5 ms·

2,000 NHS Security Vulnerabilities Disclosed

107 points by edent 13y ago

jloughry 13y ago
Under current U.S. law, I would be extremely hesitant to publish anything like this. How different is U.K. law on the subject?
- sentenza 13y ago
  I don't know what the situation in the UK is, but it is probably safe to say that, while possibly legally in the right, such a publication is risky in most jurisdictions. Personally, what I'd do in such a situation is to contact a well-renowned hacker organization with experience in these matters (as for instance the CCC here in Germany) and ask for their assistance. Alternatively, a tech publishing company could also be the right choice, preferably one with a legal department and experience in these things. He mentions that you should buy the issue of "Computer Active" that contains this article, so he probably took this route.
  - edent 13y ago
    Indeed, I worked with James Temperton - https://twitter.com/jtemperton https://twitter.com/jtemperton - an InfoSec journalist before publishing. I also gave the DoH ample opportunity to fix the sites or shut them down. I agree that there is a (minor) risk - but offset against hundreds of high profile sites being exploited, I think it's worthwhile.
- edent 13y ago
  The Computer Misuse Act is fairly strict - but in this case we haven't accessed anything without permission, nor altered any data. We spoke to the overall owner of the sites and they did not object to myself or the magazine publishing this information.
  - jloughry 13y ago
    We spoke to the overall owner of the sites and they did not object to myself or the magazine publishing this information. That's...astonishing.
    - edent 13y ago
      We're slightly less litigious this side of the pond... :-)
      - polymatter 13y ago
        I'm UKian and I'm astonished. Having worked in the UK Civil Service, sounds to me the person making this decision didn't know what it meant and that it was an actual security issue. Probably they thought it was sort of idly interesting, like speculating how many office computers are still beige. Not that you were listing sites with trusted nhs.uk domains that appear to be easy to hack.
        edent 13y ago
        I can assure you that we made it abundantly clear how bad the problem was - including sending link, screenshots, etc. Had phone calls with them where they did sound genuinely concerned. Sadly, it didn't transform into action.
  - danielweber 13y ago
    I saw a screenshot of an XSS injection. You don't know that you haven't altered data. You think you haven't, but you don't know it. I congratulate you for talking to the owners before publication, however.
  - buro9 13y ago
    > We spoke to the overall owner of the sites What do you mean by this? In the article you state: > in many cases there is simply no way to contact the website owners Do you simply refer to the owner of the parent domain name?
SilkRoadie 13y ago
Ignoring some of the obvious conversation points. As a developer I like posts like this and find them very useful. Information like this demonstrating ways to discover exploits should be more common knowledge. I feel currently attackers have the advantage over developers. More posts like this where security is an open topic can only lead to more secure websites going forward.
jloughry 13y ago
In the 17th century, John Wilkins wrote of his reasons for full disclosure: If it be feared that this Discourse may unhappily advantage others in such unlawful Courses; ’tis considerable, that it does not only teach how to deceive, but consequently also how to discover Delusions. but even then he knew there were liability risks that go along with information security research: ...the chiefe experiments are of such nature, that they cannot be frequently practised, without just cause of suspicion, when it is in the Magistrates power to prevent them.
iamsalman 13y ago
There are currently no financial penalties if a website is compromised as long as the data store which has PHIs (Personal Health Information) is encrypted and the encryption keys are also safe. However, any compromised NHS website would lead to bad publicity and insecurity.
- Silhouette 13y ago
  However, any compromised NHS website would lead to bad publicity and insecurity. And horrendous scope for phishing. Who's going to think twice about entering potentially sensitive information into their GP's web site accessed via a .nhs.uk address? Not most people, I suspect.
  - _delirium 13y ago
    I would guess that's an issue even without the nhs.uk address, unfortunately. American doctors' websites don't have an 'official' domain they're under, but some people send information via their local doctor's website anyway. So if you compromise the Wordpress install (and it's likely that thousands of American doctors have a vulnerable Wordpress install) you could pull in some potentially sensitive information. The main mitigating factor in the U.S. would be that so much stuff is still done on paper and over the phone that many people wouldn't visit the site in the first place. Like the NHS, American doctors usually don't store actual patient data on the generic CMS they use for hosting the website. If they have an online "patient portal" or "billing portal" it's usually a hosted solution that goes offsite, via a third-party company that provides such services. But it's nonetheless a huge phishing opportunity. Besides a fake contact form, you could also clone the portals, replacing the links from the main site, which are supposed to go off to places like medfusion.net or eclinicalweb.com, with ones that go off to medfusion.yourdomain.net or whatever, and most people will not think twice as long as your cloned site looks vaguely similar. I mean the genuine domains sound halfway like the domains of phishing sites to begin with...
