OpenEMR flaws left millions of health records exposed

A total of 23 critical vulnerabilities were left unpatched until last month

Clinician's computer meltdown

Critical security flaws in the widely-used OpenEMR health records storage system left millions of patient records vulnerable, researchers have revealed.

A host of flaws in version 5.0.1.3 of the open source system used by organisations across the world - including a portal authentication bypass, instances of SQL injection, as well as remote code execution - left the records of more than 90 million patients vulnerable.

The 23 issues - many described as 'high risk' - outlined in a vulnerability report were discovered by a team of seven cyber security experts from Project Insecurity who manually reviewed OpenEMR's source code without the use of any automated analytical tools.

The researchers brought these vulnerabilities to the developer's attention last month, before the vendor released an update fixing the vulnerabilities less than two weeks later on 20 July. Full disclosure of the vulnerabilities were made yesterday as per an agreement between OpenEMR and Project Insecurity.

Advertisement
Advertisement - Article continues below

"We've seen a lot of medical-related breaches in the media lately and it made us think about the entire transition from regular handling of medical records to them being dealt with electronically and the security implications of that," said Project Insecurity's CEO Matt Telfer, speaking with databreaches.net.

"After some googling we found that OpenEMR was the most widely-deployed open-source electronic medical record application on the internet. And the fact that it's open source meant that we could test it without any negative legal implications."

The research team also issued a number of recommendations the developers could deploy to prevent further exploitation in future, including PHP modifications to prevent SQL injection attacks, and blacklisting malicious extensions to mitigate the risk of unrestricted file uploads.

Project Insecurity's chief financial officer Brian Hyde told IT Pro the team wasn't able to say whether malicious actors had already taken advantage of the frailties, but added a dedicated hacker would have been able to find them "in a rather trivial manner".

He added some of the exploits "could have potentially been there since the very first release of OpenEMR".

OpenEMR is one of the world's most widely-used systems for storing medical records and managing medical practices, and boasts thousands of downloads each month.

The open source system is predominantly used in the US, and on Windows devices, but is also popular in a host of other countries including India, and Honduras. OpenEMR does have a presence in the UK - but it is not as widely-used; only 19th in most downloads by country in the last five years.

Concerns over the security of patient data have never been higher - particularly as health records across the NHS are increasingly being stored digitally. Speaking with IT Pro in June, experts highlighted the risks of migrating patient data to the public cloud, claiming patients would be put at risk if cloud migration is done purely as a cost-saving exercise.

NHS Digital told IT Pro OpenEMR is not used from a national perspective, but local organisations are able to procure their own systems from a variety of suppliers.

It is unlikely OpenEMR is used in the NHS, the spokesperson added, due to its exclusion from the main channels through which Primary and Secondary Care organisations procure their services.

Featured Resources

Application security fallacies and realities

Web application attacks are the most common vulnerability, so what is the truth about application security?

Download now

Your first step researching Managed File Transfer

Advice and expertise on researching the right MFT solution for your business

Download now

The KPIs you should be measuring

How MSPs can measure performance and evaluate their relationships with clients

Download now

Life in the digital workspace

A guide to technology and the changing concept of workspace

Download now
Advertisement

Recommended

Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/business-strategy/mergers-and-acquisitions/354191/xerox-threatens-hostile-takeover-after-hp-rebuffs
mergers and acquisitions

Xerox threatens hostile takeover after HP rebuffs $30bn takeover

22 Nov 2019
Visit/mobile/google-android/354189/samsung-galaxy-a90-5g-review-simply-the-best-value-5g-phone
Google Android

Samsung Galaxy A90 5G review: Simply the best value 5G phone

22 Nov 2019
Visit/security/bugs/354180/google-to-offer-15m-to-anyone-that-can-break-a-pixel-4
bugs

Google to offer $1.5m to anyone that can break a Pixel 4

22 Nov 2019
Visit/public-cloud/34850/salesforce-takes-aws-relationship-to-the-next-level
News

Salesforce takes AWS relationship to the next level

19 Nov 2019