Slashdot Mirror
FTC Fines Software Vendor Over False Data Encryption Claims (softpedia.com)
An anonymous reader writes: The US Federal Trade Commission (FTC) has fined a software vendor for lying about its product's encryption capabilities, despite being publicly warned by US Computer Emergency Readiness Team (CERT) not to do so. The software vendor is Henry Schein, who deliberately ignored CERT and FTC warnings and continued to sell its CRM for dentists, even if it knew it did not comply with HIPAA rules. The vendor got "only" a $250,000 fine.
This is yet another example of why rolling your own encryption is a very bad idea. Not only is it a weak algorithm but it also relies on obscurity. Their literature even says that due to it's proprietary nature that makes it even more secure because it's more difficult to reverse engineer. Good job, morons!
yes, they were only fined $250K. Henry Schein is a multibillion dollar multinational company. $250K is "cost of business" expense because they make millions selling their software. this isn't even a slap on the wrist.
Anons need not reply. Questions end with a question mark.
No, because HIPAA is totally tech agnostic. The security protocols in HIPAA are only a few pages; encryption is "Addressable" yet not "Required" unlike "Unique User Identification". They are designed so a normal "office manager" can do a checklist; they are in no way "security protocols" like an actual IT compsec person would design.
"Encryption and decryption (Addressable). Implement a mechanism to encrypt and decrypt electronic protected health information."
"Encryption (Addressable). Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate."
That's pretty much the tech level of the entire document, there are no actual technologies referenced in it. Technically you could indeed use Pig Latin as your "encryption", but actually don't need to have any encryption at all.
Good. Now maybe the Federal Trade Commission will go after anyone building back doors in their software or hardware for the criminals at the N.S.A.
I'm an American. I love this country and the freedoms that we used to have.
It seems like someone wrote a basic customer-tracking database for Windows that happened to be focussed on dental patients, and then Henry Schein bought them and built the rest by "buying" (or "licensing") connections to a pile of other third-party software. In addition to MS-SQL and Microsoft Office, this seems to include Adobe Flash in places, "integrators" for at least two different third-party imaging software packages, a messaging system, and who knows what else.
Looking at the CERT notice, I'm guessing they "bought" (/"licensed") their special "proprietary encryption" as a package from Faircom and just bolted it on without any further examination. They were probably happily going along continuing to brag about their encryption because Faircom was, and they figured Faircom could be blamed for it.
It doesn't help that "Dental-patient record tracking software" isn't a particularly big niche, so there's likely very little competition and any half-assed thing they throw together will continue to generate license fees because Big Multibillion-Dollar Corporation can easily outmarket the very few competitors they may have (and who may not actually be any better). Many years ago, I worked for a proprietary retail inventory-and-point-of-sale software developer. Their product was also a rickety pile of smouldering crap, but it still seemed to be better than most of their few competitors back then. Horrifying, but I suspect Henry Schein is in an analogous situation (compounded by being a massive conglomerate).
Hacker Public Radio is our Friend
The flaws you are referring to are in the implementation of the crypto algo, not the algo itself.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
First they wanted to backdoor all encryption, now they've got a fully-backdoored encryption and it's still not good enough.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
How many of the bugs in OpenSSL or LibreSSL or GnuTLS are bugs in the actual implementation of the encryption algorithm and how many are bugs in higher level protocols (SSL, TLS etc)?
OMG, I can't believe that FTC did something. This is where people would chime in and point out a list of FTC accomplishments, if people could.
Ha-ha!
https://www.youtube.com/c/BrendaEM
oops :)
Also, how many go completely unpatched by the vendor because they don't understand encryption?
At least with OpenSSL etc, the problems are fixed quickly.
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
Not exactly. HIPPA has provisions for both PHI and e-PHI. If your business works with another by passing either PHI or e-PHI, you either have to be compliant or you don't do business with them. In practical terms, this means that if you're a dentist and you want to be reimbursed by insurance, it doesn't matter if you're submitting paper or pixels - you have to be HIPPA compliant. If you want to do a cash-only business and you don't need to work with any other HIPPA-compliant business, you can roll HIPPA up in a ball and trash it. Regardless of whether your records are paper or pixels.