Slashdot Log In
Break-In Compromises 160k Medical Records At UC Berkeley
Posted by
timothy
on Tue May 12, 2009 11:57 AM
from the no-ivy-league-nudes-on-file-at-berkeley dept.
from the no-ivy-league-nudes-on-file-at-berkeley dept.
nandemoari writes "Hackers have reportedly infiltrated restricted computer databases at the University of California Berkeley, putting the private data of 160,000 students, alumni, and others at risk. According to UC Berkeley, computer administrators determined on April 9, 2009 that electronic databases in University Health Services had been breached by overseas criminals. The breakins began in October 2008. Information contained on the breached databases included Social Security numbers, health insurance information, and non-treatment medical information such as records of immunization and names of treating physicians."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Duh.. (Score:3, Insightful)
Re:Duh.. (Score:4, Funny)
Parent
Re:Duh.. (Score:5, Interesting)
I don't give them to insurance people, I don't give them to Dr.'s or medical institutions, or even utilities (cable, phone). etc). I don't give it out to hardly anyone. Sometimes it is a fight, but, very seldom has it happened, that when I was going to walk away from the transaction, did they not cave and say "ok".
The next battle, as I understand it, will be trying to sign up for an iPhone without giving an SSN. I've heard it can be done, but, sometimes take a number of tries before finding the salesperson/mrg that will do it.
Parent
Re:Duh.. (Score:5, Informative)
The next battle, as I understand it, will be trying to sign up for an iPhone without giving an SSN. I've heard it can be done, but, sometimes take a number of tries before finding the salesperson/mrg that will do it.
It's got to do with a credit check. You need to surrender your SSN for the normal credit check, and they use the results to determine your deposit. Very few companies will do an alternate (less informative/reliable) check that does not require your ssn.
Without the credit check, you can still get a phone, 100% of the time. You will just have to pay a very large deposit, the largest possible for people that have horrible credit. Anyone that tells you that your ssn is required to get an iPhone is out of touch with reality.
This is true of any of the places that are not authorized by law to require your ssn. So same applies to the others that are often brought up, such as utilities, and pretty much always applies to calculation of a deposit or interest rate.
Parent
Re: (Score:2)
Auditing Logs (Score:5, Insightful)
Part of my daily duties as a systems administrator was auditing connection logs for odd behavior. Don't admins do that anymore?
Re: (Score:2)
Part of my daily duties as a systems administrator was auditing connection logs for odd behavior. Don't admins do that anymore?
This is a bit of a dilemma, if the systems administrator and the hacker are one in the same person.
Re: (Score:3, Insightful)
That's only reserved for a select few sites.
Odd behavior is sometimes hard to distinguish from normal behavior, so you can't get everything. And in some cases the traffic volume is so large that it's not feasible to try to catch behavior patterns because the deed may be over at the time the analysis has finished.
And then - many systems today lacks necessary logs and may even lack logs completely. That's all too common in those cost-pressed projects. Even if there is a log it's often incomprehensible unless
Re:Auditing Logs (Score:5, Insightful)
Most "Systems Administrators" are people like me, who know enough to keep a wide variety of systems functioning, with little or no training, and are expected to spend a great deal of time and energy keeping the systems functioning ... all by themselves. The scope of responsibility of many of these "System Administrators" spans much further than auditing logs.
I only WISH I had the time to audit logs, and make corrective actions. But our staff has 6000 PCs and three dozen (or more) servers that we have to keep running.
Administration doesn't care about hackers until it is too late. They don't care about computers or keeping them running, until they are without. It is like all those people bitching and complaining when they don't have electricity for a day after a storm. They don't care what it takes to keep the juice flowing until it isn't.
The old saying "don't fix it, if it ain't broke" runs many IT Depts.
Parent
Re: (Score:3, Informative)
Part of my daily duties as a systems administrator was auditing connection logs for odd behavior. Don't admins do that anymore?
A lot of that is left up to parsing scripts, interns, or just ignored. Plus, "Odd" is relative. If one of your people is overseas in China, and his VPN account logs in from China IPs at odd times of the day, it could be normal. Until it logs in twice at the same time or after he comes home, you won't notice.
