OpenEMR flaws left millions of health records exposed

A total of 23 critical vulnerabilities were left unpatched until last month

Clinician's computer meltdown

Critical security flaws in the widely-used OpenEMR health records storage system left millions of patient records vulnerable, researchers have revealed.

A host of flaws in version 5.0.1.3 of the open source system used by organisations across the world - including a portal authentication bypass, instances of SQL injection, as well as remote code execution - left the records of more than 90 million patients vulnerable.

The 23 issues - many described as 'high risk' - outlined in a vulnerability report were discovered by a team of seven cyber security experts from Project Insecurity who manually reviewed OpenEMR's source code without the use of any automated analytical tools.

The researchers brought these vulnerabilities to the developer's attention last month, before the vendor released an update fixing the vulnerabilities less than two weeks later on 20 July. Full disclosure of the vulnerabilities were made yesterday as per an agreement between OpenEMR and Project Insecurity.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"We've seen a lot of medical-related breaches in the media lately and it made us think about the entire transition from regular handling of medical records to them being dealt with electronically and the security implications of that," said Project Insecurity's CEO Matt Telfer, speaking with databreaches.net.

"After some googling we found that OpenEMR was the most widely-deployed open-source electronic medical record application on the internet. And the fact that it's open source meant that we could test it without any negative legal implications."

The research team also issued a number of recommendations the developers could deploy to prevent further exploitation in future, including PHP modifications to prevent SQL injection attacks, and blacklisting malicious extensions to mitigate the risk of unrestricted file uploads.

Project Insecurity's chief financial officer Brian Hyde told IT Pro the team wasn't able to say whether malicious actors had already taken advantage of the frailties, but added a dedicated hacker would have been able to find them "in a rather trivial manner".

He added some of the exploits "could have potentially been there since the very first release of OpenEMR".

OpenEMR is one of the world's most widely-used systems for storing medical records and managing medical practices, and boasts thousands of downloads each month.

Advertisement - Article continues below

The open source system is predominantly used in the US, and on Windows devices, but is also popular in a host of other countries including India, and Honduras. OpenEMR does have a presence in the UK - but it is not as widely-used; only 19th in most downloads by country in the last five years.

Concerns over the security of patient data have never been higher - particularly as health records across the NHS are increasingly being stored digitally. Speaking with IT Pro in June, experts highlighted the risks of migrating patient data to the public cloud, claiming patients would be put at risk if cloud migration is done purely as a cost-saving exercise.

NHS Digital told IT Pro OpenEMR is not used from a national perspective, but local organisations are able to procure their own systems from a variety of suppliers.

It is unlikely OpenEMR is used in the NHS, the spokesperson added, due to its exclusion from the main channels through which Primary and Secondary Care organisations procure their services.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Recommended

Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/microsoft-windows/32066/what-to-do-if-youre-still-running-windows-7
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Visit/policy-legislation/data-governance/354496/brexit-security-talks-under-threat-after-uk-accused-of
data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
Visit/hardware/laptops/354533/dell-xps-13-new-9300-hands-on-review-chasing-perfection
Laptops

Dell XPS 13 (New 9300) hands-on review: Chasing perfection

14 Jan 2020