10 ms·

CVE-2015-3459 – Hospira Lifecare PCA Infusion Pump

152 points by aburan28 12y ago

mherdeg 12y ago
I wonder how long it's going to be before we see state-level actors exploit these kinds of security holes. To be sure, there are already a lot of ways to incapacitate or hurt someone. But abusing software bugs in a person's medical devices might be a less traceable way to disrupt their activity.
- TheLoneWolfling 12y ago
  Why bother with medical devices? Just lock on their driver-side brakes when they're on the highway. Bonus: car accidents are common enough that it'd be unlikely to be noticed.
  - higherpurpose 12y ago
    Malicious hackers are going to have so much "fun" with always-connected self-driving cars that get OTA updates that can "upgrade" their engines, or breaks, etc. Also I imagine CIA would largely be made redundant as the NSA can just take over the assassinations from there.
  - flashman 12y ago
    You'll have to be more subtle than that. A crash investigator is going to notice asymmetric skid patterns and brake disc damage.
    - r00fus 12y ago
      For plausible deniability on extrajudicial actions, I thought "drug overdose" and "murder/suicide" were the preferred means. That's assuming the agency committing the act doesn't have readily handy poisons that degrade within hours and are thus untraceable. Combine with car accident and you have a large mess to uncover, further decreasing likelihood of discovery.
- duaneb 12y ago
  > I wonder how long it's going to be before we see state-level actors exploit these kinds of security holes. Sounds like a political nightmare for little gain. I would be more worried about ransom-oriented terrorists.
  - jMyles 12y ago
    > state-level actors > ransom-oriented terrorists Sadly, INTERSECT on these groups yields a non-trivial set of results.
xooxies 12y ago
This is completely unacceptable. There really should be more pentesting of medical gear and industrial control systems in general.
- blueintegral 12y ago
  It's surprising that the FDA doesn't require that as part of their certification procedure.
  - asuffield 12y ago
    I can think of many words to describe my reaction to this, but "surprise" is not one of them. I have never seen a regulatory body impose any meaningful security testing. Even supposedly "secure" standards are often self-certified, not tested.
- TheLoneWolfling 12y ago
  I'd argue that the very fact that it's physically possible to hack these sort of devices is a huge red flag. There shouldn't be pentesting, because there shouldn't be anything to pentest. Something like a medical device, you keep the outside communication part airgapped from anything that could cause harm. If that means you have to duplicate things, then it means you have to duplicate things.
  - moyix 12y ago
    Implantable devices typically have to have a wireless interface of some sort. The alternative is to put a physical port on someone's body, which is a great way to cause infections.
    - amyjess 12y ago
      But... but... I want a datajack at the base of my skull!
      - 12y ago
Zikes 12y ago
Not that this isn't a nasty security hole, but I should hope that this sort of equipment is firewalled at least.
- michaelt 12y ago
  "Hope", yes. But if there are products with unencrypted no-auth telnet, I'm not sure we can assume everyone is following industry-standard best practices :)
- achillean 12y ago
  Glucose meters and pumps similar to this one have already been found on Shodan :-/ The majority aren't directly on the Internet but it happens. There has actually been an increase in the number of hospitals that are showing up online.
- ceejayoz 12y ago
  > Not that this isn't a nasty security hole, but I should hope that this sort of equipment is firewalled at least. Won't do you much good if an attacker makes an open Wifi point with the same SSID as the hospital's network.
  - hueving 12y ago
    >Won't do you much good if an attacker makes an open Wifi point with the same SSID as the hospital's network. For that to work the hospital's SSID would have to be open as well. And if that were the case, faking the SSID would be a complete waste of time because you could just connect to it yourself.
    - zurn 12y ago
      You vastly overestimate the difficulty of spoofing a password-protected wifi network. Even without that, acquiring access credentials is hardly rocket science. (eg. grab one of these pumps or any other wifi device lying around and read the password over the ethernet/serial port)
teuobk 12y ago
Here's the bad news: after spending a decade working in the medical device industry, I can say that security is not always a high priority in medical device designs. I don't think the situation is likely to get better until the FDA starts requiring security audits as a condition of approval -- and for 510(k)s too, not just for PMAs.
- wyldfire 12y ago
  > I can say that security is not always a high priority in medical device designs. Agreed. But it's because generally it's not (yet?) a problem.
dlnovell 12y ago
I worked for Hospira last year on the Plum A+ and 360 infusion pumps but not the PCA. I'm a little surprised such a blatant security hole wasn't caught, considering the magnitude of the regulatory environment we worked under. I'd never worked in that kind of environment before, and I left shortly after a successfully defended audit of our software development and tracking process and systems. (Although how successful is the development and tracking process if a year later this "bug" comes out?) My guess is that because we were beaten over the head day in and day out focusing on "if this software delivers the wrong medication the patient is probably going to die", and "if you make a mistake in the development process and in change tracking we can lose the ability to make these devices" that the idea of defending against malicious intent was de-emphasized/overlooked.
- lifeisstillgood 12y ago
  This is most likely the problem - the number of cases where patients die from drug delivery mistakes is probably in thousands if not tens of thousands. The cases where someone deliberately administers a dose, via a machine are likely to be zero (because I have not heard of them) So any cost benefit or risk analysis is going to worry about the drug.
- voidlogic 12y ago
  Question unrelated to the stupidity of supporting telnet as protocol on these devices- Did you guys use formal verification techniques? http://en.wikipedia.org/wiki/Formal_verification http://en.wikipedia.org/wiki/Formal_verification
