{"id":5489,"date":"2016-06-17T05:13:12","date_gmt":"2016-06-17T09:13:12","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/?p=5489"},"modified":"2020-04-09T21:34:06","modified_gmt":"2020-04-09T17:34:06","slug":"vulnerable-medical-equipment","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/vulnerable-medical-equipment\/5489\/","title":{"rendered":"Getting sick is doubly dangerous: Medical equipment is vulnerable to hackers"},"content":{"rendered":"<p><b>Almost every cyberattack has the same goal \u2014 stealing someone\u2019s money.<\/b>\u00a0However, as a vast variety of equipment is getting connected, a buggy device can lead to more serious consequences than money loss. What about human health and life?<\/p>\n<p>Take\u00a0<a href=\"https:\/\/www.kaspersky.com\/blog\/blackhat-jeep-cherokee-hack-explained\/9493\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">connected cars<\/a>, a perfect example of how a device can pose a great risk to life and limb. A malicious party taking control over a self-driving car can easily lead to an accident. Smart medical equipment is also at risk. Devices designed to keep us healthy can be also used to do the opposite.<\/p>\n<p>To date, we know of zero documented cases of compromised medical equipment directly harming human health. However, experts regularly find new vulnerabilities in medical devices, including bugs that could be used to cause serious physical harm.<\/p>\n<p>Because stealing money and harming people physically are disparate actions, one might hope that hackers will refrain from taking such steps for ethical reasons. But it\u2019s more likely criminals haven\u2019t turned to hacking medical devices simply because they don\u2019t (yet) know how to gain easy profit from such attacks.<\/p>\n<p>Actually, cybercriminals have repeatedly attacked hospitals with Trojans and other widespread malware. For example, in the beginning of this year, a number of ransomware infections hit medical centers in the United States,\u00a0<a href=\"https:\/\/www.kaspersky.com\/blog\/locky-ransomware\/11667\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">including<\/a>\u00a0Hollywood Presbyterian Medical Center in Los Angeles.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Hospital pays ransom, does not get files back\u2026 Remember, don't pay  <a href=\"https:\/\/t.co\/8yLC4w5yMr\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/8yLC4w5yMr<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/ransomware?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#ransomware<\/a> <a href=\"https:\/\/t.co\/nT9MT4d6nB\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/nT9MT4d6nB<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/735921006641045504?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">May 26, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The Los Angeles hospital paid $17,000 to get its records back. However, when Kansas Heart Hospital tried to do the same, the crooks didn\u2019t give them files back,\u00a0<a href=\"https:\/\/www.kaspersky.com\/blog\/why-you-dont-pay-ransomware\/12214\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">demanding<\/a>\u00a0more money instead. As you can see, we cannot rely on ethical imperatives to stop criminals: Some will always be happy to attack medical establishments for easy money.<\/p>\n<p>Medical equipment undergoes required inspection and certification \u2014 but only as medical equipment, not as connected computer technology. Fulfilling cybersecurity requirements is recommended, of course, but remains a matter of vendor discretion. As a result, many hospital devices suffer from obvious flaws, long known to competent IT specialists.<\/p>\n<p>The U.S.\u00a0<a href=\"https:\/\/en.wikipedia.org\/wiki\/Food_and_Drug_Administration\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Food and Drug Administration<\/a>\u00a0regulates the sale of medical devices and their certification. Trying to adapt to the evolving connected environment, the FDA\u00a0<a href=\"http:\/\/www.reuters.com\/article\/us-cybersecurity-medicaldevices-insight-idUSKCN0IB0DQ20141022\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">released<\/a>\u00a0guidelines for manufacturers and health-care providers to better secure medical devices. In the beginning of 2016, a draft of a sibling document was published. But all of the measures are just\u00a0<a href=\"http:\/\/www.fda.gov\/medicaldevices\/digitalhealth\/ucm373213.htm\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">advisory<\/a>. So it\u2019s still\u00a0<b>not mandatory<\/b>\u00a0to secure medical devices that are critical to saving human lives.<\/p>\n<h3>Fatal negligence<\/h3>\n<p>Equipment manufacturers can ask cybersecurity experts for help, but in fact they often do just the opposite, declining even to provide their devices for testing. Experts have to buy secondhand equipment on their own to check how well it is protected. For example,\u00a0<a href=\"https:\/\/twitter.com\/XSSniper\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Billy Rios<\/a>, who\u00a0<a href=\"https:\/\/www.kaspersky.com\/blog\/internet-of-crappy-things\/7667\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">knows connected devices<\/a>\u00a0inside and out, occasionally examines medical devices as well.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Medicine under fire: how to hack a hospital <a href=\"https:\/\/t.co\/QcmY3IlWGR\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/QcmY3IlWGR<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/TheSAS2016?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#TheSAS2016<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/Healthcare?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Healthcare<\/a>  <a href=\"https:\/\/twitter.com\/hashtag\/medicalsec?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#medicalsec<\/a> <a href=\"https:\/\/t.co\/Cil0ueabag\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/Cil0ueabag<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/697813032647467008?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">February 11, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>About two years ago, Rios tested Hospira\u00a0<a href=\"https:\/\/en.wikipedia.org\/wiki\/Infusion_pump\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">infusion pumps<\/a>, which are delivered to tens of thousands of hospitals around the globe. The results were alarming: The drug injection pumps\u00a0<a href=\"https:\/\/www.kaspersky.com\/blog\/drug-pump-security-bugs\/8650\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">let him<\/a>\u00a0change settings and raise dose limits. As a result, malefactors could cause patients to be injected with larger or smaller doses of medicine. Ironically, these devices were advertised as error-proof.<\/p>\n<p>Another vulnerable device Rios found was the Pyxis SupplyStation, produced by CareFusion. These devices dispense medical supplies and facilitate account keeping. In 2014, Rios found a bug that let anybody inside the system.