.com/item?id=39610846 https://news.ycombinator.com/item?id=39610846) - Mar 2024 (162 comments) UnitedHealth says Change hackers stole health data on ‘substantial proportion of people in America’ (https://techcrunch.com/2024/04/22/unitedhealth-change-healthcare-hackers-substantial-proportion-americans/ https://techcrunch.com/2024/04/22/unitedhealth-change-health...)
peteradio 2y ago
The title is not correct. They used credentials to get access to the vpn. How they moved laterally is obviously the interesting part anyway. Change the title, it gives cover to the lumbering behemoth that fault might lie anywhere besides UnitedHealths corrupt IT.
- skilled 2y ago
  You are correct. I made a mistake with the title, it should say that access was acquired through a Citrix account without MFA as opposed to a direct Citrix bug. My bad. I will email mods to change it. This Reuters[0] article is much more specific about saying it was a Citrix vulnerability, but since Citrix has not issued an official statement, it's better to have it changed to the default title. [0]: https://www.reuters.com/technology/cybersecurity/unitedhealth-hackers-took-advantage-citrix-vulnerabilty-break-ceo-says-2024-04-29/ https://www.reuters.com/technology/cybersecurity/unitedhealt...
- dang 2y ago
  Fixed now. Thanks! (Submitted title was "UnitedHealth hackers exploited Citrix bug, CEO says")
- SkyPuncher 2y ago
  How they moved laterally was likely trivial. Every place that I seen with a VPN tends to trust everything within the VPN.
  - blackmesaind 2y ago
    Check the network share for a folder called "Passwords"
toomuchtodo 2y ago
Mandate MFA/passkeys/crypto primitives using regulatory mechanisms.
- Terr_ 2y ago
  * And no lame half-measures involving code-by-SMS or code-by-email.
  - deleted 2y ago
    [deleted]
  - readthenotes1 2y ago
    I have relatives with a small business whose Verizon phones were allegedly taken over and then used code by SMS to get into a bunch of other things. And then Verizon allegedly allowed it to happen again a few days later after they had thought the original phones/sims shut down
alephnerd 2y ago
Screw Change Healthcare. I had the misfortune of dealing with them once as a vendor years ago. Horrible DevSecOps culture due to penny pinching.
- deleted 2y ago
  [deleted]
deleted 2y ago
[deleted]

15 points by skilled 2y ago

Related, Hackers Broke into Change Healthcare's Systems 9 Days Before Cyberattack (https://news.ycombinator.com/item?id=40127483 https://news.ycombinator.com/item?id=40127483) - Apr 2024 (27 comments) BlackCat ransomware group implodes after apparent payment by Change Healthcare (https://news.ycombinator.com/item?id=39610846 https://news.ycombinator.com/item?id=39610846) - Mar 2024 (162 comments) UnitedHealth says Change hackers stole health data on ‘substantial proportion of people in America’ (https://techcrunch.com/2024/04/22/unitedhealth-change-healthcare-hackers-substantial-proportion-americans/ https://techcrunch.com/2024/04/22/unitedhealth-change-health...)

peteradio 2y ago

The title is not correct. They used credentials to get access to the vpn. How they moved laterally is obviously the interesting part anyway. Change the title, it gives cover to the lumbering behemoth that fault might lie anywhere besides UnitedHealths corrupt IT.

skilled 2y ago
You are correct. I made a mistake with the title, it should say that access was acquired through a Citrix account without MFA as opposed to a direct Citrix bug. My bad. I will email mods to change it. This Reuters[0] article is much more specific about saying it was a Citrix vulnerability, but since Citrix has not issued an official statement, it's better to have it changed to the default title. [0]: https://www.reuters.com/technology/cybersecurity/unitedhealth-hackers-took-advantage-citrix-vulnerabilty-break-ceo-says-2024-04-29/ https://www.reuters.com/technology/cybersecurity/unitedhealt...
dang 2y ago
Fixed now. Thanks! (Submitted title was "UnitedHealth hackers exploited Citrix bug, CEO says")
SkyPuncher 2y ago
How they moved laterally was likely trivial. Every place that I seen with a VPN tends to trust everything within the VPN.
- blackmesaind 2y ago
  Check the network share for a folder called "Passwords"

toomuchtodo 2y ago

Mandate MFA/passkeys/crypto primitives using regulatory mechanisms.

Terr_ 2y ago
* And no lame half-measures involving code-by-SMS or code-by-email.
- deleted 2y ago
  [deleted]
- readthenotes1 2y ago
  I have relatives with a small business whose Verizon phones were allegedly taken over and then used code by SMS to get into a bunch of other things. And then Verizon allegedly allowed it to happen again a few days later after they had thought the original phones/sims shut down

alephnerd 2y ago

Screw Change Healthcare. I had the misfortune of dealing with them once as a vendor years ago. Horrible DevSecOps culture due to penny pinching.

deleted 2y ago
[deleted]

deleted 2y ago

[deleted]