Hospital Equipment Infected With Conficker

nandemoari writes "Recently, the Conficker/Downadup worm infected several hundred machines and critical medical equipment in an undisclosed number of US hospitals. The attacks were not widespread; however, Marcus Sachs, director of the SANS Internet Storm Center, told CNET News that it raises the awareness of what we would do if there were millions of computers infected in hospitals or in critical infrastructure locations. It's not clear how the devices (including heart monitors, MRI machines and PCs) got infected. Infected computers were running Windows NT and Windows 2000 in a local area network (LAN) that wasn't supposed to be Internet accessible, but the LAN was connected to one with direct Internet access. A patch was released by Microsoft last October that fixes the problem, but the computers infected were reportedly too old to be patched."

Comments

Old Computers

[Jesterace]

I'm surprised that NT4 is still run. But then again I often see it running on older equipment in stores, call centers and hospitals I guess.

Re:Old Computers

[BSAtHome]

Medical equipment has a very long lifespan. Many devices for measurement and monitoring are used for 10 to 20 years before replacement. The general policy is "if it works, don't fix it and, more important, do not touch it".
The real problem is that most suppliers of equipment are reluctant to support any type of patches. Many of the suppliers explicitly state that the machines may not be changed in any way (and that includes patching the OS) or you will lose all guarantee and support.

Re:Old Computers

[painandgreed]

It's not like they can just upgrade the computer. The computer is running software that goes with specialized equipment. They'd have to upgrade everything if they upgraded anything and with that you could easily be talking millions of dollars. That might not be really needed as the machine should run just as well as it did with they bought it if it hasn't broke. If it's a smaller hospital, they might not have the budget to replace non-broken machines that still preform within needed specs, especially in this economic climate. Add in that some of these machines need to be FDA tested and are only supported by the manufactuer and that makes it even more expensive and harder to upgrade. Then, on many of these machines, the users might not even know they're running on NT4 as the software they run takes up the entire screen and they never actually interact with Windows at all.

I work in healthcare and I'm not surprised at all. Within the last year we just got rid of a Win95 system that was still talking over Novell networking, our Vax system, and a bunch of Sun Sparq stations. We still have plenty of Win2k and probably some WinNT4 around. We also have one of the most advanced set ups in the country, but legacy systems still exist for lots of reasons. First off, if it still works, management is not likely to want to get rid of it unless you make a good case for a good ROI. They're all old and aren't used to replacing major hospital systems that aren't broke especially if the new system doesn't offer any advantages. Budgets are always a problem because if the department isn't bringing in enough money to warrant new equipment, they might not get it. Then there are the vendors. perhaps GE, Fuji, or Cerner are happy with their old system or wants to sell you lots of stuff you don't want or need to replace one bit that is still running on old server tech just fine, so you effectively can't upgrade even if you wanted to.

Re:Old Computers

[causality]

Medical equipment has a very long lifespan. Many devices for measurement and monitoring are used for 10 to 20 years before replacement. The general policy is "if it works, don't fix it and, more important, do not touch it". The real problem is that most suppliers of equipment are reluctant to support any type of patches. Many of the suppliers explicitly state that the machines may not be changed in any way (and that includes patching the OS) or you will lose all guarantee and support.

Doesn't Microsoft itself say (perhaps in the EULA disclaimer) that its operating systems were not intended to be used in this sort of mission-critical capacity? That could of course have a very narrow definition, something along the lines of "don't ever use it to operate that iron lung but maybe use it so the receptionist can run MS Office" but if that were the case, then this would be a mere nuisance and not such a real problem. That is, in that case there'd be nothing special about the fact that the affected institution happened to be a hospital beyond the fact that it sounds bad. Because of that, I really get the impression that they were using the wrong tool for the job.

Re:Old Computers

[Anonymous Coward]

The biggest issue here is that Medical Equipment has to be run through an FDA Validation process. If you make changes to the system, you have to revalidate, and Validation takes months and $100K's. So the vendors leave them as-is.

What's frustrating is that these systems need to be on a LAN, since they need to report their results to other clinical systems. So these small islands need to be linked other islands, and eventually, someone screws up and links an island with an Internet connection . . . .

Re:Old Computers

[Mazcote Yarquest]

Indeed, I work for an OEM on the imaging (X-Ray) side of the house. My system(s) do get patched regularly. The users are given specific instruction not to "Surf the web".

These systems are usually on a network segment dedicated strictly to imaging yet somehow I manage to find all fashon of virus (Most recently Conficker) games and saved email attachments on the Desktop.

The FDA is very strict about how these systems are to be upgraded and serviced but patching is a non issue.

My company has a simple solution to the virus issue though, If the network admin allows the cluster to get infected, we will gladly remove the infection, for a price.

If I have only had a penny for every time I have heard "It's not my network, check your equipment"

Re:Old Computers

[Jeremy Erwin]

The real problem is that most suppliers of equipment are reluctant to support any type of patches. Many of the suppliers explicitly state that the machines may not be changed in any way (and that includes patching the OS) or you will lose all guarantee and support.

Shouldn't they be using OpenBSD, then?

Re:Old Computers

[Anonymous Coward]

Medical equipment has a very long lifespan. Many devices for measurement and monitoring are used for 10 to 20 years before replacement. The general policy is "if it works, don't fix it and, more important, do not touch it".

If it's running Windows it probably never worked in the first place, so the point is moot.

[/humour]

Re:Old Computers

[DoofusOfDeath]

The biggest issue here is that Medical Equipment has to be run through an FDA Validation process. If you make changes to the system, you have to revalidate, and Validation takes months and $100K's. So the vendors leave them as-is.

What's frustrating is that these systems need to be on a LAN, since they need to report their results to other clinical systems. So these small islands need to be linked other islands, and eventually, someone screws up and links an island with an Internet connection . . . .

It sounds like the real WTF is that the FDA hasn't dealt with the hacking issue in its certification requirements.

Re:Old Computers

[nathan.fulton]

My company has a simple solution to the virus issue though, If the network admin allows the cluster to get infected, we will gladly remove the infection, for a price. I never got why the network admin is always blamed for stupid people doing stupid things.

Re:Old Computers

[ceoyoyo]

Windows isn't usually used for anything absolutely critical. Still, when your MR scanners go down because of a worm even if it doesn't kill anyone directly it may lead to deaths due to missed diagnoses.

Re:Old Computers

[plover]

Because the network admin should have the laboratory equipment firewalled off with a "deny all" preceded and followed by comment lines that read " # DANGER -- MEDICAL EQUIPMENT ON THIS SEGMENT -- If you permit so much as one stinking port to pass through this firewall, I will hunt you down and leave nothing behind for the doctors to patch together."

There is no excuse on the planet for letting health care equipment see the cloud. If data has to enter or leave, it should pass through a bastion host. If the requirements are that the equipment really has to reach the internet, the requirements are faulty.

Re:Old Computers

[kullnd]

Just decomissioned two OS/2 systems last month --- This is perfectly normal in the Healthcare environment...

A hospital needs IT staff that are not dumb enough to allow these old machines to be exposed to a public network --- It's really quite simple --- ACLs are your friend. Any equipment manufacture will tell you what type of interfacing is absolutly required, and any healthcare systems admin worth his pay will already know most of these requirements since most systems operate on known protocols (DICOM, etc)- seperate the equipment from everything else and keep it secured!

Re:Old Computers

[jonwil]

There should be rules in place for hospitals that prohibit FDA certified equipment from being connected to a network in a way that would allow this kind of crap to infect it. (or for that matter allow general purpose internet stuff to be done on it)

Re:Old Computers

[Darinbob]

I agree that companies will disallow the end user changing things. This is because of FDA regulations though, not some rules of the manufacturer. Some of these machines are incredibly dangerous and it is forbidden for end users to modify them in unapproved ways. So if the virus showed up over the network, the FDA will likely demand to know why the system was allowed to modify itself in such an unattended way. But if the virus showed up on an upgrade CD, there's a big regulatory nightmare heading to some QA department.

That said, it's silly to have Windows on such systems. But some are very large, such as MRI machines, and it's very handy to just include a full featured PC and OS as part of those systems. I haven't done MRI myself, but I suspect that the PCs are not a part of the actual control system but instead are for imaging databases and viewing and transfer, so I'm not sure if regulations are relaxed for it.

