8 ms·

It’s Easy to Hack Hospital Equipment

104 points by ghosh 13y ago

mentalhealth 13y ago
“Many hospitals are unaware of the high risk associated with these devices,” I assure you that while this is the hospital's official stance, many people within the hospital are well aware of the shoddy software on their medical devices and the risks they pose. There are so many opportunities for disruption of every aspect of the healthcare system (from the equipment itself, that this article addresses, to the electronic medical records systems, to more structural aspects of the healthcare system as a whole), but literally none of the incentives for practitioners and hospital administrators are properly aligned to make it possible. I'd love to work with a company trying to break into these markets if they had a plausible route to entry.
- daveslash 13y ago
  I agree with you - I'm sure there are people within the healthcare system who are aware of the situation but are probably not in a position to do anything about it. I'd also guess that this is one of those things where nothing will be done until there's a high-profile "incident". Security will probably end up being reactionary at first.
- bane 13y ago
  I almost wonder what a completely reimagined vertically integrated health care system would look and cost like.
  - Ntrails 13y ago
    Can you explain what you mean by "vertically integrated" in this context?
    - bane 13y ago
      I mean from every check-in to every release/death, all patient data is collected, tracked. All tests automatically end up in the patient file and every device a patient is hooked up to is part of the same "system". Spend time on an EKG? Every heart beat becomes part of this package. Every shot, every weigh-in, every blood pressure test. This should also tie in to inventory systems etc. Got the sniffles? The system shows you get them every year at this time, and that it's atypical of any other tracked infectious outbreak, but correlates to three cyclical natural events including a yearly mold growth that it turns out you're allergic to. End up incapacitates in the ER? System automatically notes your allergies and past medical history, allowing the ER folks to give you one pain medicine instead of the other one that will kill you. While you're there, all the respirators, etc. all get logged. Take 5 units of blood from 3 donors? All their histories are tracked and fed into your treatment in-case some blood-born illness they suffer from but passed screening shows up in your case. Blood test shows an abnormality? You get automatic trendlines showing either a progression of this abnormal result (blood sugar continues to get lower) or a weird spike, this way your doctor isn't just working off of one data point like usual. Every x-ray, cat scan etc. all get stored for later reference. The first cat scan your oncologist takes might not be the first cat scan she can refer to if you have one in your file? Right now, at least in the U.S., and with different insurances every year (meaning my doctor might change every year), I have to really go out of my way just to make sure my shot records follow me. Within one provider they do an okay job of tracking my medical history and getting x-rays from the x-ray machine to the wall mounted display in the evaluation room, but the moment I need to go to a hospital I'm pretty much filling out my history again by hand and from memory. Vertically integrated means dumping your medical history into Watson to see if some emergent patterns point to some underlying chronic illness you aren't even aware of and don't have notable symptoms yet.
- davidw 13y ago
  There's a market for disruption with some things, but it's mostly about doing more/better for less money. Security isn't really what most people are interested in paying for in many cases.
  - fixermark 13y ago
    In the medical space (at least in the U.S.), there's much less room for disruption relative to other markets. The market is significantly regulated / restricted; the law is structured so that even if the vendor and their potential patients both consent to a given transaction or procedure, the government can still step in and deny it. In essence, the laws are structured under the (not necessarily wrong) assumption that the consumer is too stupid to identify snake-oil. All an incumbent has to do to block a newcomer to the market is make a hard-to-deny snake-oil accusation.
- baldfat 13y ago
  TL&DR Regulations need to require interoperability and cross-platform with medical records and images. As a "Cancer Dad" the electronic medical records and images that are closed and inaccessible between my local hospital where we got our chemotherapy and the Children's Hospital where we did our major surgeries was mind blowingly crazy. I had to drive my bone cancer child 2.5 hours to use their equipment because there was an issue with the image file format. So I had to give my child enough pain killers to knock out a grown adult just so we could get the same pictures we could get 5 miles down the road.
