2 ms·

Patient Monitor Contec CMS8000 Contains a Backdoor

59 points by doener 2y ago

jeroenhd 2y ago
Notably, the backdoor uploads data to an NFS share hosted on a university IP (the exact university has not been made clear). Data includes patient names, doctor names, date of birth, and the specific hospital department the patient is at.
- Wololooo 2y ago
  Someone is going to be going out of business soon and someone at a university is going to get very fired.
  - numbsafari 2y ago
    > Contec Medical Systems Co., Ltd. (hereinafter referred to as CONTEC) focusing on research, manufacture and distribution of medical instruments, was founded in 1996 as a high-tech company. CONTEC locates in Economic & Technical Development Zone in Qinhuangdao covered an area of 125 acres and building area of over 100000 square meter, which is one of the largest bases for R & D and production of medical devices in China. https://contechealth.com/pages/company-introduction https://contechealth.com/pages/company-introduction I doubt it.
    - lenerdenator 2y ago
      I work in medical software. If you think the FDA or other regulating bodies wouldn't immediately tell care providers to yank these devices, you might be in for a surprise. What's more mysterious to me is why there's a back door in a device like this. Seems like a bizarre way to attack your enemy.
      - axus 2y ago
        Why attack people when you can exploit their data to make money. This is some growth "hacking" to make a list of sales leads.
        lenerdenator 2y ago
        Because there are far, far simpler ways to figure out what a hospital wants, or what a patient needs to deal with their health needs. I'm going to bet that the completely legal practice of building a profile off of what a person has installed on their phone and their web searches is more effective than collecting their vitals and turning that into sales leads. You could just ask the health system what they need. That's what leads to a lot of our product initiatives. It almost makes me wonder if there's a component in the hardware or software that's shared with other devices manufactured in China that are better attack vectors and they just tossed it into this one because, hey, it works.
        numbsafari 2y ago
        The inverse of “defense in depth” is “flooding the zone”.
        M95D 2y ago
        Can't gather data new data from the phone if that person is in a coma. But, hey, now the relatives can get coffin adverts before the doctor brings the bad news! /s That backdoor, if it reports to a university, is probably put there to facilitate a study/diploma/phd or something like that.
  - red_admiral 2y ago
    I doubt anyone at the university was involved, or is in trouble. I rather suspect that the university was told "put this on your network and don't ask too many questions".
Crosseye_Jack 2y ago
It also contains a out of bounds write, which could lead to RCE. https://www.cve.org/CVERecord?id=CVE-2024-12248 https://www.cve.org/CVERecord?id=CVE-2024-12248
deleted 2y ago
[deleted]
patrickhogan1 2y ago
1. Why wouldn’t CISA release the IP address? Blocking a specific IP is much easier for a hospital than patching or replacing every affected device. Some might argue that hospitals should just remove the device altogether, but CISA has stated that keeping the device and disabling its network capability is an acceptable solution. It seems very odd not to disclose the IP address. The only plausible explanation is that they want to monitor U.S.-based egress traffic to that IP. 2. The backdoor transmits data in plain text to a static IP address—something a competent hospital network administrator would have inevitably discovered.
- decio 2y ago
  The weird thing about this advisory is that the hardcoded IP addresses (202.114.4[.]119) are the same ones found in the online installation manuals for Contec and affiliated brands ( https://help.xchart.com/en/articles/7943824-configuring-edan-im-x-series-monitors-for-xchart-with-allink-xlink-adapter-box https://help.xchart.com/en/articles/7943824-configuring-edan... ). This was confirmed through firmware analysis: https://x.com/craiu/status/1885341007576801338 https://x.com/craiu/status/1885341007576801338 and in the manuals: https://infosec.exchange/@decio/113928319441297901 https://infosec.exchange/@decio/113928319441297901

59 points by doener 2y ago

Notably, the backdoor uploads data to an NFS share hosted on a university IP (the exact university has not been made clear). Data includes patient names, doctor names, date of birth, and the specific hospital department the patient is at.

Wololooo 2y ago
Someone is going to be going out of business soon and someone at a university is going to get very fired.
- numbsafari 2y ago
  > Contec Medical Systems Co., Ltd. (hereinafter referred to as CONTEC) focusing on research, manufacture and distribution of medical instruments, was founded in 1996 as a high-tech company. CONTEC locates in Economic & Technical Development Zone in Qinhuangdao covered an area of 125 acres and building area of over 100000 square meter, which is one of the largest bases for R & D and production of medical devices in China. https://contechealth.com/pages/company-introduction https://contechealth.com/pages/company-introduction I doubt it.
  - lenerdenator 2y ago
    I work in medical software. If you think the FDA or other regulating bodies wouldn't immediately tell care providers to yank these devices, you might be in for a surprise. What's more mysterious to me is why there's a back door in a device like this. Seems like a bizarre way to attack your enemy.
    - axus 2y ago
      Why attack people when you can exploit their data to make money. This is some growth "hacking" to make a list of sales leads.
      - lenerdenator 2y ago
        Because there are far, far simpler ways to figure out what a hospital wants, or what a patient needs to deal with their health needs. I'm going to bet that the completely legal practice of building a profile off of what a person has installed on their phone and their web searches is more effective than collecting their vitals and turning that into sales leads. You could just ask the health system what they need. That's what leads to a lot of our product initiatives. It almost makes me wonder if there's a component in the hardware or software that's shared with other devices manufactured in China that are better attack vectors and they just tossed it into this one because, hey, it works.
        numbsafari 2y ago
        The inverse of “defense in depth” is “flooding the zone”.
        M95D 2y ago
        Can't gather data new data from the phone if that person is in a coma. But, hey, now the relatives can get coffin adverts before the doctor brings the bad news! /s That backdoor, if it reports to a university, is probably put there to facilitate a study/diploma/phd or something like that.
- red_admiral 2y ago
  I doubt anyone at the university was involved, or is in trouble. I rather suspect that the university was told "put this on your network and don't ask too many questions".

Crosseye_Jack 2y ago

It also contains a out of bounds write, which could lead to RCE. https://www.cve.org/CVERecord?id=CVE-2024-12248 https://www.cve.org/CVERecord?id=CVE-2024-12248

deleted 2y ago

[deleted]

patrickhogan1 2y ago

1. Why wouldn’t CISA release the IP address? Blocking a specific IP is much easier for a hospital than patching or replacing every affected device. Some might argue that hospitals should just remove the device altogether, but CISA has stated that keeping the device and disabling its network capability is an acceptable solution. It seems very odd not to disclose the IP address. The only plausible explanation is that they want to monitor U.S.-based egress traffic to that IP. 2. The backdoor transmits data in plain text to a static IP address—something a competent hospital network administrator would have inevitably discovered.

decio 2y ago
The weird thing about this advisory is that the hardcoded IP addresses (202.114.4[.]119) are the same ones found in the online installation manuals for Contec and affiliated brands ( https://help.xchart.com/en/articles/7943824-configuring-edan-im-x-series-monitors-for-xchart-with-allink-xlink-adapter-box https://help.xchart.com/en/articles/7943824-configuring-edan... ). This was confirmed through firmware analysis: https://x.com/craiu/status/1885341007576801338 https://x.com/craiu/status/1885341007576801338 and in the manuals: https://infosec.exchange/@decio/113928319441297901 https://infosec.exchange/@decio/113928319441297901