Data databases of many hospitals are accessible despite security

Hospital patient information databases may still be accessible to third parties, even if they are encrypted. Research by Microsoft shows that. Company employees analyzed the databases of two hundred American hospitals.

The researchers managed to recover an ‘alarming amount’ of data, such as gender, race, age and other information, by weakening the security of the encrypted databases. It actually concerned personal data used by hospitals. 95 percent of all hospitals appeared to ‘leak’ sensitive information.

The databases mostly used CryptDB, which is open source and allows organizations to store encrypted data in a somewhat outdated database infrastructure. The scientists were able to weaken the encryption of the tde- and ope-encrypted columns, eventually allowing them to view the data as plain text.

To weaken security, the researchers used a total of four attacks, two of which were known and two new. All the attacks, which were slightly different and detailed in a paper, were at least aimed at decrypting the columns. With success, it turns out.

The researchers state that their research shows that many tde- and ope-encrypted columns are not secure. Although they only looked at the columns in the electronic patient files of the hospitals, they also think that the vulnerabilities apply to other systems. They will present their findings next month at the ACM Conference on Computer and Communications Security.