Re:Old Computers

[X0563511]

Yea, everyone keeps arguing about all this.

If the vendors didn't drink the MS cool-aid in the first place, it wouldn't even be an issue!

Now if only they would learn from their mistakes.

Re:Old Computers

[guruevi]

Exactly. The way we configured it is by having the medical machines (one running Linux, 2 on Windows) behind a small router and first of all have no default gateway (so it doesn't know where to route to to get outside the lan) and the first set of firewall rules deny all packets that are not in the other LAN's IP range (both source and destination). The router can only be reconfigured when you have physical access to it (serial port) and I always unplug the cable before leaving. Then each machine is set up to deny all outgoing traffic except for specific hosts (like printers, PACS etc.), the machine has no default gateway but there is 1 route set up to reach the other IP range.

Re:Old Computers

[the.loquitur]

Would you be allowed to modify your imaging machines so that they could be monitored via SNMP?

Re:Old Computers

[woboyle]

Remember the Therac disaster? Oops, you just got a fatal dose of radiation! Our bad!!!

Re:Old Computers

[The Grim Reefer2]

The places I've worked on imaging systems, the virus solution was simple: they didn't run Windows, or MacOS, or even Linux.

Then I'd guess you never worked in an environment that had an MRI scanner because ALL of the major vendors use either Linux or Windows to run the control consoles for the magnet.

Re:Old Computers

[The Grim Reefer2]

Shouldn't they be using OpenBSD, then?

Then the hospitals all complain because the in-house IT generally only understand MS, so they will have to pay for even the simplistic things.

I work for a medical software company and we had a program that ran on Linux only for a long time. We eventually ported it to Windows because the majority of the support calls required an on site visit since no one in IT support was willing and/or able to touch a Linux box. Several times I went to sites and the only problem would be that the hard disk was full and they simply needed to delete some old/unneeded data.

Re:Old Computers

[CrossChris]

My company has a simple solution to the virus issue though,

So does mine - we refuse to install Windows on anything. It's simply not worth the grief it causes.

Much of the equipment we design, build, install and maintain is safety-critical. We would be out of business in a week if we had to use Windows. We recently had one major braindead government demand Windows on their equipment, so we turned down the (highly lucrative) business offer. It's a pity - I would have enjoyed more trips to the USA!

Re:Old Computers

[Canazza]

I don't know why, but i read "PACS" as "Particle Accelerator Cannons" - god forbid anything at CERN gets Conficker.

Re:Old Computers

[gadget junkie]

from the post:"A patch was released by Microsoft last October that fixes the problem, but the computers infected were reportedly too old to be patched."
"....musssst....not.....say.....MS conspiracy......"

Re:Old Computers

[Mazcote Yarquest]

Would you be allowed to modify your imaging machines so that they could be monitored via SNMP?

Legally, no.

Nothing is permitted on an FDA controlled device which has not been validated by the manufacturer of said device.

Re:Old Computers

[KDR_11k]

There's still the infection vector of laptops and USB sticks being plugged into the closed network by employees.

Re:Old Computers

[plover]

Yes, an air gap would be even better, but I read the above to say "we had an air gap but some idiot bridged it." My intent was to provide the bridge as part of the design to let people know that you've already created the path, but to then plaster it with the equivalent of "Road Closed", "Keep Out", and "No Trespassing" signs.

Re:Old Computers

[pixr99]

No, the laboratory equipment should be air-gapped.

Sure, and the referring physician can drive across town to the lab and sit right in front of the blood gas analyzer to see his patient's results.

Re:Old Computers

[pixr99]

I get a kick out of the vendors that have been running control and acquisition systems on bulletproof UNIX boxes forever and now they're switching Windows XP but *leaving* the Motif user interfaces in place.

Re:Old Computers

[budgenator]

No the problem is they can't, these are often FDA approved medical devices and applying a patch is considered re-manufacturing the device and the organization making the modification then assume the manufacturer's liabilities. The documentation requirements for Good Manufacturing Practice / Quality Systems are quite intense.

Validation
Each changed device, accessory, labeling, packaging, and process should be thoroughly verified and/or validated by the appropriate department. Then the test results and all information related to the change should be reviewed by the change control board or other designated review group. This procedure is the same as needed for designing and introducing a new product or process into production and is detailed in section 820.30, Design Controls. Changes that only modify documents and do not change any design aspect of a device or process are performed according to 820.40 Document Controls. The change control procedure should state the details of the evaluation and review process or, as appropriate, refer to the company control procedures. The change control procedure should define the responsibilities of the various departments and members of the review board. DOCUMENT AND CHANGE CONTROL

I's love to go into Medical Devices like sleep-apnea/anti-snoring devices, but the FDA requirements means I'd have to spend twice as much time documenting and record keeping as I would actually making the things.

Re:Old Computers

[The Grim Reefer2]

I get a kick out of the vendors that have been running control and acquisition systems on bulletproof UNIX boxes forever and now they're switching Windows XP but *leaving* the Motif user interfaces in place.

Me too. It makes me wonder how much of it is laziness and how much is to keep the technologists/IT people from having enough comfort to start messing around with it too much.

Re:Old Computers

[dogugotw]

If you look at pretty much any 'big' software (Oracle for instance), it includes the same exclusion.

In regulated environments, it's the responsibility of the system user to define the intended use of a system then validate to that intended use. Just because the vendor says 'do not use for important stuff' doesn't mean WE can't validate that the system works for us the way we want.
The comments others make about the validation effort are spot on. If I patch one of my production servers, I'm supposed to do a risk assessment, determine what might be affected by the patch, develop a test plan to address the potential risk, get the test plan approved, execute the test plan, document the results, write a report, get that signed, then get signed authorization to implement the patch. Think 'Service Pack' which contains a hundred or more discrete patches...
Toss hands in air, patch and pray...
It's worse for medical devices because you CANNOT patch and pray.
Oh, and while you're trying to figure out how to manage software that's not in your hands, you (the software engineer) are supposed to be creating the 'next big thing' for your company so you can keep making money.
That's why we have a couple of systems on our production floor still using Win 98. Not stupid, but a practical choice.

Re:Old Computers

[Elbis.Reverri]

Who decides what data is old/unneeded and based on what ? Is there a way to make the definition of this process part of the initial configuration of the system ?

Is there a way to build the check for available disk space into the system itself, and when as it gets closer to the red zone, give an unintrusive "Warning: you are running low on disk space. Would you like to invoke the archival procedure now or you do it later?" - Of course, that's a last resort in case automating this is not possible - we all know the users are by now are trained to ignore any and all warnings.

But maybe with some variation of the above you could save a few hassles for the customers, and avoid a couple of support calls.

Re:Old Computers

[Unsupervised]

But at the same time, I work in IT at a hospital, and our support contracts include on-site fixing by the vendor, but the vendors normally try to get our IT guys to be their eyes and fingers because it is CHEAPER than sending out a tech as the contract requires. And our medical folks don't want to wait until the vendor sends out a tech. I've been bitten too many times by trying to "help" our radiology folks with ther PACs system or our pharmacy folks with their P2000 system. Even if built on Wintel, these systems have too many odd outside-of-the-norm bells & whistles to allow us non-vendor techs a warm-fuzzy feeling when working on them. So dammit, vendor, I don't feel bad about you coming on site, because we PAY you to do so. But be sure to let us know before you come so someone from our IT section, familiar with your system and possessing the admin password, can come help. It doesn't help us when you pop in unexpectedly and the system-associated local tech is 40 miles away.

Re:Old Computers

[The Grim Reefer2]

Who decides what data is old/unneeded and based on what ? Is there a way to make the definition of this process part of the initial configuration of the system ?

Is there a way to build the check for available disk space into the system itself, and when as it gets closer to the red zone, give an unintrusive "Warning: you are running low on disk space. Would you like to invoke the archival procedure now or you do it later?" - Of course, that's a last resort in case automating this is not possible - we all know the users are by now are trained to ignore any and all warnings.

But maybe with some variation of the above you could save a few hassles for the customers, and avoid a couple of support calls.