Brutal (Score:5, Insightful)
This is why a national requirement for EMR systems isn't a good idea right now. The staffers that have to take care of this (in light of recent events in Virginia) are getting hung out to dry either because they don't have the training, or the budget, or both to pull this of safely.
This will always be an argument against EMR systems - How much harder is it to break into someone's office or a hospital and rip off *everyone's* data. Sure, you could break in, steal a few and then torch the building... But which is worse? Missing your medical history or having all that personal identifiable information in the hands of credit thieves? And in the break in scenario, there's less stolen data. You're not walking out of a medial building with 160K charts... Or 8 Million in VA.
Re: (Score:2, Insightful)
how is this interesting ? (Score:2)
I totally agree
"This is why a national requirement for EMR systems isn't a good idea right now. The staffers that have to take care of this (in light of recent events in Virginia) are getting hung out to dry either because they don't have the training, or the budget, or both to pull this of safely"
Look, all it takes is to implement systems that are as secure as possible
Re:how is this interesting ? (Score:5, Interesting)
The most dangerous opening to a statement involving security is "All it takes..." I've had to manage an EMR system. I've had to deal with the security aspect. I also had to do it fresh out of college.
And if you think that having one target for all this information makes it more secure? I have to totally disagree. I've worked with plenty of folks who have ties or worked for the government. They're exactly who I'm talking about when I say "lack of training, or budget, or both." You could audit everything you want, but if you don't know what to look for, or you're not watching the audit logs, it doesn't matter what you've got in place. I've taken a look at logs of an intrusion, and I've seen at least one case where the success happened because the attacker was already armed with data. First attempt succeeded cause they had a valid username/password... Someone else's.
You can't foolproof a public facing system... You can't geniusproof it either. There will be a compromise, it's just a matter of how small you can make it.
Parent
Re: (Score:2, Funny)
Re: (Score:2)
But which is worse? Missing your medical history or having all that personal identifiable information in the hands of credit thieves?
Assuming that it _must_ be an either-or scenario, I'd rather have my medical history on port 80 open to the world. Sure, there'd be some (a lot of) abuses, but at least my doctors would know my medical history in an emergency or in case I get some long-term condition.
Re: (Score:2)
And I'd rather have mine not on port 80 at all. It should be at least port 443, and better yet, on some seriously secured interface where accessing that data requires some sort of transaction ID, and pre-auth with the data holder.
Furthermore - In that scenario, if I was in an emergency, I'd rather have the freaking hospital *call* the my doctor's office directly to make sure my "history" is correct.
Has anyone ever wondered how people are supposed to verify the accuracy of these records?
Re: (Score:3, Insightful)
But which is worse? Missing your medical history or having all that personal identifiable information in the hands of credit thieves?
Stand the problem on its ear: what if this information were worthless to credit thieves? What if this information simply was no longer able to wreck someone's life?
What we should do instead is make the paradigm of "name, address, SSN, etc.", valueless. Figure out a way to issue credit that wasn't strictly information based. One way would be to make the banks stop issuing credit by mail. If you physically had to walk into a secure building, and present credentials to someone trained to review them, c
Re: (Score:2)
You sir, are addressing this from a much better angle. The biggest reason EMRs are so valuable is because of the non-health information kept with them.
I personally don't care if the entire world knows I had knee surgery. In cases where someone had heart surgery, it's likely that they don't want a life insurer or health insurer to know... but they'll know anyway since that's their business. AFAIC - If our EMRs are not valuable to anyone outside the health industry, then I have no problem with them being p
This is a huge, everyday, constant problem. (Score:5, Interesting)
Re: (Score:3, Insightful)
Maybe we should stop making SSNs the end all be all of who we are.
Re: (Score:2)
Or we should quit using an identifier as a password.
Old Story (Score:5, Informative)
http://www.wired.com/threatlevel/2009/05/uc-berkeley-suffers-breach-of-student-health-data/ [wired.com]
The email informing students of the breach was sent on May 8th. It was all over the news last Friday.
Re: (Score:2, Informative)
Re: (Score:3, Informative)
Here is the text of the email that was send out to the Berkeley community.
Re: (Score:2)
> Slashdot editors posting stories that are days old? Never!
Evidently, this is the exception that proves the rule.
Normally, they wait until a story is a month or two old, but someone screwed up and posted it before its time.