  - commandar 13y ago
    As somebody working in healthcare integration, this may be small consolation, but it that's getting better. The HITECH act[1] (which was part of the stimulus package in 2009) has gone a long way in getting the industry moving. One of the core deadlines we're scrambling to meet at the moment at my hospital is actually data interchange between facilities, including a portal that allows patients to access their records for themselves. I realize that doesn't help your situation now, but with Medicare penalties looming for not getting that sort of exchange in place, things are starting to happen quickly in an industry that tends to move at a snail's pace. http://en.wikipedia.org/wiki/HITECH_Act#Electronic_Health_Records_.28EHR.29 http://en.wikipedia.org/wiki/HITECH_Act#Electronic_Health_Re...
    - HillRat 13y ago
      Out of curiosity, which HL7 CDAs (and which levels) do you support, and how much lift is it to set up import/export for a new provider or institution? I'm pessimistic that we'll be able to achieve true level 3 interoperability, even though the basic ontologies (e.g., SNOMED, LOINC, etc) are in place. I'd love to hear that you're having a good experience, though.
      - commandar 13y ago
        Honestly, that end of things is kind of out of my element; I'm mostly involved in the message plumbing side of things. Our actual HIE integration has been contracted out to Relay Health/McKesson. They're promising the world, but we're not far enough along for me to say whether they'll actually deliver at this point.
- HeyLaughingBoy 13y ago
  I agree. I led a team that added network connectivity to one of our high-value medical instruments and one of the highest hurdles to cross wasn't technical: it was getting the hospitals' IT departments to buy in. They are rightfully paranoid about anything connected to their network. Both for the security of the device itself (it stores thousands of patient test records) and the possibility of it being hostile to the rest of the network. tl;dr: Buyers may not care, but hospital IT certainly does.
ossama 13y ago
Scary, but this isn't surprising at all. What the hardware does in these cases is more important than the software that runs it. Couple that with devices that sell in relatively small quantities for high cost, and you get undertested, unstressed software.
gaurav_godhwani 13y ago
This is a serious concern, Government and NGOs should come together for ensuring proper security of hospital and healthcare systems and software. Also, any kind of data breach can result into national level threats.
hhsnopek 13y ago
I've been going to my local Defcon group for almost 2 years, and this isn't the first time this has been discovered. It's insane what could be done with the old tech in hospitals.
anigbrowl 13y ago
Although vendors often tell customers they can’t remove hard coded passwords from their devices or take other steps to secure their systems because it would require them to take the systems back to the FDA for approval afterward, Erven points out that the FDA guidelines for medical equipment includes a cybersecurity clause that allows a post-market device to be patched without requiring recertification by the FDA. These are the same people that have been complaining about how awful it is that the Affordable Care Act imposes a medical device tax. Maybe if they weren't so cavalier about deceiving their customers regulation and certification wouldn't cost as much as it does.
- EpicEng 13y ago
  I think you have to always assume that people can't be trusted to do the right thing when it comes to lives of others. The FDA has to employ policies which gives us a reasonable confidence that a vendor's device/test/whatever is safe and effective. Disclaimer: I have worked on FDA cleared medical devices my entire career.
  - dllthomas 13y ago
    I think most of the time you can trust people to do the right thing when it comes to the lives of others, when the right thing is sufficiently clear, when the fact that it involves the lives of others is sufficiently salient, and when there are not enormous incentives to do otherwise.
    - EpicEng 13y ago
      I'm not sure you took my meaning. Even if what you say is true, a regulating body must view everyone with skepticism. They have to walk into an audit/filing review with a "prove it to me" attitude else risk doing real harm to people.
      - dllthomas 13y ago
        I don't know that that's wrong. The two views are certainly compatible.
shmageggy 13y ago
Why was the title changed away from the original? This is getting too confusing. It used to read like the actual title: "It’s Insanely Easy to Hack Hospital Equipment"
- kijin 13y ago
