Hackers threaten to leak plastic surgery pictures

https://www.bbc.co.uk/news/technology-55439190

by g_p • 6 years ago

173 151 6 years ago

bbc.co.uk

pstrateman• 6 years ago

Why would you even keep these on anything but archive media??

arkitaip• 6 years ago

Because they are lazy, incompetent and indifferent. But they might be against a very powerful and public group of people who can sue them out of existence, so maybe that will scare other health providers into better security practices.

adkadskhj• 6 years ago

Maybe. Sounds like their incentive will be primarily to keep _some_ records more safe. Eg i'm skeptical that this would propagate to poor people, without legislation at least.

(which isn't to say that they'd purposefully choose two different implementations. Rather, just that if i'm using poor person doctors i'm unsure they'd rise to the new "standard" of security practices)

sidlls• 6 years ago

You hinted at it but didn't mention it explicitly: greedy. It simply costs more to have somewhat better security practices, and they don't want to pay unless they have to.

EvanAnderson• 6 years ago

Why does everybody keep data hanging around forever? It's easier. You don't have to think about it. Just keep kicking the files onto new media every few years / at a new server refresh.

I did some IT work for a plastic surgery practice in the US many years ago. I was adding some storage to an existing server. I was shocked to see that the practice was keeping all their before / after photos online going back years. Not encrypted. Hanging out in Windows file shares with lax permissions.

It certainly gave me pause.

Maybe some software providers in this space will think about handling this better.

g_p6• 6 years ago

It seems that Windows SMB file sharing is still the go-to universal storage system in a lot of organisations. I imagine because it's built in, easy to configure, and works out the box with the ability to map drives so it's transparent to users.

In contast, anything more secure tends to add inherent friction (since just blindly giving access due to some potentially replayed hash of a user's likely weak password isn't exactly going to be appropriate in a secure setup). And if it adds complexity, people still go for the old solution.

I hope they had backups - I've often caught out the same Windows SMB-using orgs out when checking their backups and discovering both of their weekly-cycled drives are empty and devoid of backups, despite having been diligently swapped out according to the schedule!

Aeronwen• 6 years ago

"I'm a doctor, not a computer security expert, Jim!"

nwatson• 6 years ago

Why does a software engineer keep old git-repo branches around, including their history? The engineer can compare the before-and-after especially as they relate to experiments, successful, and failed approaches.

A plastic surgeon might want to look at before-and-after for a few of their "branches" (specific plastic surgeries or repeated applications of a technique). "When I did celebrity-A I notice they sag too much in location-X, whereas for celebrity-B where I changed the procedure location-X looks much better." "Celebrity-P has the same odd nose Celebrity-K had ... let me consult my notes and the before/after for Celebrity-K."

zimpenfish2• 6 years ago

Perhaps they bring them out to show people who are considering the same surgeries but haven't yet comitted?

(Although I'd hope they obscure identifying details and get permission from the original patients...)

tompazourek6• 6 years ago

The patient can come for a checkup or a related thing and they want to be able to easily retrieve these if they want to check something (or in case there's an issue of sorts). Having it all in a single system is the easiest way to do that.

elliekelly2• 6 years ago

I didn’t let my plastic surgeon take before and after photos for this exact reason. I asked him whether it was necessary for the procedure and what they were used for and he couldn’t really give me an answer beyond it’s nice to be able to compare the finished product. So I told him when I came back in for my post-op I’d be more than happy to pull up a before picture on my phone for him to use to admire his work. I even let him take the “before” photo on my phone. I’m sure he thought I was a paranoid tinfoil hat type but he really didn’t seem to mind.

MeinBlutIstBlau2• 6 years ago

This is one of the rare pieces of advice few people get. You can tell the professional in the room "Your idea is stupid and I as a paying customer do not want that." It's amazing how many people concede to the request.

The only place I can't get away with it is a dentist. They love giving x-rays...because apparently that helps with scaling.

Triv888• 6 years ago

Its like when I went for a broken tooth... The dentist insisted on a panoramic xray of my head/jaw... Then he came back and said: yep you have a broken/chipped tooth... And the funny thing is that he protected my chest from the xray with a lead cover but not my brain... And the tooth broke because it was repaired from a previous cavity

reiderrider• 6 years ago

Do hacker groups have positive track records of not sharing their stolen data? It’s ironic to pay and then rely on trusting them.

