From Digital Age to Nano Age. WorldWide.

Tag: authentication

Robotic Automations

UnitedHealth CEO tells Senate all systems now have multi-factor authentication after hack | TechCrunch


UnitedHealth Group Chief Executive Officer Andrew Witty told senators on Wednesday that the company has now enabled multi-factor authentication on all the company’s systems exposed to the internet in response to the recent cyberattack against its subsidiary Change Healthcare.

The lack of multi-factor authentication was at the center of the ransomware attack that hit Change Healthcare earlier this year, which impacted pharmacies, hospitals and doctors’ offices across the United States. Multi-factor authentication, or MFA, is a basic cybersecurity mechanism that prevents hackers from breaking into accounts or systems with a stolen password by requiring a second code to log in.

In a written statement submitted on Tuesday ahead of two congressional hearings, Witty revealed that hackers used a set of stolen credentials to access a Change Healthcare server, which he said was not protected by multi-factor authentication. After breaking into that server, the hackers were then able to move into other company systems to exfiltrate data, and later encrypt it with ransomware, Witty said in the statement.

Today, during the first of those two hearings, Witty faced questions about the cyberattack from senators on the Finance Committee. In response to questions by Sen. Ron Wyden, Witty said that “as of today, across the whole of UHG, all of our external-facing systems have got multi-factor authentication enabled.”

“We have an enforced policy across the organization to have multi-factor authentication on all of our external systems, which is in place,” Witty said.

When asked to confirm Witty’s statement, UnitedHealth Group’s spokesperson Anthony ​​Marusic told TechCrunch that Witty “was very clear with his statement.”

Witty blamed the fact that Change Healthcare’s systems had not yet been upgraded after UnitedHealth Group acquired the company in 2022.

“We were in the process of upgrading the technology that we had acquired. But within there, there was a server, which I’m incredibly frustrated to tell you, was not protected by MFA,” Witty said. “That was the server through which the cybercriminals were able to get into Change. And then they led off a ransomware attack, if you will, which encrypted and froze large parts of the system.”

Contact Us

Do you have more information about the Change Healthcare ransomware attack? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or email. You also can contact TechCrunch via SecureDrop.

Witty also said that the company is still working on understanding exactly why that server did not have multi-factor authentication enabled.

Wyden criticized the company’s failure to upgrade the server. “We heard from your people that you had a policy, but you all weren’t carrying it out. And that’s why we have the problem,” Wyden said.

UnitedHealth has yet to notify people that were impacted by the cyberattack, Witty said during the hearing, arguing that the company still needs to determine the extent of the hack and the stolen information. As of now, the company has only said that hackers stole personal and health information data of “a substantial proportion of people in America.”

Last month, UnitedHealth said that it paid $22 million to the hackers who broke into the company’s systems. Witty confirmed that payment during the Senate hearing.

On Tuesday afternoon, Witty also appeared in a House Energy and Commerce committee, where he revealed that “maybe a third” of Americans had their personal health information stolen by the hackers


Software Development in Sri Lanka

Robotic Automations

Anon is building an automated authentication layer for the GenAI age | TechCrunch


As the notion of the AI agent begins to take hold, and more tasks will be completed without a human involved, it is going to require a new kind of authentication to make sure only agents with the proper approval can access particular resources. Anon, an early-stage startup, is helping developers add automated authentication in a safe and secure way.

On Wednesday, the company announced a $6.5 million investment — and that the product is now generally available to all.

The founders came up with the idea for this company out of necessity. Their first idea was actually building an AI agent, but CEO Daniel Mason says they quickly came up against a problem around authentication — simply put, how to enter a username and password automatically and safely. “We kept running into this hard edge of customers wanting us to do X, but we couldn’t do X unless we had this delegated authentication system,” Mason told TechCrunch.

He began asking around about how other AI startups were handling authentication, and found there weren’t really any good answers. “In fact, a lot of the solutions, people that were using, were actually quite a bit less secure. They were mostly inheriting authentication credentials from a user’s local machine or browser-based permissions,” he said.

And as they explored this problem more in depth, they realized that this was in fact a better idea for a company than their original AI agent idea. At this point, they pivoted to becoming a developer tool for building an automated authentication layer designed for AI-driven applications and workflows. The solution is delivered in the form of a software development kit (SDK), and lets developers incorporate authentication for a specific service with a few lines of code. “We want to sit at that authentication level and really build access permissioning, and our customers are specifically the developers,” Mason said.

The company is addressing security concerns about an automated authentication tool by working toward building a zero trust architecture where they protect the credentials in a few key ways. For starters, they never control the credentials themselves; those are held by the end user. There is also an encryption layer, where half the key is held by the user and half by Anon, and it requires both to unlock the encryption. Finally, the user always has ultimate control.

“Our platform is such that as a user, when I grant access, I still maintain control of that session — I’m the ultimate holder of the password, user Name, 2FA — and so even in the event of our system, or even a customer system getting compromised, they do not have access to those root credentials,” company co-founder and CTO Kai Aichholz said.

The founders recognize that other companies, large and small, will probably take a stab at solving this problem, but they are banking on a head start and a broad vision to help them stave off eventual competitors. “We’re looking to basically become a one-stop integration platform where you can come and build these actions and build the automation and know that you’re doing it in a way that’s secure and your end user credentials are secure and the automations are going to happen,” Mason said.

The $6.5 million investment breaks down into two tranches: a pre-seed of around $2 million at launch and a seed that closed at the end of last year for around $4.5 million. Investors include Union Square Ventures and Abstract Ventures, which led the seed, and Impatient Ventures and ex/ante, which led the pre-seed, along with several industry angels.


Software Development in Sri Lanka

Back
WhatsApp
Messenger
Viber