  Calm down, they just removed an adverb whose only function was to exaggerate.
  - ASneakyFox 13y ago
    What's the point of rules if you don't follow them? So what if some one feels "insanely" exagerates it. Its the journalists opinion that it is insanely easy. That should be the title. I don't care if an hn moderator feels it is insanely easy or just easy to hack a hospital. IF he has an opinion on the difficulty to hack topic there is a comment section. The op is not a comment section for mods
    - pbhjpbhj 13y ago
      Hear, hear!
kijin 13y ago
How many of these devices are still running Windows XP? Weak default passwords on the web interface is just the icing on the cake, the low-hanging fruit. The entire networking stack is likely to be riddled with unpatched vulnerabilities for anyone to exploit. Relative obscurity and physical security are probably the only things that stand between hospital equipment and certain disaster.
- FLUX-YOU 13y ago
  >Relative obscurity and physical security are probably the only things that stand between hospital equipment and certain disaster. Even then, you can pop on a pair of scrubs and avoid most scrutiny. Keycard systems are there, but those aren't difficult. Sometimes the operating area doesn't have cameras and the area surrounding the 2 million dollar daVinci machines are deserted.
  - commandar 13y ago
    >Even then, you can pop on a pair of scrubs and avoid most scrutiny. Keycard systems are there, but those aren't difficult. Sometimes the operating area doesn't have cameras and the area surrounding the 2 million dollar daVinci machines are deserted. I can confirm this. I can also confirm that those daVinci machines are way less impressive looking in person than they are plastered on roadside billboards. :)
- commandar 13y ago
  >How many of these devices are still running Windows XP? A lot. I know we have telemetry systems that are all XP based. Granted, they're on a separate VLAN that doesn't touch the public internet or the rest of our internal network, but there are still physical security concerns there. >Weak default passwords on the web interface is just the icing on the cake, the low-hanging fruit. The entire networking stack is likely to be riddled with unpatched vulnerabilities for anyone to exploit. A major problem in healthcare is that vendors tend to use generic credentials for support purposes.
Cthulhu_ 13y ago
The thing with equipment like this is that security isn't a priority; "who would hack medical equipment?". A lack of high-profile cases where medical equipment was actively hacked is also not giving any incentive to fix these issues. Worst case, these exploits will suddenly be used to disable or cripple hospitals in case of dirty wars and terrorist campaigns. If the latter is still a problem.
- forgottenpass 13y ago
  Your comment is a few years out of date. The FDA has recently started caring, and there are high-enough profile cases to be on the industry's radar. It'll continue to be a mess for years to come, the introduction of new medical hardware and software is slow and I don't know how they plan to handle already deployed items. But not exactly for the reasons you state.
hessenwolf 13y ago
To be a dash risk managementy about it; (Risk of being hacked) x (severity of being hacked) << (Risk of software not delivered) x (severity of not delivered). (Risk of being hacked): Small. (Severity of being hacked): Very negative, but localised most likely to a single machine, set of machines, or hospital. (Risk of Software not Delivered): Pretty high if we go super-security. We are on a budget. There is competition. Who is paying for it? (Severity of not delivered): Failure to cure at every hospital for every machine. So, yes, there is a cost, but the benefit of ignoring security, for some sets of numbers on the above, could conceivably exceed it.
- lifeisstillgood 13y ago
  Whilst true, I can with 100% certainty, state that no-one in the medical profession, or the procurement people in the hospitals ever did that calculation. NICE (the UK's no-you-cant-spend-ten-million-of-taxpayers-money-per-patient-on-a-drug-to-extend-their-life-by-six-weeks agency which gets it in the neck for such things) might be able to take on such a calculation - but I bet you anything even if they did that calculation every machine maker would treble their security departments anyway. This is only possible because there was no pressure to deploy secure systems. Now there is, and after the first death from a hacked pacemaker, the outcry will be heard from the moon.
  - pbhjpbhj 13y ago
    >after the first death from a hacked pacemaker, the outcry will be heard from the moon // Isn't the problem that there will always be a way to kill people, even remotely without touching them (sniper, poison mail, gas bomb, massive microwave in a van that you park next to them, ...). You perhaps don't want to make it easy but it's also not necessarily sensible to waste money on an arms race that you'll never win. Similarly we don't have enclosed station platforms (in the UK) despite people having been pushed in front of trains in the past.