<\/p>\n<p>In 2016, Rios turned to the Pyxis SupplyStation once more, this time with fellow security expert Mike Ahmadi. The duo discovered\u00a0<a href=\"https:\/\/threatpost.com\/1400-vulnerabilities-to-remain-unpatched-in-medical-supply-system\/117089\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">more than 1,400 vulnerabilities<\/a>, half of which are considered very dangerous. Though third-party developers were to blame for a great number of the bugs, and experts analyzed only an older-model Pyxis SupplyStation, those vulnerabilities are still greatly troubling.<\/p>\n<p>The thing is, these solutions were at end-of-life, and despite their widespread use, the developers did not provide any patches for them. Instead, CareFusion recommended customers upgrade to new versions of equipment. Organizations that did not want to upgrade received a list of tips on how to minimize the risk of those systems being compromised.<\/p>\n<p>It\u2019s hard \u2014 and expensive \u2014 to update old equipment. But, for example, Microsoft had already abandoned the operating systems installed on the devices, leaving them fundamentally vulnerable. The latest versions of the Pyxis SupplyStation run on Windows 7 or later and are not vulnerable to those bugs.<\/p>\n<p>Kaspersky Lab also\u00a0<a href=\"https:\/\/www.kaspersky.com\/blog\/hacked-hospital\/11296\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">provided<\/a>\u00a0cyberstructural tests for hospitals: Our expert Sergey Lozhkin was invited to take part in the experiment and hack medical equipment, including a\u00a0<a href=\"https:\/\/en.wikipedia.org\/wiki\/Tomography\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">tomographic<\/a>scanner.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">How I hacked my <a href=\"https:\/\/twitter.com\/hashtag\/hospital?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#hospital<\/a> \u2013 <a href=\"https:\/\/t.co\/qhKfT636F5\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/qhKfT636F5<\/a> from <a href=\"https:\/\/twitter.com\/61ack1ynx?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@61ack1ynx<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/healthcare?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#healthcare<\/a> <a href=\"https:\/\/t.co\/SPES9tPnsw\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/SPES9tPnsw<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/697498654731534337?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">February 10, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Of course, the abovementioned cases were carried out as experiments \u2014 to show how easily criminals could repeat this if they wanted \u2014 not to cause any actual harm!<\/p>\n<h3>Who is to blame, and what should we do?<\/h3>\n<p>The service life of medical devices is much longer than your smartphone\u2019s lifecycle. Dozens of years for an expensive piece of equipment is not long at all. Moreover, although the latest devices are less vulnerable than outdated ones, with time and without proper support they are going to become as buggy as their older counterparts.<\/p>\n<p>As Mike Ahmadi explains: \u201cI think it\u2019s reasonable for a medical device manufacturer to have a stated end-of-life for a medical device, and have a stated end-of-life for cybersecurity for the devices.\u201d<\/p>\n<p>The Pyxis SupplyStation hack has the bright side as well. True, the developers ignored the first bugs that Rios discovered, but later, the giant Becton Dickinson corporation bought the company, and its new management views cyberexperts quite differently. Maybe in the future, companies will pay more attention to bug-proofing than they do now. And perhaps they will even do massive vulnerability testing for new devices\u00a0<i>before<\/i>\u00a0they enter the market.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"kesb-trial\">\n","protected":false},"excerpt":{"rendered":"<p>Almost every cyberattack has the same goal \u2014 stealing someone\u2019s money.\u00a0However, as a vast variety of equipment is getting connected, a buggy device can lead to more serious consequences than<\/p>\n","protected":false},"author":1654,"featured_media":5490,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,1486],"tags":[261,1192,1012,36,1193,1150,433,268],"class_list":{"0":"post-5489","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-threats","9":"tag-encryption","10":"tag-hospitals","11":"tag-internet","12":"tag-malware-2","13":"tag-medical-equipment","14":"tag-medicine","15":"tag-ransomware","16":"tag-vulnerabilities"},"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/vulnerable-medical-equipment\/5489\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/vulnerable-medical-equipment\/3857\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/vulnerable-medical-equipment\/7314\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/vulnerable-medical-equipment\/7342\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/vulnerable-medical-equipment\/7291\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/vulnerable-medical-equipment\/8507\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/vulnerable-medical-equipment\/8404\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/vulnerable-medical-equipment\/12252\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/vulnerable-medical-equipment\/2208\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/vulnerable-medical-equipment\/12385\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/vulnerable-medical-equipment\/5770\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/vulnerable-medical-equipment\/6377\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/vulnerable-medical-equipment\/7961\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/vulnerable-medical-equipment\/11781\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/vulnerable-medical-equipment\/12252\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/vulnerable-medical-equipment\/12385\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/vulnerable-medical-equipment\/12385\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/encryption\/","name":"encryption"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/5489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/1654"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=5489"}],"version-history":[{"count":6,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/5489\/revisions"}],"predecessor-version":[{"id":16335,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/5489\/revisions\/16335"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/5490"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=5489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=5489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=5489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}