full-disclosure - Undisclosed breach at major US facility

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <591fd0b20607031738k17fc9307s3df3673036ad282e@mail.gmail.com>
Date: Tue Jul  4 01:38:16 2006
From: stacksmasher at gmail.com (Stack Smasher)
Subject: Undisclosed breach at major US facility

To my knowledge, no one has ever been convicted or fined for HIPAA
violations EVER. Don't wast your time,  at this point you risk being
arrested and blamed for this finding rather commended by finding it.


Be careful.



On 7/3/06, r r <anothersecurityquestion@...il.com> wrote:
> Need some advise here.
> I would like to know what to do if I --hypothetically speaking-- I
> were to retrieve _complete_ databases of a MAJOR us hospital.  My
> hypothetical model is not brute force, but rather an 'accidental'
> discovery by trying to retrieve updates from a software vendor.
>
> Let's say this Big Name software vendor, who sells itself as being an
> authority on security, is so flipping retarded that they stick their
> customer data on a public CVS server.  Let's say I sync to this and
> dump a couple hundreds of meg of 'updates' only to later discover that
> those are NOT updates.
>
> Those are data files for other customers (which when prodding, reveals
> itself to be very real, verified data of at least one high-profile
> hospital)
>
> I read up as much as I could on HIPAA, but this is beyond the slip-ups
> to be covered by HIPAA.  Beyond medical records and privacy, this
> wreaks of woeful incompetence by who should be freaking security
> professionals!! (4 MAJOR organizations who have royally screwed up
> here).
>
> First thoughts are to call HIPAA (has to be federally reported for
> number of people and different states affected).
> And while HIPAA is supposed to protect the 'whistleblower', I don't
> put much confidence in it.  Maybe a webpost through anonomizer (and
> borrowed connections) like I do to check gmail.
>
> And if these companies are notified, what happens?  A slap on the wrist?
> Wash it under the rug and label the person discovering it all to be a Black Hat?
> Let's not forget about the diebold fiasco(s)---(fwiw I don't work for
> any of the involved companies--in my theoretical model I would solely
> be the customer of questionable software).
>
> One idea (by one of my imaginary friends who pretends to be a doctor
> and a former hospital board member) was to ABSOLUTELY NOT tell the
> hospital for various reasons.  That alter-ego of mine instead
> suggested I get an attorney that specialized in that.  That sounds
> expensive.  Now, I feel like a victim.
>
> If _I_ have been able to discover such a gaping hole (and I didn't
> even TRY to find it), then I am pretty sure that it already has been
> taken. In any case, it will be stolen in a matter of weeks.  Since
> that is inevitable, I should just remove all the data I obtained and
> forget about it.
>
> In the end, I feel bad for the hundreds of thousands of people who can
> be totally raped of their identities (or be scammed for extraneous
> chargesl, etc etc).
> But, why should I be the scapegoat for pointing out that the Emperor
> has no clothes?
>
> Any useable thoughts?
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>


-- 
"If you see me laughing, you better have backups"