Do Huawei and ZTE present security threats to the US and global communications networks? The FCC says yes.

July 1, 2020 | by

In two little-noted decisions formally announced yesterday (30 June), the Federal Communications Commission (FCC) banned the funding by the FCC Universal Service Fund (USF) of the purchase or use of equipment or services provided by China’s Huawei and ZTE. The USF funds rural internet, Lifeline for low-income consumers, Indian Tribal initiatives, schools and libraries, and the Rural Health Care program–a substantial part of the national network which will also discourage private companies from use of their equipment as Verizon, Sprint, et al participate in these programs.

Both Huawei and ZTE have been found by the US government–and many others–to be extensively tied to the Chinese government and military, obligating these two companies to permit their systems to be used for espionage, plus numerous known cybersecurity risks and vulnerabilities in their equipment. Other national governments have felt likewise including the UK, which is reevaluating its former permission for their participation in the 5G rollout. FCC release, Huawei order, ZTE order, ZDNet (UK)

FCC approves 70 more COVID-19 telehealth funding applications for an additional $32 million

July 1, 2020 | by

The US Federal Communications Commission (FCC) today (1 July) approved 70 additional applications for funding telehealth during the COVID-19 pandemic. This funding covers both urban and rural providers, from large health systems to local community health centers. The funds for this thirteenth group totals $31.63 million of the $189.27 million in total funds awarded. To date, the FCC’s COVID-19 Telehealth Program, authorized by the CARES Act, has approved 514 funding applications in 46 states plus Washington, D.C. Equipment covered includes telehealth, computers, smartphones, tablets, remote patient monitoring equipment, and software.

A small sample of this group of healthcare organizations:

  •  Avera Health, South Dakota
  • Barnabas Health in NJ for remote patient monitoring equipment
  • Boston Children’s Hospital
  • Greater Philadelphia Health Action
  • Lehigh Valley Health Network in Allentown PA
  • Montefiore Medical Center in the Bronx, NY
  • Ryan Health in Manhattan
  • University of Alabama at Birmingham Hospital
  • UPMC in Harrisburg PA

FCC release. Full list of Telehealth Program recipients here.

Hackermania runs wild…all the way to the bank! Ransomware strikes Crozer-Keystone, UCSF med school, others

July 1, 2020 | by

News to make you livid. After surviving (to date) the COVID pandemic, health systems and medical schools are being attacked by ransomware criminals. Both the small Crozer-Keystone Health System and the globally known University of California San Francisco School of Medicine have been attacked by the ever-so cutely named Netwalker (a/k/a MailTo). Yes, this criminal hacker gang isn’t outside banging pots for first responders or donating money, or even sticking to a brief truce (Emsisoft), but figuring ways to spread malware into healthcare organizations for fun and profit. 

And profitable it’s been. UCSF paid Netwalker the princely sum of $1.14 million (£910,000) in 116.4 bitcoins after an attack starting 1 June that was also (to add insult to injury) published on Netwalker’s public blog. In the timeline presented by BBC News, it was negotiated down (professionally) from $3 million; BBC also obtained some key parts of the negotiation via an anonymous tipoff, and it’s fascinating reading. Netwalker leads the victim to a dark web ‘customer service’ site where there’s a countdown to double payment or deletion of your now-encrypted data. They are also able to live chat with the victim.

UCSF was able to limit the malware encryption damage to servers within the School of Medicine (according to the BBC, literally unplugging computers; according to UCSF, isolating servers) but decided to pay the ransom to unlock the encrypted data and return data they obtained, stating in its public release “The data that was encrypted is important to some of the academic work we pursue as a university serving the public good”. They will work with the FBI on the incident and have brought on board outside expert help.

According to FierceHealthcare, Netwalker was also behind the attack on the Champaign-Urbana Public Health District (Illinois) website in March and Michigan State University’s network in May.

Paying ransom is contrary to the advice of the major world security services such as the FBI, Europol, and the UK’s National Cyber Security Centre, on the simple basis that it encourages them. It’s a true damned-if-you-do, damned-if-you-don’t situation, as Brett Callow, a threat analyst at cyber-security company Emsisoft, said to the BBC: “But why would a ruthless criminal enterprise delete data that it may be able to further monetise at a later date?” 

Crozer-Keystone to date has refused to pay ransom. On 19 June, bitcoin publication Cointelegraph published a screenshot of Netwalker’s dark web auction page of the data. Apparently it is all financial and not medical records or PHI. Crozer also isolated the intrusion and took systems offline. Crozer is a small system of four hospitals in suburban Philadelphia (Delaware County) and serves parts of the state of Delaware and western New Jersey.

Neither Crozer nor UCSF have gone public with the source of the breach, but it is known that the main lure during the pandemic has been phishing emails with COVID-19 results or news, loaded with malware downloads.

As this Editor wrote back in May 2018 on the anniversary of WannaCry, it’s not a matter of if, but when, at highly vulnerable organizations like healthcare and academia with high-value information records. Right now, the Hakbit spear-phishing ransomware connected to an Excel spreadsheet macro is targeting mid-level individuals at pharma, healthcare, and other sectors in Austria, Germany, and Switzerland, according to tech research firm Proofpoint. TechGenix

More: Becker’s 22 June on Crozer-Keystone, 29 June on UCSF, 12 largest healthcare breaches to date, 10 healthcare system incidents for June, Kroger hacking incident exposing 11,000 health records. DataBreaches.net news page.