    - hagbardgroup 13y ago
      The difference being that it's tough to kill people at scale and covertly with a rifle or even poison mail. Exploiting a bug in networked pacemakers could give you the means to kill an entire userbase. For the train comparison, it's the difference between pushing a guy on the rails and derailing a train remotely by accelerating it remotely through a curve and disabling the manual controls. What's the value to the user of a networked pacemaker? Maybe a lower price? There would be better ways for it to 'speak' to a network to collect data, I should think.
bane 13y ago
In general the security on the equipment is because hideously high acquisition costs keeping most hobbyists out of fooling around with it. And most places with the equipment won't let somebody sit there and fool around with it. It's not quite security through obscurity, but more like security through expense.
- mbesto 13y ago
  I'm pretty sure this has less to do with high acquisition costs and more to do with the fact that you can basically kill someone if you start tinkering with hospital equipment.
- realo 13y ago
  Well... I think you should look more often on eBay: http://www.ebay.com/sch/i.html?_trksid=m570.l3201&_nkw=infusion+pump&_sacat=0 http://www.ebay.com/sch/i.html?_trksid=m570.l3201&_nkw=infus... => 49.99$ is not _that_ hideously high.
akama 13y ago
I was actually at the conference talk this guy gave about the subject last week and was talking to him about it the night before. If anyone has questions I can attempt to answer them. Also interesting to think about is if these devices are getting hacking and people are blaming it on malfunctions.
akama 13y ago
I was actually at the conference talk this guy gave about the subject last week and was talking to him about it the night before. If anyone has questions I can attempt to answer them. Also interesting to think about is if these devices are getting hacking and people are blaming it on malfunctions.
Robin_Message 13y ago
They also found surgery robots connected to internal networks. Although the robots generally have software firewalls to block connections to them, Erven and his team found that simply running an off-the-shelf vulnerability scanner against the firewall caused it to turn off and fail open. Wow, just wow. If someone ever hacks an active surgery robot it's going to be Saw meets Snow Crash, and not in a good way.
- FLUX-YOU 13y ago
  And with some hospitals still running Win XP, it's easy to get a foothold on their network!
  - bcostlow 13y ago
    I'm working in that space, and sampling from the ones I've dealt with, I'd replace some with most. Some of the ones I deal with are also running those XPs with old IE versions, 6 & 7. This is because they bought, then never upgraded, systems that won't run right with newer browsers.
peterfisher 13y ago
I guess no one listens to unencrypted pager traffic?
nnnnni 13y ago
Definitely not a surprise. I once had to hack a piece of medical equipment in order to make it print to a printer that was manufactured within the previous decade. The only one that it "officially supported" was from about 15 years before that day. The OS version (patches/updates included) was also that old.
yitchelle 13y ago
This kind of problems is going to be more prominent as "Internet of Things" starts to take off. I was rather concern about Nest, our cars, Fridges etc being connected to the Internet and, on some devices, the security is quite low. This article is shows an example of it.
- commandar 13y ago
  This is one of the reasons why, as a rule, biomed devices that directly interact with a patient are never connected to the public internet.
  - TheLoneWolfling 13y ago
    Which works until one of the devices networked with said biomed device uses a wireless link and someone brings in a cell phone. Airgaps are really hard to do correctly, as they have so many single points of failure.
jacquesm 13y ago
There is much lower hanging fruit (scada systems). http://en.wikipedia.org/wiki/SCADA http://en.wikipedia.org/wiki/SCADA I've seen a couple that used unencrypted UDP with bitfields representing the state of solenoids. Imagine what sending a series of all '1' and all '0' packets would do in terms of damage and panic.
scrabble 13y ago
In a recent hospital visit I noticed that the equipment in the room I was in had bluetooth connectivity enabled. And in fact had all the details you needed to connect to them via bluetooth taped to the sides of the machines. That made me a little worried.
snake_plissken 13y ago
Why does some of this stuff need be connected to a network? How often does a surgery robot need an OTA update?