  - voidlogic 12y ago
    If some one would explain the down-voting to me, I'd love to understand... honestly 1. My question was unrelated to the poor decision the OPs former employer made to use telnet. 2. Formal verification the the gold standard in correctness often used for can't fail things like missiles and satellites.
    - sfeng 12y ago
lifeisstillgood 12y ago
tl;dr - drug pump has no authentication on telnet port This is the brochure page for this family of products (http://www.hospira.com/en/products_and_services/infusion_pumps/Lifecare/ http://www.hospira.com/en/products_and_services/infusion_pum...) and the one that stands out a mile is - Robust wireless capabilities enable remote drug library updates the product itself (let's assume it's top notch medical hardware, I am afraid I cannot comment usefully) works fine, and has been battle tested and built by veterans. But the second they add network access they are hit by a double whammy ... Actually I have rewritten this three times, and really I can find no excuse for this. Selling to moronic sysadmins - "hey easy to use web front end with passwords or even client certs). I can only assume the argument runs like this - if we make it hard to do X over the network, and X does not happen, chances of someone dying are y%. If we bollox security, then X is sooo easy to do, and we just save y% of lives. Now that is "tragedy of the commons" in sheeps clothing, but I can see it may be the only excuse you have
vesinisa 12y ago
It's essentially a device for automatic delivery of pain killers when the patient presses a button. Why on earth would such device even require network connectivity? They advertise "wireless capabilities for remote drug library update". But "wireless capability" is a whole new engineering domain, and the manufacturer seems to have failed to even begin to address it properly.
- ryanmarsh 12y ago
  Just because you cannot envision a particular use case does not mean that it is not a valuable one. Fist off a large hospital will have drugs that are "formulary", meaning drugs doctors are allowed to prescribe and the in-house pharmacy fill. These lists need to be updated, imagine you have thousands of these pumps on premises. Now imagine you also have to do inventory management. Now imagine you have these pumps wired in with your nurse calling system (for when infusion is complete or the device is empty). Edit: usually you pick the drug from a list on the interface when programming it. I'm not familiar with this pump but I've used many like it.
- forgottenpass 12y ago
  Why on earth would such device even require network connectivity? Convenience features sell. It looks like these devices might just push down delivery limits over the network, but the connectivity of medical devices is in the process of exploding. The market forces for software in general don't magically not apply to medical software/devices. Of all the software out there that sends telemetry back to base, medical devices are probably one of the easiest to justify and least morally dubious types of user monitoring around.
moe 12y ago
Was anyone else reminded of that 'Homeland' episode?
smutticus 12y ago
Is anyone else dissatisfied with the amount of information we get in many sec bug reports? Almost everytime I read a CVE or other vulnerability I find myself with more questions than answers. There's so little information given. Is telnet on by default? Is this device normally plugged into a network, for how long? How common is this device? Has it been on the market for long? Without this kind of information it's very difficult to assess risk, or otherwise form an opinion.
- adt2bt 12y ago
  On the other hand, for potentially significant security holes, answering those questions would make attacking the devices easy. I imagine more detail will come out in a postmortem once the affected devices are updated. I may be overly optimistic, though..
  - dyngnosis 12y ago
    I've got a full advisory written up. It is unclear if the vendor will patching the device. When I get that cleared up I'll have a full advisory for everyone. In the meantime if you need something answered urgently you can contact me directly.
  - flashman 12y ago
    Hopefully not a literal post mortem.
- dyngnosis 12y ago
  Telnet is on by default. It is a busybox shell. This device is normally connected to a network via wifi. There is an additional Ethernet port on the back. It is safe to say every patient using one of these has physical access. The wireless encryption keys are stored in plain text.
totallynotcool 12y ago
I don't think we have any of our equipment in the OR networked other than commo devices; phones, video, et. al. I do know of some dental tools that use bluetooth to sync drills with a nurses cell so they can change the settings for the docs but 'hacking' that wouldn't lead to any unrecoverable harm... unless, of course, you could turn the drill on via blue tooth
NamTaf 12y ago
"Robust wireless capabilities enable remote drug library updates" [1] What do they mean by 'robust'? You can rely on it to be there whenever you want to hack someone to death? [1] http://www.hospira.com/en/products_and_services/infusion_pumps/Lifecare/ http://www.hospira.com/en/products_and_services/infusion_pum...
- abecedarius 12y ago
  I mentally translate 'robust' to 'fancy' -- the dictionary meaning I grew up with being so rarely used correctly now.
zurn 12y ago
So is the procurement process in medical organizations so feeble that nobody notices these, or is there such widespread apathy about this state of affairs that it all gets ignored, or is there some kind of culture of secrecy that results in even these life threatening cases to be kept quiet between the hospital and the equipment salesman?
sspiff 12y ago
I was thinking this is bad, but this thing is running a 2.4 kernel, so it's probably just a wired ethernet port on the back of the device. Limited but dangerous potential here. Nope, it's a thousands times worse. This devices has WiFi. You don't even need to plug a cable in the back. I can't find how the wireless is configured in their manual[1], but they clearly mention Wireless LAN. [1]: http://www.meql.com/Manuals/Abbott-Hospira-PCA-III-Mednet-User-Manual.pdf http://www.meql.com/Manuals/Abbott-Hospira-PCA-III-Mednet-Us...
theskyisfalling 12y ago
Of all the bad things that can happen to a patient connected to an infusion pump, being hacked is way way down the list.

