DHS notifies of vulnerabilities in hospital medical devices
Has your doctor’s anesthesia apparatus been hacked?
The US Department of Homeland Security has notified hospitals and health centers that many of the electronic medical devices in use at their facilities may be vulnerable to cyber-security attacks.
The affected machines include surgical and anesthesia devices, ventilators, drug infusion pumps, external defibrillators, patient monitors, laboratory and analysis equipment, and more, according to an alert published on Thursday by the DHS’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT).
The problem ? Many of these devices were built with hard-coded passwords that could allow hackers with information of the manufacturer’s practices to alter their settings or install rogue firmware, the report states.
This isn’t the first time security researchers have uncovered vulnerabilities in medical stuff. A number of potential attacks on such implanted devices as pacemakers, defibrillators, and insulin pumps have been identified. But Thursday’s warning is the first to raise the issue that external equipment may also be vulnerable – and a great deal of it, to boot.
To lessen the likelihood of attacks, ICS-CERT recommends that healthcare facilities take whatever steps they can to separate medical devices from the internet and even from the business LAN, including placing them behind firewalls and using VPNs for access where possible.
Physical access to medical equipment by the general public should also be restricted, and any ports that could be used to update a device’s firmware should be protected.
ICS-CERT further recommends that hospital staffers familiarize themselves with the best practices for industrial control system security found on the US-CERT website – noting that, although medical devices are not technically industrial control systems, many of the same recommendations apply.
If there’s a silver lining to all of this talk, however, it’s that attacks on medical devices are so far mainly hypothetical – as far as we know, at any rate.”The FDA is not aware of any patient injuries or deaths connected with these incidents,” the agency’s bulletin states, “nor do we have any indication that any specific devices or systems in clinical use have been purposely targeted at this time.”
Chat With Our System Analyst To Remove All Kinds Of Threats And Get Online Technical Support.