104 points by ghosh 13y ago

“Many hospitals are unaware of the high risk associated with these devices,” I assure you that while this is the hospital's official stance, many people within the hospital are well aware of the shoddy software on their medical devices and the risks they pose. There are so many opportunities for disruption of every aspect of the healthcare system (from the equipment itself, that this article addresses, to the electronic medical records systems, to more structural aspects of the healthcare system as a whole), but literally none of the incentives for practitioners and hospital administrators are properly aligned to make it possible. I'd love to work with a company trying to break into these markets if they had a plausible route to entry.

daveslash 13y ago
I agree with you - I'm sure there are people within the healthcare system who are aware of the situation but are probably not in a position to do anything about it. I'd also guess that this is one of those things where nothing will be done until there's a high-profile "incident". Security will probably end up being reactionary at first.
bane 13y ago
I almost wonder what a completely reimagined vertically integrated health care system would look and cost like.
- Ntrails 13y ago
  Can you explain what you mean by "vertically integrated" in this context?
  - bane 13y ago
    I mean from every check-in to every release/death, all patient data is collected, tracked. All tests automatically end up in the patient file and every device a patient is hooked up to is part of the same "system". Spend time on an EKG? Every heart beat becomes part of this package. Every shot, every weigh-in, every blood pressure test. This should also tie in to inventory systems etc. Got the sniffles? The system shows you get them every year at this time, and that it's atypical of any other tracked infectious outbreak, but correlates to three cyclical natural events including a yearly mold growth that it turns out you're allergic to. End up incapacitates in the ER? System automatically notes your allergies and past medical history, allowing the ER folks to give you one pain medicine instead of the other one that will kill you. While you're there, all the respirators, etc. all get logged. Take 5 units of blood from 3 donors? All their histories are tracked and fed into your treatment in-case some blood-born illness they suffer from but passed screening shows up in your case. Blood test shows an abnormality? You get automatic trendlines showing either a progression of this abnormal result (blood sugar continues to get lower) or a weird spike, this way your doctor isn't just working off of one data point like usual. Every x-ray, cat scan etc. all get stored for later reference. The first cat scan your oncologist takes might not be the first cat scan she can refer to if you have one in your file? Right now, at least in the U.S., and with different insurances every year (meaning my doctor might change every year), I have to really go out of my way just to make sure my shot records follow me. Within one provider they do an okay job of tracking my medical history and getting x-rays from the x-ray machine to the wall mounted display in the evaluation room, but the moment I need to go to a hospital I'm pretty much filling out my history again by hand and from memory. Vertically integrated means dumping your medical history into Watson to see if some emergent patterns point to some underlying chronic illness you aren't even aware of and don't have notable symptoms yet.
davidw 13y ago
There's a market for disruption with some things, but it's mostly about doing more/better for less money. Security isn't really what most people are interested in paying for in many cases.
- fixermark 13y ago
  In the medical space (at least in the U.S.), there's much less room for disruption relative to other markets. The market is significantly regulated / restricted; the law is structured so that even if the vendor and their potential patients both consent to a given transaction or procedure, the government can still step in and deny it. In essence, the laws are structured under the (not necessarily wrong) assumption that the consumer is too stupid to identify snake-oil. All an incumbent has to do to block a newcomer to the market is make a hard-to-deny snake-oil accusation.
baldfat 13y ago
TL&DR Regulations need to require interoperability and cross-platform with medical records and images. As a "Cancer Dad" the electronic medical records and images that are closed and inaccessible between my local hospital where we got our chemotherapy and the Children's Hospital where we did our major surgeries was mind blowingly crazy. I had to drive my bone cancer child 2.5 hours to use their equipment because there was an issue with the image file format. So I had to give my child enough pain killers to knock out a grown adult just so we could get the same pictures we could get 5 miles down the road.
- commandar 13y ago
  As somebody working in healthcare integration, this may be small consolation, but it that's getting better. The HITECH act[1] (which was part of the stimulus package in 2009) has gone a long way in getting the industry moving. One of the core deadlines we're scrambling to meet at the moment at my hospital is actually data interchange between facilities, including a portal that allows patients to access their records for themselves. I realize that doesn't help your situation now, but with Medicare penalties looming for not getting that sort of exchange in place, things are starting to happen quickly in an industry that tends to move at a snail's pace. http://en.wikipedia.org/wiki/HITECH_Act#Electronic_Health_Records_.28EHR.29 http://en.wikipedia.org/wiki/HITECH_Act#Electronic_Health_Re...
  - HillRat 13y ago
    Out of curiosity, which HL7 CDAs (and which levels) do you support, and how much lift is it to set up import/export for a new provider or institution? I'm pessimistic that we'll be able to achieve true level 3 interoperability, even though the basic ontologies (e.g., SNOMED, LOINC, etc) are in place. I'd love to hear that you're having a good experience, though.
    - commandar 13y ago
      Honestly, that end of things is kind of out of my element; I'm mostly involved in the message plumbing side of things. Our actual HIE integration has been contracted out to Relay Health/McKesson. They're promising the world, but we're not far enough along for me to say whether they'll actually deliver at this point.
HeyLaughingBoy 13y ago
I agree. I led a team that added network connectivity to one of our high-value medical instruments and one of the highest hurdles to cross wasn't technical: it was getting the hospitals' IT departments to buy in. They are rightfully paranoid about anything connected to their network. Both for the security of the device itself (it stores thousands of patient test records) and the possibility of it being hostile to the rest of the network. tl;dr: Buyers may not care, but hospital IT certainly does.