Re: (Score:2)
> Slashdot editors posting stories that are days old? Never!
Evidently, this is the exception that proves the rule.
Normally, they wait until a story is a month or two old, but someone screwed up and posted it before its time.
Don't worry, someone will post a dupe of it about the time it's due.
Time to live in secrecy (Score:3, Interesting)
Between this hacking job, and the stolen records from the Virginia health services, and who knows how many other attacks, I'm thinking it might be a good idea to live "in secret" without any computer-based accounts of any kind. No bank accounts, no stock accounts, no credit cards other than maybe just one.
If you don't have these accounts, you won't be vulnerable to monetary or identity theft.
Re: (Score:2, Insightful)
And... (Score:2, Insightful)
Re: (Score:2, Informative)
Re: (Score:2, Insightful)
Re: (Score:2, Interesting)
I once read an article about a "right" way to secure data. Even the authors admitted it wasn't foolproof but there point was, it was a lot more secure than what most people are using.
Every externally-facing computer was on its own sub-network, mostly isolated from everything else. Web sites, ftp sites, even wireless access points. They didn't have any sensitive data on them though. If they needed data, they requested it from data servers, which were in a very locked-down partition.
Portions of the "corpor
Sometimes you need an air gap (Score:5, Insightful)
It's not just military-grade information that needs protecting.
If medical and financial information were warehoused in a way that required a "man in the middle" to approve a request, it might not prevent spear-fishing, and it might not prevent theft of "in use" data, but it would at least prevent wholesale data breaches from information warehouses.
With a man-in-the-middle, you'd need to bribe or blackmail the man in the middle to allow a larger number of access requests to get through.
For some systems, a man in the middle is overkill, alarms that trigger when there are more than a typical number of data requests is sufficient. However, automated alarms, like any automated system, can theoretically be compromised.
Re: (Score:3, Insightful)
So when you go to the emergency room, how is the hospital supposed to query your electronic medical records at your family doctor when it's behind an air gap?
Maybe they aren't. Re:Sometimes you nee (Score:2, Insightful)
If it's current, like allergies, summaries of chronic conditions that affect emergency and urgent health-care conditions, current prescription drugs you are taking, the names and pager numbers of your current doctors, and a current certification that you have current medical insurance that covers emergency and urgent care will probably be considered "current" and not "warehoused." These will be available 24/7, to both care-givers and to criminals who manage to compromise the system the data is stored in.
Ho
'computers' hacked .. (Score:2)
Break-in free zone signs (Score:5, Funny)
The folks at Berkeley need to put up some "this room is a break-in free zone" signs so there are no more break-ins.
Why is this news? (Score:2)
160,000 students records compromised (Score:2)
Re: (Score:2)
Who could benefit from this medical info? (Score:5, Interesting)
Re: (Score:2, Informative)
When will it be illegal to store/lose this data? (Score:4, Interesting)
privacy? what privacy? (Score:5, Funny)
So? It's not like there's any expectation of privacy. If the govt isn't expected to respect anyone's privacy, then surely one can't expect it of criminals.
I wish that were funny.
Re: (Score:3, Insightful)
Did they get into the system with intricate knowledge of computer systems or did they brute force and crack a password or other encryption scheme?
(bad) Hacker may be an appropriate term. Just as there are probably (good) hackers probably trying to figure out who did this.
Re:Hackers or Crackers? (Score:4, Funny)
Just because they're on the internet doesn't mean they're white.
Parent
Re:Hackers or Crackers? (Score:5, Insightful)
If they're infiltrating with malicious intent, I don't think 'hacker' is the proper term here...
Yeesh, give it a rest. Evil computer infiltrator is the predominately accepted definition for Hacker these days. No one calling you a Geek today thinks you bite the heads off small animals. In fact, Geek's etymology stems back to an old English word for "Fool", whereas today it means a smart, unliked person (although it's starting to lose the "unliked" portion of its definition with the rise of the ubiquitous computer culture). I predict in 20-40 years, "Hacker" will be synonymous with "Con-man" as more "crackers" shift into social engineering either in person or via email/IM...
</feeding the troll>
Parent
Re: (Score:2)
Man if only they were using OpenBSD... That would've been so... much.... ummm....
Re: (Score:2)