152 points by aburan28 12y ago

I wonder how long it's going to be before we see state-level actors exploit these kinds of security holes. To be sure, there are already a lot of ways to incapacitate or hurt someone. But abusing software bugs in a person's medical devices might be a less traceable way to disrupt their activity.

TheLoneWolfling 12y ago
Why bother with medical devices? Just lock on their driver-side brakes when they're on the highway. Bonus: car accidents are common enough that it'd be unlikely to be noticed.
- higherpurpose 12y ago
  Malicious hackers are going to have so much "fun" with always-connected self-driving cars that get OTA updates that can "upgrade" their engines, or breaks, etc. Also I imagine CIA would largely be made redundant as the NSA can just take over the assassinations from there.
- flashman 12y ago
  You'll have to be more subtle than that. A crash investigator is going to notice asymmetric skid patterns and brake disc damage.
  - r00fus 12y ago
    For plausible deniability on extrajudicial actions, I thought "drug overdose" and "murder/suicide" were the preferred means. That's assuming the agency committing the act doesn't have readily handy poisons that degrade within hours and are thus untraceable. Combine with car accident and you have a large mess to uncover, further decreasing likelihood of discovery.
duaneb 12y ago
> I wonder how long it's going to be before we see state-level actors exploit these kinds of security holes. Sounds like a political nightmare for little gain. I would be more worried about ransom-oriented terrorists.
- jMyles 12y ago
  > state-level actors > ransom-oriented terrorists Sadly, INTERSECT on these groups yields a non-trivial set of results.

xooxies 12y ago

This is completely unacceptable. There really should be more pentesting of medical gear and industrial control systems in general.