Miner49er2• 6 years ago

Yes, otherwise people would stop paying them. However, I wouldn't be surprised if once they make enough money, they do a type of exit scam: sell anything they can, then leave the business. It happens often in dark net markets.

ryanlol3• 6 years ago

Most stolen data is very hard to sell for meaningful amounts. Such an “exit scam” would be a waste of time, you’d make more money by just ransoming one more company.

When you’re earning (tens of) millions by extorting companies you aren’t going to be very interested in selling their data for tens or hundreds of thousands.

wolco2• 6 years ago

Yes even if you don't pay because unless revenge is part of the target attacking you they just wastes time with no gain.

hprotagonist• 6 years ago

Paging King Roland of Druidia...

Timpy2• 6 years ago

The Hospital Group, which has a long list of celebrity endorsements, has confirmed the ransomware attack.

This isn't a ransomware attack, they're not encrypting the company's drives and demanding a ransom to unencrypt them. Not every "I hacked you now pay me or bad things happen" situation is ransomware.

bigbubba5• 6 years ago

They're not using cryptography, but aren't they demanding ransom? Is the use of cryptography an essential part of what it means for something to be ransomware, or is it merely a common implementation detail?

derivagral• 6 years ago

To me, ransomware attacks are specifically "the malware got in and turned all my data to mush; the attacker doesn't care about my data, just that I'll pay to un-mush it."

This is "the malware got in and sent copies back home; now home base is threatening release and expecting payment to prevent it." To me, this is blackmail done via hacking, not ransomware.

flyGuyOnTheSly2• 6 years ago

They are demanding a ransom, but Ransomware has a commonly accepted definition which requires encrypting files and demanding payment to decrypt them. [0]

[0] https://en.wikipedia.org/wiki/Ransomware

curryst• 6 years ago

They're not using cryptography, but aren't they demanding ransom?

No, a ransom is a fee paid for the release of something you value. Cryptography is one way to take a user's data, and release it back to them on payment.

This is blackmail. They want payment to not release something.

heavyset_go2• 6 years ago

It's blackmail.

jMyles• 6 years ago

Ransom usually means, "I have some(one|thing) of yours, and if you want it back, you need to pay me."

Calling this "randomware" subtly blurs the line between copying and stealing. The attackers here didn't remove access to the data (clearly stealing), they made a copy (clearly a crime other than stealing, at least in my view).

It's more like blackmail than kidnapping.

throw14082020• 6 years ago

Timpy :P, your understanding of Ransomware is different to Wikipedias:

Ransomware is a type of malware from cryptovirology that threatens to publish the victim's data or perpetually block access to it unless a ransom is paid.

Timpy2• 6 years ago

If this is the definition of ransomware then I was indeed incorrect. I understood ransomware to be "threatens to perpetually block access to data" only.

threatofrain• 6 years ago

If somebody breaks into a psychiatrist's office and threatens the release of embarrassing or sensitive data unless there's payment, isn't that just classic blackmail?

jahewson• 6 years ago

Extortionware would be appropriate.

smarx007• 6 years ago

What you are talking about are cryptolockers and they are a subset of ransomware. Not all ransomware are cryptolockers. In this case, ransomware exfilled the data without a need for cryptolockers. They are still asking for a ransom.

fabianhjr3• 6 years ago

What always amazes me is that credit card data is almost always safe since VISA/MasterCard and others have very stringent security requirements. (PCI DSS)

There are some regulations regarding medical data (Eg, HIPAA) but security seems like an afterthought in most hospitals at best.

hahamrfunnyguy• 6 years ago

I've done work in the medical industry, both for hospitals and private software companies developing medical software. In my experience; security, stability and compliance with HIPAA and other regulations are taken very seriously.

speedgoose• 6 years ago

Same. And we have external audits and experts checking what we do.

xxs2• 6 years ago

That's UK, no HIPPA per se. Funny enough, the infamous GDPR applies and data leaks are quite punishable.

The Hospital Group is in a quite bad position: 1) the blackmail, in no definition that's ransom. 2) The data leak has to be reported and potentially they will get fined by the state.

As for taking regulation seriously, I guess it does depend on the industry. Where I work GDPR and regulatory breaches are treated more seriously than downtime.