ossama 13y ago

Scary, but this isn't surprising at all. What the hardware does in these cases is more important than the software that runs it. Couple that with devices that sell in relatively small quantities for high cost, and you get undertested, unstressed software.

gaurav_godhwani 13y ago

This is a serious concern, Government and NGOs should come together for ensuring proper security of hospital and healthcare systems and software. Also, any kind of data breach can result into national level threats.

hhsnopek 13y ago

I've been going to my local Defcon group for almost 2 years, and this isn't the first time this has been discovered. It's insane what could be done with the old tech in hospitals.

anigbrowl 13y ago

Although vendors often tell customers they can’t remove hard coded passwords from their devices or take other steps to secure their systems because it would require them to take the systems back to the FDA for approval afterward, Erven points out that the FDA guidelines for medical equipment includes a cybersecurity clause that allows a post-market device to be patched without requiring recertification by the FDA. These are the same people that have been complaining about how awful it is that the Affordable Care Act imposes a medical device tax. Maybe if they weren't so cavalier about deceiving their customers regulation and certification wouldn't cost as much as it does.

EpicEng 13y ago
I think you have to always assume that people can't be trusted to do the right thing when it comes to lives of others. The FDA has to employ policies which gives us a reasonable confidence that a vendor's device/test/whatever is safe and effective. Disclaimer: I have worked on FDA cleared medical devices my entire career.
- dllthomas 13y ago
  I think most of the time you can trust people to do the right thing when it comes to the lives of others, when the right thing is sufficiently clear, when the fact that it involves the lives of others is sufficiently salient, and when there are not enormous incentives to do otherwise.
  - EpicEng 13y ago
    I'm not sure you took my meaning. Even if what you say is true, a regulating body must view everyone with skepticism. They have to walk into an audit/filing review with a "prove it to me" attitude else risk doing real harm to people.
    - dllthomas 13y ago
      I don't know that that's wrong. The two views are certainly compatible.