blueintegral 12y ago
It's surprising that the FDA doesn't require that as part of their certification procedure.
- asuffield 12y ago
  I can think of many words to describe my reaction to this, but "surprise" is not one of them. I have never seen a regulatory body impose any meaningful security testing. Even supposedly "secure" standards are often self-certified, not tested.
TheLoneWolfling 12y ago
I'd argue that the very fact that it's physically possible to hack these sort of devices is a huge red flag. There shouldn't be pentesting, because there shouldn't be anything to pentest. Something like a medical device, you keep the outside communication part airgapped from anything that could cause harm. If that means you have to duplicate things, then it means you have to duplicate things.
- moyix 12y ago
  Implantable devices typically have to have a wireless interface of some sort. The alternative is to put a physical port on someone's body, which is a great way to cause infections.
  - amyjess 12y ago
    But... but... I want a datajack at the base of my skull!
    - 12y ago

Zikes 12y ago

Not that this isn't a nasty security hole, but I should hope that this sort of equipment is firewalled at least.

michaelt 12y ago
"Hope", yes. But if there are products with unencrypted no-auth telnet, I'm not sure we can assume everyone is following industry-standard best practices :)
achillean 12y ago
Glucose meters and pumps similar to this one have already been found on Shodan :-/ The majority aren't directly on the Internet but it happens. There has actually been an increase in the number of hospitals that are showing up online.
ceejayoz 12y ago
> Not that this isn't a nasty security hole, but I should hope that this sort of equipment is firewalled at least. Won't do you much good if an attacker makes an open Wifi point with the same SSID as the hospital's network.
- hueving 12y ago
  >Won't do you much good if an attacker makes an open Wifi point with the same SSID as the hospital's network. For that to work the hospital's SSID would have to be open as well. And if that were the case, faking the SSID would be a complete waste of time because you could just connect to it yourself.
  - zurn 12y ago
    You vastly overestimate the difficulty of spoofing a password-protected wifi network. Even without that, acquiring access credentials is hardly rocket science. (eg. grab one of these pumps or any other wifi device lying around and read the password over the ethernet/serial port)

teuobk 12y ago

Here's the bad news: after spending a decade working in the medical device industry, I can say that security is not always a high priority in medical device designs. I don't think the situation is likely to get better until the FDA starts requiring security audits as a condition of approval -- and for 510(k)s too, not just for PMAs.

wyldfire 12y ago
> I can say that security is not always a high priority in medical device designs. Agreed. But it's because generally it's not (yet?) a problem.

dlnovell 12y ago

I worked for Hospira last year on the Plum A+ and 360 infusion pumps but not the PCA. I'm a little surprised such a blatant security hole wasn't caught, considering the magnitude of the regulatory environment we worked under. I'd never worked in that kind of environment before, and I left shortly after a successfully defended audit of our software development and tracking process and systems. (Although how successful is the development and tracking process if a year later this "bug" comes out?) My guess is that because we were beaten over the head day in and day out focusing on "if this software delivers the wrong medication the patient is probably going to die", and "if you make a mistake in the development process and in change tracking we can lose the ability to make these devices" that the idea of defending against malicious intent was de-emphasized/overlooked.

lifeisstillgood 12y ago
This is most likely the problem - the number of cases where patients die from drug delivery mistakes is probably in thousands if not tens of thousands. The cases where someone deliberately administers a dose, via a machine are likely to be zero (because I have not heard of them) So any cost benefit or risk analysis is going to worry about the drug.
voidlogic 12y ago
Question unrelated to the stupidity of supporting telnet as protocol on these devices- Did you guys use formal verification techniques? http://en.wikipedia.org/wiki/Formal_verification http://en.wikipedia.org/wiki/Formal_verification
- voidlogic 12y ago
  If some one would explain the down-voting to me, I'd love to understand... honestly 1. My question was unrelated to the poor decision the OPs former employer made to use telnet. 2. Formal verification the the gold standard in correctness often used for can't fail things like missiles and satellites.
  - sfeng 12y ago

lifeisstillgood 12y ago

tl;dr - drug pump has no authentication on telnet port This is the brochure page for this family of products (http://www.hospira.com/en/products_and_services/infusion_pumps/Lifecare/ http://www.hospira.com/en/products_and_services/infusion_pum...) and the one that stands out a mile is - Robust wireless capabilities enable remote drug library updates the product itself (let's assume it's top notch medical hardware, I am afraid I cannot comment usefully) works fine, and has been battle tested and built by veterans. But the second they add network access they are hit by a double whammy ... Actually I have rewritten this three times, and really I can find no excuse for this. Selling to moronic sysadmins - "hey easy to use web front end with passwords or even client certs). I can only assume the argument runs like this - if we make it hard to do X over the network, and X does not happen, chances of someone dying are y%. If we bollox security, then X is sooo easy to do, and we just save y% of lives. Now that is "tragedy of the commons" in sheeps clothing, but I can see it may be the only excuse you have

vesinisa 12y ago

It's essentially a device for automatic delivery of pain killers when the patient presses a button. Why on earth would such device even require network connectivity? They advertise "wireless capabilities for remote drug library update". But "wireless capability" is a whole new engineering domain, and the manufacturer seems to have failed to even begin to address it properly.