Bukhmanizer• 6 years ago

In my experience HIPAA is taken very seriously in the sense that people are willing to have meetings about HIPAA, with furrowed brows and serious expressions and a lot of signatures. Are the actual end-products more secure? No probably not. Of course this probably varies drastically from place to place.

fabianhjr3• 6 years ago

There are plenty of reports of hospitals using out-of-support Windows versions (95-XP) with known vulnerabilities on _networked connected_ devices. ( https://nakedsecurity.sophos.com/2020/02/20/nearly-half-of-h... )

On the parent comment I am not saying that hospitals aren't HIPPA compliant but rather that the security expectations of credit card data are higher than medical data.

OminousWeapons2• 6 years ago

Securing payments is much simpler than securing medical data in many ways because payment processors are centralized entities with established protocols for data transmission, where communication is largely many (vendors) to one or few (the processors), and where only one type of data is being moved. Health care organizations are HIGHLY decentralized entities where authentication is extremely difficult; where orgs employ many different protocols and software stacks; where many different types of data need to move freely between many orgs, with various levels of sophistication, in many different directions (patient to provider, provider to patient, provider to provider, provider to payer, payer to provider, patient to payer, payer to payer, provider to regulator, provider to researcher, provider to vendor, etc), with few established standards for how that is done (paper, phone, email, web application, fax, API, snail mail, CD, hard drive, USB, etc), with many people having access; and where organizations need to be porous, with high turnover by design. It should also be realized that a failure to access payment data or process a payment results in lost business and headaches. A failure to access medical data may kill someone, so tradeoffs between confidentiality and availability are much more nuanced.

jrumbut• 6 years ago

This is an amazing summary of the problem and why it remains a problem.

542458• 6 years ago

Good comment, especially WRT trade off between confidentiality and availability. Nonetheless, I do feel that many of these items (few standards, little interchange, often old tech, data decentralization) are primarily problems because the vendors and hospitals don’t really have strong incentive to solve them. I do appreciate that the problem is non-trivial, but I don’t think that the problem would be unsolvable should the appropriate incentives be put into place.

radicalbyte• 6 years ago

In the medical world you have standards (HL7, DICOM, XDS) which are all about throwing large amounts of data around hospital networks (and in the case of XDS - outside). It's a castle with moat model of security - everything within the network is trusted and they focus on keeping the bad guys out.

Obviously that's a horrible strategy and it delivers the expected results..

tidepod12• 6 years ago

I've worked as a security consultant for healthcare companies for years. The HIPAA Security Rule is a joke. The HIPAA Security Rule requirements are extremely basic things like "users must have their own login username rather than sharing an account" or "data should be encrypted where appropriate" (and it's left up to the company to decide where they think is "appropriate". There's also zero requirements around the type of encryption or implementation around it.. you could use a Caesar cipher and probably pass a HIPAA audit).

Yes, as the other commenter mentioned, hospitals do "take it seriously" in the sense that they put a lot of importance on passing HIPAA audits... but passing a HIPAA security audit is a checkbox exercise for security controls that are a decade+ outdated. It means absolutely nothing about an organization's actual security maturity.

cratermoon3• 6 years ago

Can confirm. Even the getting the ISO27001 certification is mostly about checking boxes. In many cases an ISO27001 item can be satisfied by picking one of several ways that standard gives to claim it's not relevant.

sargun2• 6 years ago

My favorite anecdote from working in health care was a VP asking if we could use—-trust OpenSSL, because it wasn’t version 1.0, and it was 0.9.8, and instead should we license an encryption product.

Godel_unicode2• 6 years ago

Let's not go letting credit card processors off the hook, this was barely a month ago. Part of our security team is essentially full-time on dealing with the consequences of actors using stolen credit cards.

https://www.forbes.com/sites/billhardekopf/2020/11/13/this-w...

fabianhjr3• 6 years ago

From that article:

security researchers from Website Planet found that Cloud Hospitality stored information from more than 10 million travelers on an unsecured database with no password protection.