    - jloughry 13y ago
      I've noticed a disturbing trend lately of physicians' office portals connecting silently to credit reporting agencies and using information from there for authentication. While I applaud them for trying to reliably authenticate me when I sign in to get blood test results, it's disconcerting to be faced with questions like this: Which of the following cars have you NOT owned? - 1999 Ford Explorer - 2001 Toyota Tercel - 2008 Audi - 1996 Hyundai Along with a few more questions like that one, it's a dead give-away that my doctor's office is connected to a credit reporting agency. I have seen this happening in other places as well; evidently credit reporting agencies recently got into the business of on-line identification and authentication (I&A).
grey-area 13y ago
It is worth pointing out that the majority of these sites do not store patient data or any privileged information, they are informational brochure type sites for surgeries to show their operning hours or specific health awareness campaigns, hence the lack of interest in centralising or updating them. They could be hacked and defaced I suppose, which wouldn't look so great for the NHS, but they won't be running on NHS servers or controlled by NHS IT. The XSS issue is a real one, and they should probably not allow subdomains of nhs.uk to be used for gp surgeries (the most likely to have terrible websites as they buy them in themselves). Patient data is typically held in secure systems like emis etc. run by one of a few large firms which have contracts with the NHS, so not on this sort of informational website.
- piqufoh 13y ago
  So if I set up a fake 'contact us' form asking for patient data on a surgery's nhs.uk domain using XSS that would be ok then?
  - grey-area 13y ago
    GP sites don't typically ask for patient data (and should not, given the budget they are purchased on), they're usually sites with opening times, a few paras about the GPs etc - if they do ask for patient data it would be by giving a link to a booking system off-site typically, I'm sure you could find an exception, but most of them are fairly harmless. The sites are not exclusively https either - anyone handling patient data should be, that's also a serious flaw if you're going to start talking about sensitive data being transferred. I'm not sure that surgeries would ever be able to adequately protect patient data on their own sites, so they mostly use externally purchased systems and the NHS provided IT for handling that (from what I know second hand from people in the NHS, I don't work there) - those are separate systems from their brochure websites, which are typically bought from and hosted at some low-budget shop which churns out WP/drupal/PHP sites for £100 a pop and would hopefully have the sense to advise surgeries never to collect private patient data on their website. The biggest problem here is that these sites have no business being subdomains of nhs.uk, and should be on something else like gp.uk or whatever, and the NHS should make it crystal clear that no patient data touches an informational site (to patients and GPs). It's either that or they need to set up a secure CMS which all GPs/Hospitals can use for their brochure sites, but that's likely to be a big budget project and is of questionable value. You could say the same of most hospital websites - they will not be secure as they are fire-walled from the actual patient data, and thus it is less of a priority to keep them secure. Sure it's not nice if they are hacked, but it is not as important as what happens to patient data.
sp332 13y ago
The coral cache of the page seems to be working http://shkspr.mobi.nyud.net/blog/2014/03/2000-nhs-security-vulnerabilities-disclosed/ http://shkspr.mobi.nyud.net/blog/2014/03/2000-nhs-security-v...
oneiroi 13y ago
So the article focuses on out of date wordpress installations, I really think the NHS has wider security implications given the recent admission of uploading their ENTIRE patient database onto googles servers for ease of deriving statistics ... (http://www.theguardian.com/society/2014/mar/03/nhs-england-patient-data-google-servers http://www.theguardian.com/society/2014/mar/03/nhs-england-p...) Regarding hesitation of posting the information in the blog post; the author appears to have losely followed responsible disclosure methods attempting remediation with the NHS directly before publishing the findings. NHS, HMRC etc the information security of these organizations is lax at best, and down right horrifying, without full disclosure forcing their hand I don't see any change. This is why full disclosure / responsible disclosure formed in the first place.
- edent 13y ago
  It doesn't. I wrote a whole section on non-WordPress vulnerabilities. But, yes, patient facing sites aren't quite as critical as some of the backend stuff. I spent the last two months trying to contact the people responsible. When I finally did, they said they wouldn't / couldn't do anything :-/
Silhouette 13y ago
As an aside, it's a shame about the political snipe partway through this piece. It might have been a useful citation to give for those of us planning to write to our MPs in light of the recent disclosures, but I imagine making an overtly political statement like that would seriously damage its credibility.
- robk 13y ago
  So frustrating it takes this political tone. It's not helpful in the least to label the administration "corrupt" and then expect to be taken seriously. It's not a partisan problem but an institutional one.