shmageggy 13y ago

Why was the title changed away from the original? This is getting too confusing. It used to read like the actual title: "It’s Insanely Easy to Hack Hospital Equipment"

kijin 13y ago
Calm down, they just removed an adverb whose only function was to exaggerate.
- ASneakyFox 13y ago
  What's the point of rules if you don't follow them? So what if some one feels "insanely" exagerates it. Its the journalists opinion that it is insanely easy. That should be the title. I don't care if an hn moderator feels it is insanely easy or just easy to hack a hospital. IF he has an opinion on the difficulty to hack topic there is a comment section. The op is not a comment section for mods
  - pbhjpbhj 13y ago
    Hear, hear!

kijin 13y ago

How many of these devices are still running Windows XP? Weak default passwords on the web interface is just the icing on the cake, the low-hanging fruit. The entire networking stack is likely to be riddled with unpatched vulnerabilities for anyone to exploit. Relative obscurity and physical security are probably the only things that stand between hospital equipment and certain disaster.

FLUX-YOU 13y ago
>Relative obscurity and physical security are probably the only things that stand between hospital equipment and certain disaster. Even then, you can pop on a pair of scrubs and avoid most scrutiny. Keycard systems are there, but those aren't difficult. Sometimes the operating area doesn't have cameras and the area surrounding the 2 million dollar daVinci machines are deserted.
- commandar 13y ago
  >Even then, you can pop on a pair of scrubs and avoid most scrutiny. Keycard systems are there, but those aren't difficult. Sometimes the operating area doesn't have cameras and the area surrounding the 2 million dollar daVinci machines are deserted. I can confirm this. I can also confirm that those daVinci machines are way less impressive looking in person than they are plastered on roadside billboards. :)
commandar 13y ago
>How many of these devices are still running Windows XP? A lot. I know we have telemetry systems that are all XP based. Granted, they're on a separate VLAN that doesn't touch the public internet or the rest of our internal network, but there are still physical security concerns there. >Weak default passwords on the web interface is just the icing on the cake, the low-hanging fruit. The entire networking stack is likely to be riddled with unpatched vulnerabilities for anyone to exploit. A major problem in healthcare is that vendors tend to use generic credentials for support purposes.

Cthulhu_ 13y ago

The thing with equipment like this is that security isn't a priority; "who would hack medical equipment?". A lack of high-profile cases where medical equipment was actively hacked is also not giving any incentive to fix these issues. Worst case, these exploits will suddenly be used to disable or cripple hospitals in case of dirty wars and terrorist campaigns. If the latter is still a problem.

forgottenpass 13y ago
Your comment is a few years out of date. The FDA has recently started caring, and there are high-enough profile cases to be on the industry's radar. It'll continue to be a mess for years to come, the introduction of new medical hardware and software is slow and I don't know how they plan to handle already deployed items. But not exactly for the reasons you state.

hessenwolf 13y ago

To be a dash risk managementy about it; (Risk of being hacked) x (severity of being hacked) << (Risk of software not delivered) x (severity of not delivered). (Risk of being hacked): Small. (Severity of being hacked): Very negative, but localised most likely to a single machine, set of machines, or hospital. (Risk of Software not Delivered): Pretty high if we go super-security. We are on a budget. There is competition. Who is paying for it? (Severity of not delivered): Failure to cure at every hospital for every machine. So, yes, there is a cost, but the benefit of ignoring security, for some sets of numbers on the above, could conceivably exceed it.

lifeisstillgood 13y ago
Whilst true, I can with 100% certainty, state that no-one in the medical profession, or the procurement people in the hospitals ever did that calculation. NICE (the UK's no-you-cant-spend-ten-million-of-taxpayers-money-per-patient-on-a-drug-to-extend-their-life-by-six-weeks agency which gets it in the neck for such things) might be able to take on such a calculation - but I bet you anything even if they did that calculation every machine maker would treble their security departments anyway. This is only possible because there was no pressure to deploy secure systems. Now there is, and after the first death from a hacked pacemaker, the outcry will be heard from the moon.
- pbhjpbhj 13y ago
  >after the first death from a hacked pacemaker, the outcry will be heard from the moon // Isn't the problem that there will always be a way to kill people, even remotely without touching them (sniper, poison mail, gas bomb, massive microwave in a van that you park next to them, ...). You perhaps don't want to make it easy but it's also not necessarily sensible to waste money on an arms race that you'll never win. Similarly we don't have enclosed station platforms (in the UK) despite people having been pushed in front of trains in the past.
  - hagbardgroup 13y ago
    The difference being that it's tough to kill people at scale and covertly with a rifle or even poison mail. Exploiting a bug in networked pacemakers could give you the means to kill an entire userbase. For the train comparison, it's the difference between pushing a guy on the rails and derailing a train remotely by accelerating it remotely through a curve and disabling the manual controls. What's the value to the user of a networked pacemaker? Maybe a lower price? There would be better ways for it to 'speak' to a network to collect data, I should think.

