Change Healthcare Says February Breach Affects 100 Million People; Hospitals are Using AI Transcription Tools that Hallucinate; Older Adults Struggle with Technology in Healthcare

In a recent updated filing with US Department of Health and Human Services Office for Civil Rights (HHS OCR), Change Healthcare now estimates the number of individuals affected by the February 2024 breach to be 100 million. HHS OCR has published an updated FAQ about the breach. The new statistics make the Change Healthcare incident the largest healthcare breach on record.

Read more in

When OpenAI introduced their transcription tool, Whisper, in 2022, they claimed it 'approache[d] human level robustness and accuracy.' However, the tool in fact is prone to hallucinations and a ChatGPT-generated description of Whisper recommends against the tool being used in 'high-risk domains.' Despite the warning, healthcare organizations are using Whisper; software engineers, developers, and researchers found high levels of inaccurate chunks of text and even entirely false sentences in Whisper-generated AI transcriptions they examined.

Read more in

According to the University of Michigan National Poll on Health Aging, nearly three-quarters of adults over the age of 50 say they would not trust AI-generated health information. Overall, 20 percent of those responding said they had 'little or no confidence' in their ability to identify health misinformation.

Read more in

The US Copyright Office has granted a partial Digital Millennium Copyright Act (DMCA) exemption 'allowing for repair of retail-level food preparation equipment.' The exemption was requested by Public Knowledge, a consumer advocacy group, along with iFixit. The original, broader request sought 'to expand the repair exemption for consumer electronic devices to include commercial industrial equipment such as automated building management systems and industrial equipment (i.e. soft serve ice cream machines and other industrial kitchen equipment).' The Copyright Office considered a total of seven proposed classes for exemption and granted all but one: a request regarding the preservation of video games.

Read more in

Russian courts sentenced members of the REvil gang to prison terms for hacking and money laundering. The group is best known for 2021 attacks on meat-packing company JBS and IT services firm Kaseya. Members of the REvil team were arrested in 2022 with cooperation from US law enforcement.

Read more in

The Software Engineering Institute's (SEI) Computer Emergency Response Team Coordination Center (CERT/CC) following up on disclosure by independent researcher "fj016" and SSD Secure Disclosure, has released an advisory describing a command injection vulnerability in the Wi-Fi Alliance's Test Suite tool. Using "specially crafted packets," an attacker could gain root privileges and execute code, posing particular risk to any "commercial router deployments" where the Wi-Fi Test Suite is not meant to be used. The vulnerable code is found on the Arcadyan FMIMG51AX000J model device. There is no patch from the manufacturer; CERT/CC recommends the Wi-Fi Test Suite be updated to at least version 9.0 or removed entirely.

Read more in

Amazon Web Services' (AWS) Cloud Development Kit (CDK) has been vulnerable to S3 bucket "namesquatting," according to researchers at Aqua, which could lead to many security issues including "full account takeover." Aqua's research was published on October 24, 2024 and details their communication with AWS after reporting the flaw in June, 2024. An S3 staging bucket is created as part of the CDK bootstrapping process, and named using an easily predictable and exploitable naming system, which creates a vulnerability: "Criminals could predict AWS S3 bucket names, pre-load malicious code into a bucket, and then sit back and wait for the target org to execute it unwittingly. Once that happened, the attackers could steal data, or even take over a user's account without them knowing." Aqua notes "there's no way to know if the vulnerability, which doesn't have an associated CVE number, has been exploited in the wild." Amazon has patched the issue and notified customers, and Aqua suggests updating and re-running the boostrap command, or applying an "IAM policy condition ... similar to the AWS patch."

Read more in

Beginning at the Black Hat conference in August, 2024, and in subsequently released research, SafeBreach's Alon Leviev has demonstrated a Windows vulnerability he calls Windows Downdate, in which an attacker with administrative privileges can bypass Driver Signature Enforcement and downgrade the OS kernel, drivers, DLLS, and other components, allowing rootkit installation on a completely up-to-date machine. In some cases, virtualization-based security (VBS) can also be bypassed or disabled if no "mandatory" flag is set with UEFI lock. Leviev stated: "I was able to make a fully patched Windows machine susceptible to past vulnerabilities, turning fixed vulnerabilities unfixed and making the term 'fully patched' meaningless on any Windows machine in the world." While Microsoft at first stated that this issue "did not cross a defined security boundary," the company has since created a "revocation policy mitigation" for CVE-2024-21302 (Windows Secure Kernel Mode Elevation of Privilege Vulnerability), and patched CVE-2024-38202 (Windows Update Stack Elevation of Privilege Vulnerability), though some systems may require additional action.

Read more in

After finalizing three encryption algorithms in August, 2024, all designed to withstand quantum computing attacks, the National Institute of Science and Technology (NIST) has continued to seek variety in its Post-Quantum Cryptography (PQC) standards. "While several non-lattice-based KEMs remained under consideration in the fourth round, no signature schemes remained," and from a selection of 40, now 14 candidates comprise a second evaluation round of "additional [digital] signatures" open for comments and tweaks, only one of which is lattice-based. NIST predicts quantum computing will be employed in attacks on encryption within ten years.

Read more in

The Dutch National Police (Politie) say they have obtained 'full access' to servers used by the Redline and Meta infostealers, both of which operate as malware-as-a-service. Operation Magnus, which involved law enforcement agencies from the US, the UK, Portugal, Australia, and EuroJust (the European Union Agency for Criminal Justice Cooperation), 'gained access to the Redline and Meta source code, including the license servers, REST API servers, panels, stealers, and Telegram bots.' The operation also turned up information that could be helpful in identifying people who used the malware.

Read more in