107 points by edent 13y ago

Under current U.S. law, I would be extremely hesitant to publish anything like this. How different is U.K. law on the subject?

sentenza 13y ago
I don't know what the situation in the UK is, but it is probably safe to say that, while possibly legally in the right, such a publication is risky in most jurisdictions. Personally, what I'd do in such a situation is to contact a well-renowned hacker organization with experience in these matters (as for instance the CCC here in Germany) and ask for their assistance. Alternatively, a tech publishing company could also be the right choice, preferably one with a legal department and experience in these things. He mentions that you should buy the issue of "Computer Active" that contains this article, so he probably took this route.
- edent 13y ago
  Indeed, I worked with James Temperton - https://twitter.com/jtemperton https://twitter.com/jtemperton - an InfoSec journalist before publishing. I also gave the DoH ample opportunity to fix the sites or shut them down. I agree that there is a (minor) risk - but offset against hundreds of high profile sites being exploited, I think it's worthwhile.
edent 13y ago
The Computer Misuse Act is fairly strict - but in this case we haven't accessed anything without permission, nor altered any data. We spoke to the overall owner of the sites and they did not object to myself or the magazine publishing this information.
- jloughry 13y ago
  We spoke to the overall owner of the sites and they did not object to myself or the magazine publishing this information. That's...astonishing.
  - edent 13y ago
    We're slightly less litigious this side of the pond... :-)
    - polymatter 13y ago
      I'm UKian and I'm astonished. Having worked in the UK Civil Service, sounds to me the person making this decision didn't know what it meant and that it was an actual security issue. Probably they thought it was sort of idly interesting, like speculating how many office computers are still beige. Not that you were listing sites with trusted nhs.uk domains that appear to be easy to hack.
      - edent 13y ago
        I can assure you that we made it abundantly clear how bad the problem was - including sending link, screenshots, etc. Had phone calls with them where they did sound genuinely concerned. Sadly, it didn't transform into action.
- danielweber 13y ago
  I saw a screenshot of an XSS injection. You don't know that you haven't altered data. You think you haven't, but you don't know it. I congratulate you for talking to the owners before publication, however.
- buro9 13y ago
  > We spoke to the overall owner of the sites What do you mean by this? In the article you state: > in many cases there is simply no way to contact the website owners Do you simply refer to the owner of the parent domain name?

SilkRoadie 13y ago

Ignoring some of the obvious conversation points. As a developer I like posts like this and find them very useful. Information like this demonstrating ways to discover exploits should be more common knowledge. I feel currently attackers have the advantage over developers. More posts like this where security is an open topic can only lead to more secure websites going forward.

jloughry 13y ago

In the 17th century, John Wilkins wrote of his reasons for full disclosure: If it be feared that this Discourse may unhappily advantage others in such unlawful Courses; ’tis considerable, that it does not only teach how to deceive, but consequently also how to discover Delusions. but even then he knew there were liability risks that go along with information security research: ...the chiefe experiments are of such nature, that they cannot be frequently practised, without just cause of suspicion, when it is in the Magistrates power to prevent them.

iamsalman 13y ago

There are currently no financial penalties if a website is compromised as long as the data store which has PHIs (Personal Health Information) is encrypted and the encryption keys are also safe. However, any compromised NHS website would lead to bad publicity and insecurity.

Silhouette 13y ago
However, any compromised NHS website would lead to bad publicity and insecurity. And horrendous scope for phishing. Who's going to think twice about entering potentially sensitive information into their GP's web site accessed via a .nhs.uk address? Not most people, I suspect.
- _delirium 13y ago
  I would guess that's an issue even without the nhs.uk address, unfortunately. American doctors' websites don't have an 'official' domain they're under, but some people send information via their local doctor's website anyway. So if you compromise the Wordpress install (and it's likely that thousands of American doctors have a vulnerable Wordpress install) you could pull in some potentially sensitive information. The main mitigating factor in the U.S. would be that so much stuff is still done on paper and over the phone that many people wouldn't visit the site in the first place. Like the NHS, American doctors usually don't store actual patient data on the generic CMS they use for hosting the website. If they have an online "patient portal" or "billing portal" it's usually a hosted solution that goes offsite, via a third-party company that provides such services. But it's nonetheless a huge phishing opportunity. Besides a fake contact form, you could also clone the portals, replacing the links from the main site, which are supposed to go off to places like medfusion.net or eclinicalweb.com, with ones that go off to medfusion.yourdomain.net or whatever, and most people will not think twice as long as your cloned site looks vaguely similar. I mean the genuine domains sound halfway like the domains of phishing sites to begin with...
  - jloughry 13y ago
    I've noticed a disturbing trend lately of physicians' office portals connecting silently to credit reporting agencies and using information from there for authentication. While I applaud them for trying to reliably authenticate me when I sign in to get blood test results, it's disconcerting to be faced with questions like this: Which of the following cars have you NOT owned? - 1999 Ford Explorer - 2001 Toyota Tercel - 2008 Audi - 1996 Hyundai Along with a few more questions like that one, it's a dead give-away that my doctor's office is connected to a credit reporting agency. I have seen this happening in other places as well; evidently credit reporting agencies recently got into the business of on-line identification and authentication (I&A).