That will be taken by credit card companies as gross negligence and breach of contract (they include PCI DSS compliance on all contracts and a requirement that they do the same for anyone that processes credit card data for them) plus anyone going the legal route (and indeed there are reports of a class action that mention PCI DSS compliance explicitly)

My original comment was more in regards the care and security that is expected.

viraptor2• 6 years ago

PCI is far from good requirements. Some of their controls make sense, some made sense for corps in the 90s and some are completely opposite to what you should do. It's good that they at least force the company to think of the requirements and dedicate some time to it. But I really wouldn't put PCI DSS as a good example, or an "almost always safe" example.

rossdavidh• 6 years ago

Visa/MC have several advantages over a federal regulator:

- they have a more regular feedback mechanism (if someone's db gets leaked, they get more fraudulent charges from that company's customers, so they can figure out whose security was bad, and this happens often)

- they have a more credible enforcement mechanism: they can and will turn off your ability to process CC transactions, while a federal regulator in many cases faces a lot of political pushback if they try to actually shut down a medical facility

- the intended (and actual) purpose of PCI was to reduce the number of operators actually storing CC data; if a federal regulator tried to make things onerous enough to force most medical facilities to not store medical data, there would be enormous pushback and they would be forced by Congress to back down

g_p6• 6 years ago

Not to disagree with you as I agree with the sentiment, but as a counter data point, I've seen a number of quite serious beaches in the past where PCI/DSS clearly wasn't being followed, as CVV2 was compromised along with payment details. Often the merchants were too naive to even understand what was going on.

Clearly having straightforward gateways to handle payments can help retailers and raise the bar, but I never cease to be amazed at how many sites run third party scripts on pages processing sensitive information! Bonus marks for using third parties that let other third parties place code on the page!

I think we have 2 orthogonal aspects here - the presence or absence of a straightforward commodity solution, versus the presence of clear security guidelines. The former seems to be what drives better practices, whereas the latter is more guidance people ignore, due to lack of personnel and skills.

Nadya• 6 years ago

I dug out my login to comment on this:

There are some regulations regarding medical data (Eg, HIPAA) but security seems like an afterthought in most hospitals at best.

I worked as a developer for healthcare/hospital websites and the company I worked for took it far more seriously than the hospitals did. We had to babysit them constantly on potential violations and actual violations. The average hospital has at least a dozen different HIPAA violations each and every day because in the end convenience almost always trumps security when a person is stressed and busy. And those were just the violations I was privy to as their web developer - undoubtingly there were even more that I couldn't have been aware of.

When we dropped support for IE8-10 it was a major issue at nearly every hospital we worked with and we couldn't convince them to finally upgrade until lawsuits started happening.

https://www.hipaajournal.com/upgrade-internet-explorer-to-re...

HIPAA compliance is a checkbox and actual security doesn't mean anything because actual security is too inconvenient.

underseacables2• 6 years ago

Are these photos really of interest to anyone? I think for most people you can tell if they’ve had work done. I guess the elephant in the room is breast augmentation, but I think it’s pretty easy to tell the difference between natural and bolt-on.

tompazourek6• 6 years ago

Lot of the photos might show private parts, and I think people will feel violated when these are shared without their consent.

underseacables2• 6 years ago

But is it enough that the company should worry? It’s not the Fappening. I just think so what, it’s tragic and Blackeye on the company, but it’s like stealing something with no value.

29athrowaway• 6 years ago

They can collect the money and leak the information anyways.

tompazourek6• 6 years ago

If they leak the photos after they get the money, they might have less chance of getting the money next time.

They probably don't care for the photos. They care about making money and want to keep making money in the future.

powersnail• 6 years ago

They might not want to keep making money in the future. Sometimes, they score something big and leave the business.

anigbrowl• 6 years ago

You're assuming they're rational in this regard, but not rational enough to change their identity or select a different class of target in the future.

breck• 6 years ago

"None of our patients' payment card details have been compromised but at this stage, we understand that some of our patients' personal data may have been accessed."

Reminds me of a statement put out by White Star Lines in 1912:

"None of our passengers payment card details have been compromised but at this stage, we understand that some of our passengers personal lives may have been affected."

function_seven• 6 years ago

The deck chairs appear to be arranged optimally at this time, but we understand that other circumstances may reduce demand for them.

sib• 6 years ago

"It's understood that many before and after pictures will not include the patients' faces."

What kind of pointless statement is this? What is "many"? And does that imply that "many," "most," or "only a few" pictures will include the patients' faces?

elliekelly2• 6 years ago

Photos of facial surgery are more likely to be identifiable (nose, cheeks, chin, lips, eyes/eyebrows) while photos of bodily surgery (breasts, arms, stomach, etc.) won’t include the patient’s face. Its probably up to the doctor’s photograph preference what types of facial photographs are identifiable and how close/far the zoom is when they take the picture.

anonymfus• 6 years ago

It has 11 clinics specialising in bariatric weight loss surgery, breast enlargements, nipple corrections and nose adjustments.