ryanmarsh 12y ago
Just because you cannot envision a particular use case does not mean that it is not a valuable one. Fist off a large hospital will have drugs that are "formulary", meaning drugs doctors are allowed to prescribe and the in-house pharmacy fill. These lists need to be updated, imagine you have thousands of these pumps on premises. Now imagine you also have to do inventory management. Now imagine you have these pumps wired in with your nurse calling system (for when infusion is complete or the device is empty). Edit: usually you pick the drug from a list on the interface when programming it. I'm not familiar with this pump but I've used many like it.
forgottenpass 12y ago
Why on earth would such device even require network connectivity? Convenience features sell. It looks like these devices might just push down delivery limits over the network, but the connectivity of medical devices is in the process of exploding. The market forces for software in general don't magically not apply to medical software/devices. Of all the software out there that sends telemetry back to base, medical devices are probably one of the easiest to justify and least morally dubious types of user monitoring around.

moe 12y ago

Was anyone else reminded of that 'Homeland' episode?

smutticus 12y ago

Is anyone else dissatisfied with the amount of information we get in many sec bug reports? Almost everytime I read a CVE or other vulnerability I find myself with more questions than answers. There's so little information given. Is telnet on by default? Is this device normally plugged into a network, for how long? How common is this device? Has it been on the market for long? Without this kind of information it's very difficult to assess risk, or otherwise form an opinion.

adt2bt 12y ago
On the other hand, for potentially significant security holes, answering those questions would make attacking the devices easy. I imagine more detail will come out in a postmortem once the affected devices are updated. I may be overly optimistic, though..
- dyngnosis 12y ago
  I've got a full advisory written up. It is unclear if the vendor will patching the device. When I get that cleared up I'll have a full advisory for everyone. In the meantime if you need something answered urgently you can contact me directly.
- flashman 12y ago
  Hopefully not a literal post mortem.
dyngnosis 12y ago
Telnet is on by default. It is a busybox shell. This device is normally connected to a network via wifi. There is an additional Ethernet port on the back. It is safe to say every patient using one of these has physical access. The wireless encryption keys are stored in plain text.

totallynotcool 12y ago

I don't think we have any of our equipment in the OR networked other than commo devices; phones, video, et. al. I do know of some dental tools that use bluetooth to sync drills with a nurses cell so they can change the settings for the docs but 'hacking' that wouldn't lead to any unrecoverable harm... unless, of course, you could turn the drill on via blue tooth

NamTaf 12y ago

"Robust wireless capabilities enable remote drug library updates" [1] What do they mean by 'robust'? You can rely on it to be there whenever you want to hack someone to death? [1] http://www.hospira.com/en/products_and_services/infusion_pumps/Lifecare/ http://www.hospira.com/en/products_and_services/infusion_pum...

abecedarius 12y ago
I mentally translate 'robust' to 'fancy' -- the dictionary meaning I grew up with being so rarely used correctly now.

zurn 12y ago

So is the procurement process in medical organizations so feeble that nobody notices these, or is there such widespread apathy about this state of affairs that it all gets ignored, or is there some kind of culture of secrecy that results in even these life threatening cases to be kept quiet between the hospital and the equipment salesman?

sspiff 12y ago

I was thinking this is bad, but this thing is running a 2.4 kernel, so it's probably just a wired ethernet port on the back of the device. Limited but dangerous potential here. Nope, it's a thousands times worse. This devices has WiFi. You don't even need to plug a cable in the back. I can't find how the wireless is configured in their manual[1], but they clearly mention Wireless LAN. [1]: http://www.meql.com/Manuals/Abbott-Hospira-PCA-III-Mednet-User-Manual.pdf http://www.meql.com/Manuals/Abbott-Hospira-PCA-III-Mednet-Us...

theskyisfalling 12y ago

Of all the bad things that can happen to a patient connected to an infusion pump, being hacked is way way down the list.