That's the funny part. All of this is patient data that is stored on PACS. It can be deleted as soon as the analysis is finished. If the analysis needs to be looked at again then the patient data can be sent back to the system and the analysis info can be reloaded with a minimum of effort.

Re:Old Computers

[The Grim Reefer2]

But at the same time, I work in IT at a hospital, and our support contracts include on-site fixing by the vendor, but the vendors normally try to get our IT guys to be their eyes and fingers because it is CHEAPER than sending out a tech as the contract requires. And our medical folks don't want to wait until the vendor sends out a tech.
I've been bitten too many times by trying to "help" our radiology folks with ther PACs system or our pharmacy folks with their P2000 system.
Even if built on Wintel, these systems have too many odd outside-of-the-norm bells & whistles to allow us non-vendor techs a warm-fuzzy feeling when working on them.
So dammit, vendor, I don't feel bad about you coming on site, because we PAY you to do so.
But be sure to let us know before you come so someone from our IT section, familiar with your system and possessing the admin password, can come help. It doesn't help us when you pop in unexpectedly and the system-associated local tech is 40 miles away.

We supply the software ONLY. The hardware is purchased by the hospital. We also do not supply onsite support or on site support contracts, it must be paid for on a case by case basis. Remote support is free, so I'd prefer to save your institution the cost of an on site visit. And yes, I always try to inform IT when I'm going to be on site. Frankly I don't care if I have to come visit every other day since we will bill you $3K/day, I would rather you be able to use that money for something more useful. So dammit, IT dude, tell your boss to quit bitching about paying $3K/day for something that really should/could be resolved internally.

Well...

[fuzzyfuzzyfungus]

I guess that's the other meaning of "Nosocomial infection"...

Re:Well...

[idontgno]

And here I am with no mod points.

Mods, this is +1 Insightful as well as +1 Funny. Please vote appropriately.

Any lawyers here

[clarkkent09]

So if a patient dies due to a (computer) virus and the virus writer gets caught can he be charged with manslaughter or something?

Re:Any lawyers here

[Ethanol-fueled]

Won't happen. Life-critical devices are embedded systems.

Re:Any lawyers here

[jd]

It depends. Did anyone successfully sue Bridgestone for their exploding SUV tyres for manslaughter? That's infinitely more direct and far more culpable, so if it failed in a case like that, it would almost certainly fail in a virus case.

Re:Any lawyers here

[Wrath0fb0b]

Yes, but you would have to prove a fairly strong ("proximate") causal link between the virus and the death. It's not enough to say "Well, the MRI machine was down because the tech was cleaning it and if we had gotten him scanned earlier we'd have seen a huge tumor but instead he died", it would have to "the MRI machine was infected with the virus and gave us wrong results so we opened his heart for nothing and he died on the table".

See, http://en.wikipedia.org/wiki/Proximate_cause

Re:Any lawyers here

[77Punker]

Ever heard of embedded Windows? I've had a cheap GPS navigation system run Windows before.

Re:Any lawyers here

[Deanalator]

How about the cheap ass IT directors that refused to run on modern hardware/software? I'm pretty sure that running windows NT/2000 and refusing to patch violates all sorts of HIPPA.

Re:Any lawyers here

[Deanalator]

The last medical device I worked on ran xp embedded.

Re:Any lawyers here

[moderatorrater]

Can the hospital employees and management who failed to provide safe equipment be sued/charged? Using windows (or any other full OS) on medical equipment is a recipe for disaster.

Re:Any lawyers here

[Anonymous Coward]

wow. that's some real strong faith there.

#1 that's not necessarily true

#2 the idea that an embedded system can't be exploited or negatively impacted by the exploitation of a 2ndary system is naive at best.

welcome to the real world. you're gonna have a tough time here.

oops. sorry. just checked your profile...more than your fair share of troll and flamebait. i get it. well done sweet stuff. now go stroke it...you're a soopahstah.

Re:Any lawyers here

[UnrefinedLayman]

Not at all. HIPAA is all about what security measures can be deemed reasonably sufficient. In this case, the systems may have been provided by a vendor and are certified only to run at a certain patch level. Makers of medical devices can't be expected to fuzz the software every time Microsoft releases a patch to make sure it doesn't kill someone when used; they instead sell a single device certified to work a certain way.

Given that, reasonable security measures would have been to physically isolate the network these devices were on. This often doesn't happen thanks to VLANs and sloppy network administration.

Re:Any lawyers here

[rwyoder]

So if a patient dies due to a (computer) virus and the virus writer gets caught can he be charged with manslaughter or something?

I would blame the morons who put a known buggy, virus-prone piece of trash OS into critical medical equipment.

Re:Any lawyers here

[Anonymous Coward]

Oh, really?

When operating in direct electron-beam therapy mode, a low-powered electron beam was emitted directly from the machine, then spread to safe concentration using scanning magnets. When operating in megavolt X-ray mode, the machine was designed to rotate four components into the path of the electron beam: a target, which converted the electron beam into X-rays; a flattening filter, which spread the beam out over a larger area; a set of movable blocks (also called a collimator), which shaped the X-ray beam; and an X-ray ion chamber, which measured the strength of the beam.

The accidents occurred when the high-power electron beam was activated instead of the intended low power beam, and without the beam spreader plate rotated into place. The machine's software did not detect that this had occurred, and therefore did not prevent the patient from receiving a potentially lethal dose of radiation. The high-powered electron beam struck the patients with approximately 100 times the intended dose of radiation, causing a feeling described by patient Ray Cox as "an intense electric shock". It caused him to scream and run out of the treatment room.[2] Several days later, radiation burns appeared and the patients showed the symptoms of radiation poisoning. In three cases, the injured patients died later from radiation poisoning.

The software flaw is recognized as a race condition.

Re:Any lawyers here

[maharb]

Bingo. Proximate cause and negligence on the hospitals part would definitely create a low probability that the virus writer could be charged with the manslaughter successfully. Basically the virus writer could not have reasonably foreseen the writing of this virus as causing someones death due to the huge time, distance, and number of events involved before someone died. Also if any internal policy is set so that these computers are not supposed to be connected to the internet then it pretty much absolves the virus writer and puts the liability on the hospital.

Someone could certainly take it to court but I don't think the virus writer would lose.

Now if the virus was written to fuck with only medical software and then the virus writer attempted to get it on medical computers you have a different case.

p.s. I am not a lawyer.

Re:Any lawyers here

[noidentity]

So if a patient dies due to a (computer) virus and the virus writer gets caught can he be charged with manslaughter or something?

What about the OS vendor, or the hospital who chose such a vulnerable OS, or who connected their computers to the outside world (or at least flash drives)?

Re:Any lawyers here

[cbiltcliffe]

A couple of days ago, I posted a comment about how nobody takes this security shit seriously.

I was modded flamebait.

Now we find out hospital systems running medical equipment are connected to the Internet, unpatched, and apparently not running any decent antivirus software.

Flamebait? My ass.

It's not flamebait if it's the truth.

Re:Any lawyers here

[pfleming]

Manslaughter is a criminal offense. You sue for civil offenses, ie. wrongful death.

Re:Any lawyers here

[andreyvul]

and the design flaw was a redundancy fail

Re:Any lawyers here

[Dhalka226]

Basically the virus writer could not have reasonably foreseen the writing of this virus as causing someones death due to the huge time, distance, and number of events involved before someone died.

You may be right that it would be hard to prove, but that's not why. If that was their concern, they'd simply make the charge involuntary manslaughter, where they don't have to prove any degree of intent to harm somebody--just that what they did was criminally negligent or reckless and caused a death.

Re:Any lawyers here

[maharb]

Even under that claim (involuntary manslaughter) proximate cause must be established. It not about intent to kill someone, it is all about if the virus writer could have seen his negligent behavior as causing harm, specifically death. I know I am not explaining it very well but here is an unrelated example to maybe help what I am saying:

Lets say I kick a rock off the top of a cliff for fun. I don't see anyone below but that rock cause an avalanche that blocked a road causing accidents that later resulted in death. I didn't intend to kill anyone yet I can be linked to all of the deaths.