I guess pictures of nose adjustment patients most certainly include faces, and pictures of nipple corrections probably don't.

Waterluvian• 6 years ago

Until these breaches result in lawsuits and maybe even criminal charges that result in complete dissolution of the corporation to pay out, these events will never stop happening.

ajay-b2• 6 years ago

The payoff for hackers seems too low here, why was this even a target? Kids and too much free time?

aaron695• 6 years ago

REvil are a well established hacking firm.

They normally ask in the millions. Generally anyone can pay for it. You could buy it instead if you want. (There is an Auction section, but it's not open for TheHospitalGroup atm)

The amounts they ask from even small websites I find way too high. Perhaps their website asks high so when they go lower they get paid.

If you don't pay and no one else wants to pay, it goes public.

REvil .onion - "At the beginning of next week we will post the first batch of files, namely: Pacient Personal - 20гб TMG OFFICIAL Documents - 50гб"

why was this even a target?

I assume like almost all hacks, even at the nation level, it's opportunity more than targeted. This website had a sploit, then they found real data behind it.

ashishb• 6 years ago

Private data is a toxic asset. Businesses should learn to purge it regularly to minimize such damages.

jessaustin• 6 years ago

One would think that if anyone had seen enough breasts, it would have been a plastic surgeon. Maybe they preserved these images for use in malpractice suits, but that's not a reason to keep the images online.

HenryBemis3• 6 years ago

Yes, insurance, malpractice. I talked to a friend who is CTO in a private hospital that has a clinic for plastic surgeries (but mostly for non-vanity purposes aka burns, acid attacks, etc.). One main reason for the pre-during-post photos is for medical studies, progress monitoring, training, etc. They keep these photos on a server on a separate network (and photos are not accesible to the typical workstation, but on locked-down ipads).

For the famous people, it's a 'nice' extortion, for some 'glossy magazine babe' who claims she is all natural, to come up with evidence of implants, etc. would be devastating to her number of followers, and thus sponsors/payments.

JohnJamesRambo• 6 years ago

I mean they post page after page of the before and afters on their websites, which I've always found kind of disturbing. I'm sure the women agreed to it but still kind of odd.

akudha• 6 years ago

There should be strict laws around collecting the data in the first place. Only minimal, absolutely needed data should be collected.

I remember shopping at a well known, large electronics store in NY. The cashier insisted on taking down my phone number and email. When I asked why, he said "if you decide to return the items". I told him I will produce the receipt, but this turned into an argument. I didn't want to waste other people's time over a 30$ purchase, so I just left without buying. This is just a small example of the abuse that we put up with everyday

imgabe2• 6 years ago

This sort of thing just shouldn't even be a viable threat. The response should be "go ahead and publish it, who cares?"

If you heard tomorrow that there were a bunch of plastic surgery before and after photos online, would you even go look? What is the threat here - that people will search the data for people they know and...make fun of them? Really?

SirSavary• 6 years ago

People who have gone through gender affirmation surgery may want that to remain hidden knowledge

imgabe2• 6 years ago

It has 11 clinics specialising in bariatric weight loss surgery, breast enlargements, nipple corrections and nose adjustments.

It doesn't seem like that was done at these clinics.

hackinthebochs• 6 years ago

It's funny how these articles are always so quick to reassure "no payment details have been compromised", as if that is a significant concern. How did we get to the point where the private data that can be rendered obsolete with one phone call is treated much more securely than private data that will follow us for the rest of our lives?

We need a lobbying group that will strong-arm lawmakers into crafting regulation so that our personal information will be treated with at least as much care as ephemeral credit card numbers.

sdenton4• 6 years ago

Seems like the payment data is just handled by the credit card companies, so it's a matter of targeting random businesses vs Visa....

So, seems like you're ultimately advocating for all data to be handled by credit card companies, or similarly hardened targets. In the end this may not gain much; a company with compromised api access is still a good target. Which helps demonstrate another difference: Companies need ongoing access to their data, where payments are 'fire and forget' and thus are easier to protect.

koheripbal• 6 years ago

I suspect it is mentioned specifically because payment data falls under PCI regulations and thus adds response requirements.

So stating that such data was not leaked is meant to prevent that additional PCI response step.

LockAndLol• 6 years ago

I guess we'll see whether those people spouting "I have nothing to hide" really mean it.

Hackers threaten to leak plastic surgery pictures

Related Stories