Hello again! I have found an open database of medical data for you once more. Let me remind you that just recently, I published three articles on this subject: , and .
This time, an Elasticsearch server with logs from the medical IT system of the laboratory network ‘Molecular Diagnostics Center’ (CMD, www.cmd-online.ru) has become publicly accessible.
Disclaimer: All information below is published solely for educational purposes. The author has not accessed any personal data of third parties or companies. The information is taken either from open sources or was provided to the author by anonymous well-wishers.
The server was discovered on the morning of April 1st, and I did not find this funny at all. The notification about the problem was sent to CMD around 10 AM (MSK) and by approximately 3 PM, the database became unavailable.
According to the Shodan search engine, this server was first made publicly available on March 9, 2019. I have written a separate article about how to detect open Elasticsearch databases. full names, gender, birth dates of patients, full names of doctors, cost of tests, research data, files with screening results
Example of a log with the results of a patient's tests: Full names, gender, dates of birth of patients, full names of doctors, costs of examinations, data of examinations, files with screening results and much more.
Example log with patient test results:
"Passport0423BF97FA5E-1DWW98675708386841791018.03.2019РОСС RU.13СК03.006012iVBORw0KGgoAAAANSUhEUgAABfoAAAfuCAIAAAArOR8rAAD//0lEQVR4Xuy9P7BtQ7u+/e3oECF6iRAhQoQI0SZCtIkQIdpEiBCxI0SIECFiV50qRKg6VYgQIUKEiDfiRL7rnPtXz+nqHnPMsfb6s+cc61rBqjl79Oh++uoe/eceT/c8888////I replaced all sensitive data with the character 'X'. In reality, everything was stored in plain view.
From such logs, it was easy (by decoding from Base64) to obtain PNG files with the screening results, already in a readable format:
The total size of the logs exceeded 400 MB and contained more than a million records in total. It is clear that not every entry represented data from a unique patient.
Official response from CMD:
We would like to thank you for promptly providing information on the vulnerability in the logging and error storage database of Elasticsearch on April 1, 2019.
Based on this information, our staff, together with specialized professionals, limited access to the specified database. The error of transmitting confidential information to the technical database has been corrected.
During the investigation of the incident, it was revealed that the appearance of the specified database with error logs in the public domain was due to human factors. Access to the data was promptly closed on April 1, 2019.
Currently, internal and external specialists are conducting measures for an additional audit of the IT infrastructure regarding data protection.
Our organization has developed a special regulation for working with personal data and a system of tiered responsibility for staff.
The current software infrastructure involves using the Elasticsearch database for error storage. To enhance the reliability of certain systems, migration of the corresponding servers will take place to our partner's data center, into a certified software and hardware environment.
Thank you for the timely information provided.
News about data leaks and insiders can always be found on my Telegram channel "».
Source: habr.com