The idea of proximate cause would say I am likely not legally responsible for the deaths because it would have been too hard for me to have foreseen that kicking this rock (when no one was directly below) could cause the death of someone in an automobile accident. Kicking of rocks off a cliff could be seen as negligent behavior and this negligent behavior resulted in death but the rock kicker is likely not going to be responsible.

These same principles can be applied to the virus case. It's not a matter of if the virus writer wanted to kill people, its if he could have know that releasing this virus could kill people in the same way that the rock kicker could have known his rock kicking would have killed people.

This doesn't even take into consideration the possible negligence of the hospital and various other parties.

Re:Any lawyers here

[kylegordon]

Your cheap GPS navigation system isn't life critical... contrary to popular belief.

Re:Any lawyers here

[kohaku]

There are a bunch of consumer products that i'd hesitate to classify as 'embedded' nowadays. Specifically, mobile phones, handheld consoles, etc. They're not running a RTOS, and they're wielding a pretty hefty amount of power. In any case, you shouldn't run windows on anything life-critical unless you want "blue screen of death" to be a literal term.

Re:Any lawyers here

[Scragglykat]

It was Firestone, a subsidiary of Bridgestone and they did got sued like crazy, and took a big hit... the biggest of which was the loss of OEM tire sales. Now most brands plant BF Goodrich or (eww) Continentals on their SUVs and light trucks. And I have to believe that Firestone's tire issue was a manufacturing flaw, while anything Conficker might do, was intentionally malicious.

Re:Any lawyers here

[ChrisMaple]

Well, maybe.
I see this as an issue of malice or "criminal intent". The rock-kicker meant no harm. Even someone who fires a gun into the air is unlikely to be intending harm. A virus-writer is out to do damage and seldom cares who he hurts. That he didn't intend to cause a death might be adequate to prevent life imprisoment, but the punishment should be quite harsh.

Re:Any lawyers here

[DarkVader]

In the TV stations I've done support work (medium market, full power, multi-state coverage) those systems most certainly WERE networked, and most had internet access. It comes in too handy to have access to the web to take those offline, and they use the network to move files around.

They were also updated with the latest security patches.

Re:Any lawyers here

[DarkVader]

The problem is that medical software makers used a known insecure operating system, and then failed to patch it when if they had put two brain cells together they would have known that someone was going to end up connecting one of these things to a non-sanitized network.

So yes, they CAN be expected to test against the patches if they want to continue to use M$ garbage operating systems in their devices. And they can also be expected to provide timely patch mechanisms to get these patches on their systems.

The expectation should be that a device will at some point be connected to an insecure network, either by accident or intentionally, and these devices MUST be hardened against that eventuality.

Re:Does it bother anyone else.....

[Dyinobal]

Newer isn't always better.

Re:Does it bother anyone else.....

[Anonymous Coward]

All versions of Windows (and Linux) are way too complex to ever be 100% bug-free. They should be running DOS.

Eeesh...

[Chasmyr]

Hospital equipment running Windows NT... Virus or no, I wouldn't want my life to depend on that machine. "Yeah, I hooked him up to the EKG and it just keeps saying device not recognized."

Re:Eeesh...

[Translation Error]

Hospitals are big on not messing with things that work. The devices that still have NT on them do so because, despite the OS's shortcomings, they work.

Re:Eeesh...

[maxume]

Would you refuse an MRI if the machine used Windows (I have no idea if they do or not)?

Re:Eeesh...

[kullnd]

Many of them do, and they work great, in their isolated networks kept away from threats like the internet.

Re:Eeesh...

[Anonymous Coward]

That's better than being hooked up to Windows Vista... "Heart is trying to beat - allow or deny?"

Car analogy

[mangu]

if a patient dies due to a (computer) virus and the virus writer gets caught can he be charged with manslaughter or something?

Maybe not, but cars have been removed from the market for similar reasons. Notoriously insecure systems should never be used in hospitals.

Re:Does it bother anyone else.....

[Feanturi]

In fact, it rarely is. If their existing OS, which is likely running custom software specific to this equipment, is still doing what it needs to do for them, what need do they have to switch? They certainly don't need to be able to play the latest games or anything superfluous like that. Why risk breaking compatibility on a tried and tested mission-critical system? How many businesses do you know of that switched to Vista the moment it came out? If you do know any, you know they're pretty dumb, don't you?

Re:Does it bother anyone else.....

[Anonymous Coward]

A family member was in an intensive care unit and was hooked up to a machine that would monitor them for seizures.

In addition to a bunch of electrodes and other monitoring devices there was a web cam.

I looked at the screen and saw the Win XP task bar (pretty sure it was XP not win 2k but it was a while ago). It was a shock to see it and caused me some concern, but since it was just monitoring software, not as critical as the other systems in the room and the unit's layout made the bed viewable from the nurse's station, it wasn't a big deal.

Had the respirator shown an XP toolbar I would have made a stink.

NT and win2k have always appeared to be fairly stable for me. More so than XP in my experience.

Re:Does it bother anyone else.....

[Brett Buck]

Does it bother anyone else that "critical medical equipment" was running Windows NT or 2000? Don't get me wrong - I like to bash MS as much as the next /.'er but XP is almost to sunset - Shouldn't they be running something a little newer?

          For a life-critical system they probably shouldn't be running ANY version of Windows. But once you get past that issue, if you have tested it sufficiently to permit people's lives to depend on it, retesting it to the same standards on first Win2000 and then XP is a non-trivial effort, and might not even be possible without massive changes. So you would be sorely tempted to leave it alone. Presumably, since it's the same code, it doesn't need any more "features" or performance. So porting it provides no value.

A better question is whether or not it's a good idea to have the damn thing hooked up to the internet so it could *get* Conficker in the first place! Well, actually, that's not a question, since its obvious...

      Brett

Re:Does it bother anyone else.....

[Smitty825]

In the medical industry, making even the smallest changes is often difficult. (I've heard stories of companies continuing to release medical software based on WinNT, and they will probably continue to do it.) When it comes to making changes to software (and hardware), there are lots of regulatory hurdles you need to meet. (The more "life-critical" a device is, the more stringent the regulations are) Obviously, it makes sense, because you don't want to go to the hospital today and find a Windows 7 Beta powered device responsible for your safety.

Also, many hospitals refuse to upgrade existing equipment to something newer. If it works, and it gets the clinicians the data they need to help the patient, then they don't want to take the risk of updating software/hardware.

Re:Does it bother anyone else.....

[StreetStealth]

For that matter, why is it running a general-purpose OS like Windows? Anything upon which life-critical systems run should be a hardened, embedded system focused on the equipment's features and nothing else.

Am I the only one who shudders at the idea of Bonzi Buddy on a cardiac monitoring system?

Re:Does it bother anyone else.....

[fuzzyfuzzyfungus]

Hey, that adorable purple ape has wonderful bedside manner!

Re:Does it bother anyone else.....

[courtjester801]

Exactly; look at the Hubble telescope and it's 486's. It's not the processors that are causing it to fail over time, they're still chugging along.

Re:Does it bother anyone else.....

[Chirs]

It bothers me that "critical medical equipment" was running Windows at all.

Re:Does it bother anyone else.....

[jd]

Not necessarily newer, but certainly more robust (Windows 2000 is not something I'd consider reliable enough to be used in mission critical systems) and more secure (USB keys can carry viruses).

Usually, for something like that, as other have noted, you'd want a special-purpose OS or a very minimal layer on the hardware you can write apps directly to (eg: L4, OSKit, or something like that).

Sigh.

[Oricalchos]

It's not clear how the devices (including heart monitors, MRI machines and PCs) got infected. Infected computers were running Windows NT and Windows 2000 in a local area network (LAN) that wasn't supposed to be Internet accessible, but the LAN was connected to one with direct Internet access.

Critical medical equipment running Windows and connected to the Internet? YOU'RE DOING IT WRONG! The sheer stupidity of humans never ceases to amaze me.

Re:Sigh.

[AndrewNeo]

Apparently you can't even read what you quoted.

but the LAN was connected to one with direct Internet access.

Internet enabled machine got infected, and bridged over to the closed-off network. Why SMB was enabled on the embedded systems is a better question.

Re:Sigh.

[he-sk]

I can't believe I'm reading this on Slashdot!