bane 13y ago

In general the security on the equipment is because hideously high acquisition costs keeping most hobbyists out of fooling around with it. And most places with the equipment won't let somebody sit there and fool around with it. It's not quite security through obscurity, but more like security through expense.

mbesto 13y ago
I'm pretty sure this has less to do with high acquisition costs and more to do with the fact that you can basically kill someone if you start tinkering with hospital equipment.
realo 13y ago
Well... I think you should look more often on eBay: http://www.ebay.com/sch/i.html?_trksid=m570.l3201&_nkw=infusion+pump&_sacat=0 http://www.ebay.com/sch/i.html?_trksid=m570.l3201&_nkw=infus... => 49.99$ is not _that_ hideously high.

akama 13y ago

I was actually at the conference talk this guy gave about the subject last week and was talking to him about it the night before. If anyone has questions I can attempt to answer them. Also interesting to think about is if these devices are getting hacking and people are blaming it on malfunctions.

akama 13y ago

Robin_Message 13y ago

They also found surgery robots connected to internal networks. Although the robots generally have software firewalls to block connections to them, Erven and his team found that simply running an off-the-shelf vulnerability scanner against the firewall caused it to turn off and fail open. Wow, just wow. If someone ever hacks an active surgery robot it's going to be Saw meets Snow Crash, and not in a good way.

FLUX-YOU 13y ago
And with some hospitals still running Win XP, it's easy to get a foothold on their network!
- bcostlow 13y ago
  I'm working in that space, and sampling from the ones I've dealt with, I'd replace some with most. Some of the ones I deal with are also running those XPs with old IE versions, 6 & 7. This is because they bought, then never upgraded, systems that won't run right with newer browsers.

peterfisher 13y ago

I guess no one listens to unencrypted pager traffic?

nnnnni 13y ago

Definitely not a surprise. I once had to hack a piece of medical equipment in order to make it print to a printer that was manufactured within the previous decade. The only one that it "officially supported" was from about 15 years before that day. The OS version (patches/updates included) was also that old.

yitchelle 13y ago

This kind of problems is going to be more prominent as "Internet of Things" starts to take off. I was rather concern about Nest, our cars, Fridges etc being connected to the Internet and, on some devices, the security is quite low. This article is shows an example of it.

commandar 13y ago
This is one of the reasons why, as a rule, biomed devices that directly interact with a patient are never connected to the public internet.
- TheLoneWolfling 13y ago
  Which works until one of the devices networked with said biomed device uses a wireless link and someone brings in a cell phone. Airgaps are really hard to do correctly, as they have so many single points of failure.

jacquesm 13y ago

There is much lower hanging fruit (scada systems). http://en.wikipedia.org/wiki/SCADA http://en.wikipedia.org/wiki/SCADA I've seen a couple that used unencrypted UDP with bitfields representing the state of solenoids. Imagine what sending a series of all '1' and all '0' packets would do in terms of damage and panic.

scrabble 13y ago

In a recent hospital visit I noticed that the equipment in the room I was in had bluetooth connectivity enabled. And in fact had all the details you needed to connect to them via bluetooth taped to the sides of the machines. That made me a little worried.

snake_plissken 13y ago

Why does some of this stuff need be connected to a network? How often does a surgery robot need an OTA update?