grey-area 13y ago

It is worth pointing out that the majority of these sites do not store patient data or any privileged information, they are informational brochure type sites for surgeries to show their operning hours or specific health awareness campaigns, hence the lack of interest in centralising or updating them. They could be hacked and defaced I suppose, which wouldn't look so great for the NHS, but they won't be running on NHS servers or controlled by NHS IT. The XSS issue is a real one, and they should probably not allow subdomains of nhs.uk to be used for gp surgeries (the most likely to have terrible websites as they buy them in themselves). Patient data is typically held in secure systems like emis etc. run by one of a few large firms which have contracts with the NHS, so not on this sort of informational website.

piqufoh 13y ago
So if I set up a fake 'contact us' form asking for patient data on a surgery's nhs.uk domain using XSS that would be ok then?
- grey-area 13y ago
  GP sites don't typically ask for patient data (and should not, given the budget they are purchased on), they're usually sites with opening times, a few paras about the GPs etc - if they do ask for patient data it would be by giving a link to a booking system off-site typically, I'm sure you could find an exception, but most of them are fairly harmless. The sites are not exclusively https either - anyone handling patient data should be, that's also a serious flaw if you're going to start talking about sensitive data being transferred. I'm not sure that surgeries would ever be able to adequately protect patient data on their own sites, so they mostly use externally purchased systems and the NHS provided IT for handling that (from what I know second hand from people in the NHS, I don't work there) - those are separate systems from their brochure websites, which are typically bought from and hosted at some low-budget shop which churns out WP/drupal/PHP sites for £100 a pop and would hopefully have the sense to advise surgeries never to collect private patient data on their website. The biggest problem here is that these sites have no business being subdomains of nhs.uk, and should be on something else like gp.uk or whatever, and the NHS should make it crystal clear that no patient data touches an informational site (to patients and GPs). It's either that or they need to set up a secure CMS which all GPs/Hospitals can use for their brochure sites, but that's likely to be a big budget project and is of questionable value. You could say the same of most hospital websites - they will not be secure as they are fire-walled from the actual patient data, and thus it is less of a priority to keep them secure. Sure it's not nice if they are hacked, but it is not as important as what happens to patient data.

sp332 13y ago

The coral cache of the page seems to be working http://shkspr.mobi.nyud.net/blog/2014/03/2000-nhs-security-vulnerabilities-disclosed/ http://shkspr.mobi.nyud.net/blog/2014/03/2000-nhs-security-v...

oneiroi 13y ago

So the article focuses on out of date wordpress installations, I really think the NHS has wider security implications given the recent admission of uploading their ENTIRE patient database onto googles servers for ease of deriving statistics ... (http://www.theguardian.com/society/2014/mar/03/nhs-england-patient-data-google-servers http://www.theguardian.com/society/2014/mar/03/nhs-england-p...) Regarding hesitation of posting the information in the blog post; the author appears to have losely followed responsible disclosure methods attempting remediation with the NHS directly before publishing the findings. NHS, HMRC etc the information security of these organizations is lax at best, and down right horrifying, without full disclosure forcing their hand I don't see any change. This is why full disclosure / responsible disclosure formed in the first place.

edent 13y ago
It doesn't. I wrote a whole section on non-WordPress vulnerabilities. But, yes, patient facing sites aren't quite as critical as some of the backend stuff. I spent the last two months trying to contact the people responsible. When I finally did, they said they wouldn't / couldn't do anything :-/

Silhouette 13y ago

As an aside, it's a shame about the political snipe partway through this piece. It might have been a useful citation to give for those of us planning to write to our MPs in light of the recent disclosures, but I imagine making an overtly political statement like that would seriously damage its credibility.

robk 13y ago
So frustrating it takes this political tone. It's not helpful in the least to label the administration "corrupt" and then expect to be taken seriously. It's not a partisan problem but an institutional one.