If network A is connected to network B and network B has internet access, then for all intents and purposes network A is part of the internet as well. All it takes is to enable forwarding on the bridge and off you go.

Internet = interconnected computer networks.

Re:Sigh.

[drinkypoo]

Another good question is why the vendor didn't use the IP Filtering functionality available in Windows NT since time immemorial to close the system down, if they really really HAD to use Windows.

Re:Does it bother anyone else.....

[setagllib]

Why risk having security vulnerabilities on a tried and tested mission-critical system? They should have gone with Linux or BSD from the start and had virtually guaranteed upgrade compatibility from that point on, with plenty of commercial support options.

Re:Does it bother anyone else.....

[dave562]

All medical devices have to go through a very stringent testing and approval process. The process is extremely costly. Even the slightest revision in a design spec can require a whole new series of retesting and recertification. Therefore what happens is that the manufacturers develop their devices using a certain piece of software and it stays on that piece of software. If you think about it, there isn't any need for a heart monitor to have internet access. The real problem is that the staff at the hospital obviously failed to follow the guidelines that were laid out for them by the manufacturer and/or their local IT department. I don't know about you, but I don't want my medical devices pulling down auto updates that might bork their functionality. As long as you're running Microsoft software on certified hardware with a known good set of drivers, the odds of a blue screen or other serious system problem are next to none. I'm not saying that you want to run your business on an NT4 server plugged into the internet. But for a medical device that should be stand alone, it isn't exactly a huge risk to be running Windows.

Another reason to choose open source

[Ironica]

I can totally understand why these systems were still running NT or 2000. If it ain't broke, don't fix it, right?

But if it ain't supported anymore, and it's completely closed-source, you literally CAN'T get fixes for vulnerabilities discovered later on. At least with an OSS product, you'd be able to hire a developer to fix the specific vulnerability on the existing system.

Re:Another reason to choose open source

[wvmarle]

That point is totally moot as has been pointed out before in other comments: patching is not an option. At all. It is usually not allowed for a start. Any changes to the system, even as minor as a small patch, would require full re-certification of the whole system. And that will last many many patch-Tuesdays, and cost a lot of money.

Re:Does it bother anyone else.....

[gbjbaanb]

no, not at all. I know we've all been brainwashed into the 'must upgrade' way of thinking, but for many places once you have something working, don't touch it and it'll keep working.

So, no, many places run NT4, it was quite a good OS, before MS started adding 'value added features' to it.

Here is why and how

[altek]

1) Vendors of these devices almost across the board disallow local IT admins to put any windows patches on the machines
    - this is due to FDA requirements for approval, and the vendor is "covering" themselves
    - also, they usually have a list of "qualified updates" that is usually MONTHS behind MS's patch cycle (not surprising given the sheer number and speed of holes that are found)
    - usually the vendors claim that THEY will apply patches regularly, in practice, they almost NEVER do

2) Vendors typically disallow these machines to be on the active directory
    - this is because they can't stand troubleshooting/supporting issues in their software due to GPO's being pushed down, software management software, etc etc

3) To everyone screaming how idiotic it is that medical devices have Windows on them: you may be a geek, but have clearly never worked in a real enterprise environment. Windows is embedded on so many devices in the world (medical and otherwise) that you would never even know existed. Why? Because it's widely supported, has huge hardware support, and is surprisingly OPEN to developers to hack it into whatever they need it to be. And windows programmers are a dime a dozen.

4) To everyone screaming how idiotic it is that medical devices are connected to the internet getting infected - Do you even know how Conficker spreads? It spreads quite easily across a LAN, attaching to Windows file shares. See MS08-067 for more info. Many of these devices are on a LAN with no DNS (although plenty are on the 'net). Why? Again, because vendors insist that they be connected so they can VPN in and support them (often using LogMeIn, Webex etc).

Re:Here is why and how

[altek]

I hate to reply to my own comment, but I forgot to add something.

5) Why don't sysadmins at the hospitals disable filesharing and enforce stronger policies on these devices?
      - usually the vendor contract explicitly states that modifying the systems in such a way will void your $50,000 annual support contract on your $3 million scanner. Scanner is broken? Tough shit, you voided your contract. Buy a new one.

Re:Here is why and how

[altek]

I don't necessarily "think it's OK". I didn't write an editorial, I just outlined why this is what it is, as it seemed a lot of the commenters were under informed on what the article is referring to.

Also, as per usual, the media uses sensationalist wording. Most of the "medical devices" in question here are not something attached to your body where you will die if it crashes. Most of what this is referring to are clinical workstations used for doing all sorts of work related to medical care. For example, a workstation that interfaces to some sort of scanner to set up and initiate a scan. Or a workstation that crunches data that comes off some piece of medical hardware. Most devices that physically touch you and control something which can harm a person are coded in hardware, not windows, and have hardware in place to prevent such a thing from harming someone.

Please realize that the FDA must approve ANY piece of hardware that comes in contact with a human and the process is EXTREMELY restrictive and scrutinizing (and expensive). It's actually one gov't institution that I feel really does protect people in a lot of ways.

Re:Here is why and how

[el_cepi]

... Vendors of these devices almost across the board disallow local IT admins to put any windows patches on the machines ... they usually have a list of "qualified updates" that is usually MONTHS behind MS's patch ... usually the vendors claim that THEY will apply patches regularly, in practice, they almost NEVER do
To everyone screaming how idiotic it is that medical devices have Windows on them: ... Why? Because it's widely supported

Can you explain this a little bit more. No patches sound does not sound like widely supported to me.

Re:Here is why and how

[nurb432]

*snip* Many of these devices are on a LAN with no DNS (although plenty are on the 'net). Why? Again, because vendors insist that they be connected so they can VPN in and support them (often using LogMeIn, Webex etc).

They should be on a dedicated LAN with NO entry point for some idiot with a laptop. A vendor complains? Too bad, hand them a cat 5 on different network. Its your rules, not theirs.

Im sorry but when it comes to medical equipment there is NO excuse for being sloppy. Those involved should be blacklisted from the industry.

And yes, it can be done, and is. Sure its difficult, but it needs to be done.

Re:Here is why and how

[StormReaver]

> 3) To everyone screaming how idiotic it is that medical devices have Windows on them: you may be a geek, but have clearly never worked in a real enterprise environment.

I'm sure there was a lot of the same type of justification in the financial industry to the few people who pointed out how idiotic the risks being taken with money were. It's irrelevant *why* something so moronic is being done. It's still tremendously stupid, and needs to be changed. Windows does not belong anywhere lives are at stake. Everyone up and down the decision tree that promotes Windows in critical functions should be held criminally negligent.

Re:Here is why and how

[KnowledgeKeeper]

Most devices that physically touch you and control something which can harm a person are coded in hardware, not windows, and have hardware in place to prevent such a thing from harming someone.

Oh, you must be new here. Have you ever heard of a silly little thing called Therac-25? Here's a summary from Wikipedia:

The Therac-25 was a radiation therapy machine produced by Atomic Energy of Canada Limited (AECL) after the Therac-6 and Therac-20 units (the earlier units had been produced in partnership with CGR of France). It was involved with at least six accidents between 1985 and 1987, in which patients were given massive overdoses of radiation, approximately 100 times the intended dose. Three of the six patients died as a direct consequence. These accidents highlighted the dangers of software control of safety-critical systems, and they have become a standard case study in health informatics.

Apparently, some bonehead decided that the hardware lock is too expensive since it can be implemented in software - and removed the physical hardware circuit. So, you never know what those machines can and can't do :)

Re:Here is why and how

[rfreedman]

Ummmm...yeah...that makes me feel better. Medical devices are apparently developed by "dime a dozen" programmers....woot!

Re:Here is why and how

[Elbis.Reverri]

So there's only one vendor that produces those systems with insecure default configuration ?

Otherwise - put the requirements for the default configuration into the RFP - and then if they don't comply to these requirements, then your $50000 support contract along with the $3m equipment purchase goes to the ones that do.

Re:Here is why and how

[altek]

That's an interesting story. I vaguely recall hearing about the Therac incident somewhere, but never knew the story. What a horrible and tragic thing to happen. Never underestimate the power of greed, I guess.

