Forget lumps of coal, the new nasty cybersecurity stocking stuffer comes in the form of a Christmas virus, or rather a few of them. And those aren’t the only unwelcome presents hospital infosec teams should be on the lookout for as 2019 arrives.

There’s also the Kubernetes hole, a rise in credentialed phishing and security gaps in industrial control systems.

And many employees are still using passwords such as 123456 and "password." Happy New Year!

HIMSS, owner of Healthcare IT News, on Friday afternoon circulated its latest monthly Healthcare and Cross-Sector Cybersecurity Report. Let’s take a look at some of the issues that the report’s author, Lee Kim, director of Privacy & Security at HIMSS, included in this edition.

"The Kubernetes vulnerability was reported earlier this month, the vulnerability was addressed, and the talk about it died down," Kim said. "But the exploits are continuing to be developed. So, that was very interesting to see." 

Now, about those pesky post-Christmas gifts. There are now seven versions, according to the Malware Wiki, and they target DOS machines. So any hospitals still running DOS should be on the lookout. Here's a YouTube video showing the virus in action. 

If DOS seems antiquated, this month’s report also pointed to security vulnerabilities in heating, ventilation and air conditioning systems that can be exploited much the way hackers did to break into Target’s network.

"A lot of us have HVAC systems that are connected to the Internet," Kim said. "Compromise of HVAC can mean a lot of things can go down."

Back to the matter of passwords. They’re not exactly getting better, as the list of 100 worst shows yet again. Some are even guessable. And hospitals continue with the struggle to enforce stronger security practices.

Kim also pointed out that cryptomining is surpassing ransowmare as the top threat in the Middle East, Turkey and Africa and there's been a rise in phishing attacks during December as well.

"There has been an uptick recently in credential phishing, including those targeting popular web mail services," said Kim.

Twitter: @SullyHIT
Email the writer: tom.sullivan@himssmedia.com

Healthcare IT News is a HIMSS Media publication.