Re:Here is why and how

[cblack]

Some good points about controlled/validated systems. I would like to point out, however, that over two years ago the FDA released a special directive making it clear that OS-level security patches did NOT require full re-validation. Some vendors are likely slow on the uptake on this or are still hiding behind the old rules/misconceptions. To re-iterate: FDA says security patches are fine and don't need all the ISO/FDA change control procedures necessary for other software changes.

Re:Here is why and how

[jzuccaro]

I have to agree with point 3 given my experience.

Just last year I saw the following medical equipment running various flavors of windows:

• Computed Radiography (CR) equipment running Windows XP
• Bone Densitometer
• Ophthalmological equipment running windows 98!

Re:Here is why and how

[phantomfive]

Most devices that physically touch you and control something which can harm a person are coded in hardware, not windows, and have hardware in place to prevent such a thing from harming someone.

Most of what you says sounds good, but this is way off. I've worked on two embedded medical devices, and one was running windowsCE, and the other was running MicroC/OS. I don't think anyone actually does stuff in hardware anymore (maybe they do), since it's harder to build, more expensive, and not guaranteed to be any more reliable.

Re:Here is why and how

[Kazoo the Clown]

Why? Again, because vendors insist that they be connected so they can VPN in and support them (often using LogMeIn, Webex etc).

Don't forget, it was CUSTOMER IT DEPARTMENTS that demanded they use the internet so they didn't have to support the obsolete and otherwise unused phone line, modem, and serial port support hardware previously used for remote support.

Re:Here is why and how

[Zotdogg]

Don't forget Autorunning (Flash or otherwise) Drives. Even if the "Great Firewall of China" was stopping anything from getting in and it wasn't on the network already, all that has to happen is for someone come in with their flash drive and show off some pictures of their kids and voila - Conficker: ENGAGED.

Re:Here is why and how

[Unsupervised]

Regarding altek's Point 3 -- Why windows? Why not? Being "not windows" doesn't really help security. We had a medical system with a flavor of UNIX on it. The vendor (won't mention the name, but it starts with A and ends with GFA) didn't seem to bother to put ANY protection on it. So it was penetrated and taken over by by an IP from another country, possibly one that starts with an I and doesn't speak Arabic and doesn't say 'Bjork' and isn't in southeast asia. So we had to send the hard drive off to 'the authorities.' The vendor put their stuff back on the new drive, AGAIN didn't bother to patch the OS, so AGAIN it was penetrated and taken over. Because the box was too pure (being UNIX and FDA-approved and all) they didn't seem to need to do ANY security patching. And they sure complained about having to send a tech down to load the new drive (both times).

bugs on hospital computers

[Cederic]

Suddenly I have this horrible urge to write a virus called "Swine Flu" that only attacks medical systems..

Re:bugs on hospital computers

[altek]

black helicopters should be hovering above your house right... about... NOW

On some hardware even installing windows updates w

[Joe The Dragon]

On some hardware even installing windows updates will void the warranty and that same hardware also has to be on the network.

New Sources of SPAM!

[happy_place]

This SPAM was brought to you by a heart monitor!

Re:Does it bother anyone else.....

[Anonymous Coward]

Its possible that they can't upgrade to a newer OS. To do so may require them to upgrade the modality attached to the OS. Hospital systems have to be validated to conform to FDA requirements and the vendor just may no longer support that OS and its just not possible to do it in house.

Mabey it just wasn't a good time to upgrade?

[Chasmyr]

"Hi it says I need to upgrade my RAM, what is that?"... "RAM is a part of your computer, if you have more of it, you can expect it to run faster... tell me what your computer is running and I'll see if I can help you out."... "Uh, right now the computer is running Bob's heart and lungs for him."

"A patch was released..." Big freaking deal!

[Anonymous Coward]

The article says "A patch was released by Microsoft last October ..." The availability of a patch doesn't mean squat. Before a patch can bve installed on medical equipment, the hardware vendor has to validate the patch. In other words, the vendor has to test the ever loving crap out of the software to insure it does not conpromise patient safety.

The fact that cornflicker got on life safety and mission critical systems at all raises the question of why anyone would use a consumer grade operating system for mission critical systems or for life support systems. At a minimum, these systems should have been running Unix or Solaris. Vx Works or Linux are also good, but require a higher level of computer engineed to implement.

This is just plain lunacy.

Re:Does it bother anyone else.....

[radtea]

For that matter, why is it running a general-purpose OS like Windows?

Ease of development, particularly UI support for rich user interaction and feedback.

Most medical systems I've worked on have two OS's: a relatively hard realtime system that's really close to the hardware, and a second system (Linux or Windows) that's close to the user. For some applications the general purpose OS is used as a soft realtime system and talks to all the hardware via USB or a framegrabber. Only very simple systems are pure embedded these days.

Given the complexity of computing that some of these machines do this makes perfect sense: an embedded, realtime OS is just not what you want to be dealing with when trying to develop richly representational software. Think imaging systems and computer-assisted surgery systems, which often have a lot of analysis and image processing built in, including heavy user interaction, in realtime, in the OR.

Intra-op ultrasound is routine in cardiac surgery (and yes, sometimes systems hang and have to be rebooted while the patient is on the table with their heart stopped...) Intra-op fluoroscopy is routine in some procedures as well, particularly in ortho.

The problem is that people have come to expect features that can't be easily delivered without a general purpose OS, and the issues that come with that are pretty much invisible to anyone who would be likely to scream about it, including the FDA. Users get used to periodic failures and work around them, just like desktop users do.

Re:Does it bother anyone else.....

[moderatorrater]

A better question is whether or not it's a good idea to have the damn thing hooked up to the internet so it could *get* Conficker in the first place! Well, actually, that's not a question, since its obvious...

The computers that were infected weren't hooked to the internet, they were hooked to a network that was hooked to the internet. The other equipment was probably either connected to an infected computer at some point, hooked into the same network, or some combination of similar things.

Seems to me that equipment of this type should be running on software that's been written from the ground up to be secure and crash-proof. Using any out-of-the-box software is asking for trouble since you can't control the code and it's going to provide features that the equipment doesn't need. Any of those unnecessary features could easily cause crashes or security concerns. The equipment should only accept input that's exactly what it's expecting and reject anything else.

Swine flu?

[Sockatume]

So, we have Conficker infecting hospitals now. And meanwhile, after Conficker's payload goes live, there's a massive outbreak of swine flu. And conficker spreads spam... spam is a pork product... COINCIDENCE?!

Re:Swine flu?

[Anonymous Coward]

Yes.

Re:Swine flu?

[st0rmshad0w]

NOW? Did you miss it a few weeks back when it basically shut down 4 British hospitals?

Re:Swine flu?

[Loconut1389]

calling it a pork product is maybe a bit of a reach, no?

Re:Swine flu?

[mdielmann]

So, we have Conficker infecting hospitals now. And meanwhile, after Conficker's payload goes live, there's a massive outbreak of swine flu. And conficker spreads spam... spam is a pork product... COINCIDENCE?!

I suggest you send your resume to The Colbert Report.

Big difference

[Sycraft-fu]

Bridgestone wasn't committing a criminal act. They had a flaw with their product.

Under US law, there are situations where you can be prosecuted if during the commission of a crime you cause something more severe to happen. One that has happened successfully is criminal being prosecuted for murder during robbery, even when they themselves didn't fire the shot that killed someone. However because the reason the death happened was their robbery, they are charged.

Now as it would apply to this, I don't know. You'd have to ask someone who's an expert in this area of law and even then this is untested so it would have to be decided in trial. However it is the sort of thing that can happen. If you commit a crime and in doing so cause other harm to happen, even if it wasn't direct or your direct intent, you can still be charged at least in the US.

Re:Does it bother anyone else.....

[peragrin]

what part of 10 year old equipment didn't you understand? What part of Win NT and win 2K makes you think the hardware can even run anything newer?

At that time your looking at Red Hat 5. think about it. linux wasn't ready back then for mission critical stuff.

At best they could have gone with OS/2 warp.

Re:Does it bother anyone else.....

[jcr]

Does it bother anyone else that "critical medical equipment" was running Windows NT or 2000?

Of course it does. Building any medical equipment around an intrinsically unreliable system is about as irresponsible a decision as anyone could make.

-jcr

Re:Does it bother anyone else.....

[Abreu]

Obviously, it makes sense, because you don't want to go to the hospital today and find a Windows 7 Beta powered device responsible for your safety.

Sure, but you also don't want to go to the hospital today and find a Windows 3.11 powered device responsible for your safety

Windows market share

[Me! Me! 42]

Kind of makes you wonder what percentage of the prestigious Windows market share is special purpose devices like this (or mundane devices like cash registers.) I know Case equipment (CNH) uses WinCE on almost everything. At least that is pared down to the essentials.
In any case this seems like lazy engineering if the item is vulnerable to viruses.

The question

[thePowerOfGrayskull]

The question here is this: did the sub-human wankers who created this ever consider this possibility? Now that it's happened, do you think they give a shit? Is there a chance that someone is saying, "Gee, maybe this wasn't such a good idea..." right about now?

Re:The question

[Renraku]

I don't think many virus writers would like to see their virus killing people.

I'd say the blame is 50% on the part of the virus writer for not considering the consequences, and 50% on the part of the medical equipment maker that decided to use Windows to save a few bucks and didn't consider the fact that Windows is one of the most insecure operating systems ever.

For a car analogy, someone throws an empty soda can out the window. Said soda can is then crushed by a Chinese-knockoff motorcycle. Since the tires are much thinner than they should be, as they're cheaper that way, the can penetrates the tire and causes a blowout. The rider of the motorcycle dies. Should the liter-bug be charged with murder/manslaughter?

Re:The question

[freelunch]

The question here is this: did the sub-human wankers who created this ever consider this possibility? Now that it's happened, do you think they give a shit? Is there a chance that someone is saying, "Gee, maybe this wasn't such a good idea..." right about now?

No, they're saying "Windows 7 will be more secure, and even better for medical devices"

Or did you mean the Conficker authors?

Re:Does it bother anyone else.....

[sexconker]

They would still have been unable to upgrade/patch/etc.

The issue is the support contracts say "DO NOT TOUCH!".

Re:Does it bother anyone else.....

[Brett Buck]

Agreed, I don't see how anyone could convince themselves that they have actually tested it sufficiently if it's running on Windows (or any other consumer-level OS). But once you have it on one version, and never change it, at least you haven't introduced any other variables, i.e. at least it's not a moving target.

        Brett

Re:Does it bother anyone else.....

[zonky]

Seems to me that equipment of this type should be running on software that's been written from the ground up to be secure and crash-proof.

I'm intrigued by your implication that windows, or any other OS wasn't written with these goals in mind. Perhaps, it's just not quite so easy to achieve?

Re:Does it bother anyone else.....

[sexconker]

"The computers that were infected weren't hooked to the internet, they were hooked to a network that was hooked to the internet."

So, they were hooked up to the internet.

Physical separation people. It's the ONLY way.

Re:Does it bother anyone else.....

[causality]

The computers that were infected weren't hooked to the internet, they were hooked to a network that was hooked to the internet.

I don't mean to nitpick, but what's the difference? Your ISP has a network that's hooked to the Internet and you connect your computer to it in order to have Internet access. Seems to me that the basic routing functionality of IP guarantees that there is no meaningful difference there, at least not unless you have some carefully-planned firewall rules in place and even then ...

Re:Does it bother anyone else.....

[setagllib]

If the support contract doesn't include tested and managed security updates, it's not really support is it?

Re:Does it bother anyone else.....

[tagno25]

The computers that were infected weren't hooked to the internet, they were hooked to a network that was hooked to the internet. The other equipment was probably either connected to an infected computer at some point, hooked into the same network, or some combination of similar things.

Being hooked up to a network that is hooked up to the internet (an insanely large network) is being hooked up to the internet! Any way the network that the medical equipment is on should be a closed system with no computers that were ever connected to the internet.

Re:Does it bother anyone else.....

[interkin3tic]

Newer isn't always better.

I disagree, think of how much better those machines would be running if they used vista!

Virus writers in the pay of computer sellers?

[Nefarious Wheel]

Sometimes I wonder if the writers of viruses aren't secretly in the pay of computer sales organisations, or even manufacturers. After all, isn't the common message "you need to keep your software up to date"?

It's extremely cynical of me perhaps, but I wonder if this isn't some type of pernicious planned obsolesence. Some car makers for many years deliberately made cars to last 20,000 hours (pure folklore, overheard) because they needed cars to fail after a few years to keep the volume of new car sales going.

Wouldn't the same principle work with computers? Something has to make them fail over time or people will make do with the old. Unfortunate that this means NT4 boxes in hospitals might get people killed, but when have the truly greedy ever really cared?

Re:Virus writers in the pay of computer sellers?

[maxume]

Maybe. The problem with your theory is that most corporations are happy to operate on a 3 year schedule, and most home users don't care if stuff doesn't last 5 years (and they really don't want to pay for 10).

Re:Virus writers in the pay of computer sellers?

[Anachragnome]

The above post is accurate about the car analogy.

From my own experience, auto-manufacturers took it a step further and only made PARTS of the car with built in obsolescence. Then they buried that part under 30 other ones. That way they get the repair cost MUCH higher. A simple $10 part can cost you (at the dealership, of course) $1000 to get to and replace, the Ford Ranger/Explorer clutch slave cylinder INSIDE the transmission bellhousing...$30 part, $500 job, being a good example (most manufacturers put it on the outside). It also discourages the "shade-tree mechanics" from doing their own work.

But what you say is mostly correct. The REAL problem is that they've been at it so long, people think that a car that only lasts 5-6 years is NORMAL. They've been conditioned to it. People will not know what to do with a car that lasts 25 years, nor be happy with it. Its all about "new", or so we are told by the auto companies.

All that being said, the OP isn't being overly cynical, in my opinion. That shit happens ALL the time, and I see no reason it shouldn't in the IT field.

Re:Virus writers in the pay of computer sellers?

[couchslug]

"A simple $10 part can cost you (at the dealership, of course) $1000 to get to and replace, the Ford Ranger/Explorer clutch slave cylinder INSIDE the transmission bellhousing...$30 part, $500 job, being a good example (most manufacturers put it on the outside). It also discourages the "shade-tree mechanics" from doing their own work."

The concentric slave cylinders were more likely some bean counter idea to save the cost of a clutch fork, pivot ball, and associated hardware. The quick-connect hydraulic fitting is a breeze to connect and would male for speedy assembly.

Never put down to malice what can be ascribed to total indifference to making a system friendly to maintainers.
The company has only to build and sell the system at the highest practical profit. They don't give a shit about the line mechanic in their dealerships, let alone the home mechanic.

Re:Virus writers in the pay of computer sellers?

[Kaboom13]

I have to agree. You think a car maker gives a crap about the cost of a repair job down the line? I know several engineers personally that work in the auto industry. Their priorities go something like this:
1. Meet bare minimum, required by law emissions, safety, and quality standards.
2. Be as cheap to make as possible
3. Be as cheap to assemble as possible
4. Require the minimum retooling for factories making it.
5. Require minimum retraining for workers assembling it.
6. When it fails (and it will) make sure it doesn't make the car catch on fire, or slam on the gas, or lose the ability to brake, or otherwise hurt/maim/kill the driver (lawsuits cost money).
7. Make it implement some sort buzzword marketing tech that doesn't do much but sells cars.
8. Make it implement some tech that actually improves the car in a way that sells more cars.
9. Make it look cool.
10. Be durable enough to last past the warranty in 99% of vehicles, and not blatantly defective enough to force a recall/inspire a class action lawsuit.
11. Be servicable.

Notice thats a long list of conflicting goals, and how easy it is to service is on the bottom. Few people even look at the (estimated) total cost of ownership of a car, much less personally inspect how easy it looks to surface. And since systemic, hard to service problems tend to show up 5 years down the line, when the engineers responsible have long ago moved on to other projects, and that particular model has already been replaced anyways, noone really cares.

The idea that some sort of sneaky conspiracy of planned obsolescence is going on is bogus. The reality is the engineers and designers have different priorities. Replacement parts are often expensive because the machines required to make them are expensive, and they want to retool them to make something else as soon as possible, so they often make a bunch of extras and shove them in a warehouse somewhere. If those run out, and they have to make more, it means they have to spend a ton of money to make another run of them.

When people are buying cars, they want the latest and greatest. A car made using the tried and tested tech from 10 years ago would last longer, and be more reliable, but would offer less performance,comfort, and safety for pretty much the same price or more.

Re:Virus writers in the pay of computer sellers?

[Anachragnome]

Never said a thing about malice.

All this is planned, thus the term PLANNED obsolescence. It has nothing to do with malice, but rather GREED.

Want another example?

Mercedes ML320. Mass Airflow Sensor. 90% failure rate at the shop I worked at in California, but not until the vehicle rolled over sufficient mileage to be out of warranty. At about 60k miles, 90% of them died. But the odd thing is I ONLY experienced this in California, not here in Washington State. After looking into it, seems the part number is different from one state to another(not surprising, due to the fact the emission controls are different), but here is the catch.

The failure in California turns on the check engine light which means you HAVE to have it fixed in order to pass an emissions test. $350 part that takes 2 mins to install. Dealer price for job? $700-$1000. No repair, no registration tags.

Re:Virus writers in the pay of computer sellers?

[Inda]

I worked at BMW for 8 years, 1 year of that was on the X5 project. The X5 and the previous dozen BMW Rovers, were designed to last 10 years. 10 years coming from an average 10,000 miles per year, 100,000 miles total.

They were never designed to fail. That is a myth.

After 10 years, all the tools were sold. These included sub-assembly jigs, checking fixtures, press dies and the like.

Re:Virus writers in the pay of computer sellers?

[Inda]

Very true but you've missed a detail.

It is important that cars do not break down. The secondhand market is worth as much as the firsthand market. A bad reputation costs millions.

Look at the Honda Jazz with its excellent reliability record. It's the reason I bought mine after the warantee had ended.

Also look at the rental/HP markets and the gauranteed future price market on new cars. People are more willing to buy a new car if they know the secondhand price will remain high. Car makers often try a keep the secondhand market inflated by giving employees cheap cars that they must return after 2 years.

(Sorry for the bad english, I'm in a rush)

Re:Virus writers in the pay of computer sellers?

[maxume]

They put in the cheapest part that they thought would satisfy the warranty. Given the size of that particular market (from what I can tell, less than 10,000 of that vehicle a year), the price insensitivity of their customers (people buying $50,000 SUVs are more worried about the label than they are about money) and the 3 year lead time on the failure, it isn't really that shocking.

Did you note if the failures got less common on later model years? That's a good indicator of how willing they are to screw customers.

I wish the car companies did a better job of thinking about serviceability, but they aren't sitting around scheming for ways to hide problems from customers, they are sitting around trying to squeeze every penny off from the upfront cost, because that increases the profits they make from customers who place far more value on brand than they do on quality. That those customers fail to consider overall ownership costs is just a bonus for them.

Removable Drives

[Samah]

As I unfortunately found out yesterday, one of the more common ways the virus spreads is through removable drives. If autorun is enabled for removable devices (which it is by default, and no MS basher responses please), Windows will load autorun.inf straight away, infecting you.

A work colleague brought over a USB stick with some music on it, which I happily acquired, along with Conficker. For some retarded reason the resident shield was disabled. After we received an email about it, I noticed this and re-enabled it. I didn't realise I had the virus until this guy came over again with some more music and the AV software exploded in my face with a nice "warning conficker detected and removed" message. Of course that meant "removed from the USB stick" and not "removed from the PC".

Virus scans would no longer run, and I couldn't access most conficker-removal-related websites unless I went through a proxy. Incredibly, the Microsoft Malicious Software Removal tool worked a treat. After using that, rebooting, and disabling autorun in the registry, it's gone.

I blame partly myself for not disabling autorun (security lockdown on these work PCs is ridiculous; I would have had to ask an admin to do it), and for whoever disabled my bloody resident shield.

I hinted to our admin that I wanted Debian instead, but that didn't go down well. :)

tl;dr version: Conficker is bad, mmkay.

Re:Removable Drives

[LearnToSpell]

tl;dr version: Piracy gives you VIRUSES!!!11! Yarrr!

Re:Removable Drives

[Samah]

tl;dr version: Piracy gives you VIRUSES!!!11! Yarrr!

but... but... I'm gonna buy the albums, I swear! ;)

Re:Removable Drives

[symbolset]

Congratulations! You're now the proud owner of an incubator for Conficker++. The worm probably downloaded a stealth virus that'll wait a while before it activates. These things are devious. They're autogenerated and each one is unique so there won't be a signature update for it.

Good luck with that.

Re:Removable Drives

[Arthur Grumbine]

As I unfortunately found out yesterday, one of the more common ways the virus spreads is through removable drives.

You must be new here. FFS it was even '60 Minutes' did a piece on it.

tl;dr Turn in your geek card at the door.

Re:Removable Drives

[Samah]

Sorry, I only get time to read Slashdot occasionally due to work schedules, so I probably missed those stories. Also, I don't watch TV.

Re:Removable Drives

[dkf]

no MS basher responses please

Awwwww! Please? Just one? A little one?

Re:Does it bother anyone else.....

[layer3switch]

they were hooked to a network that was hooked to the internet.

So essentially they were on same switch network or segment medical hosts by vlan and probably ip packet filtering at the gateway. Sounds like a poor design and really poor security policy if Conficker can push NetBIOS propagation outgoing to medical hosts network regardless bridging network has access to internet or not.

The main point should be the fact that network design and security model is defected in this case, not what OS is running or software it's running on top of what OS. There is no foolproof OS known to mankind as of yet, and I highly doubt medical device manufactures can do any better at developing OS/software than software companies. And I hate when I have to defend Microsoft on this, but there is no proof that Windows OS is inherently unstable when it's in use by medical devices.

Re:Does it bother anyone else.....

[miggyb]

Why are you getting modded as "Funny?" That's the first thought I had. Shouldn't heart monitors and MRI machines have an embedded OS of some sort? MRIs are more complex, but (AFAIK) things like heart monitors do one thing and one thing only.

Think again

[westlake]

At least with an OSS product, you'd be able to hire a developer to fix the specific vulnerability on the existing system.

It doesn't work that way.

You botch this assignment and people die.

The hospital does not have the financial or technical resources to validate your work.

It's potential exposure to administrative actions, civil and perhaps criminal penalties is enormous.

Re:Think again

[LingNoi]

He's talking about the manufacturers producing fixes, not the individual hospitals.

Re:Think again

[phantomfive]

Can't say going proprietary helped them much here, did it? Sorry man, this is the wrong story to use to be saying why proprietary is better than open source. This assignment got botched. Hope people don't die.

Incidentally, the linux 2.0 tree is still being maintained, despite the fact that it was released nearly 15 years ago. Proprietary software loses all around on this one.

Keep the hospital network away from the Internet

[madmod]

Let's assume that the hospital equipment can't be patched enough or in a timely-enough manner to make it safe enough to use with the Internet. To me it's obvious: don't ever allow connections to the Internet in any way.

Totally Unacceptable

[nurb432]

Critical medical equipment should never have been even remotely connected to anything not 100% secure.

Re:Totally Unacceptable

[dosun88888]

The fatal flaw with your argument is that nothing is ever 100% secure.

I will, however, go so far as to say that no critical system that will be used for an extended period of time should be using closed software that will ever be EOLed.

Re:Does it bother anyone else.....

[sjames]

No, they shouldn't be running something newer. Older software has had longer to show it's failings and to be well understood. Nobody wants to be surprised by medical equipment. They SHOULD, however, be running something safer.

Re:Does it bother anyone else.....

[sgent]

These probably aren't the heart monitors physically in the patient, but rather either EKG's or pacemaker programming monitors -- which need to have graphics, a terminal, and be connected to other clinical systems.

Comming soon to make magazine

[nausea_malvarma]

It seems a lot of commenters support keeping medical equipment away from the internet where it's vulnerable to malware.

...

Well then how the hell am I supposed to send my heartbeats to twitter?

Answer that! Ball's in your court.

awesome

[commodoresloat]

Considering the high cholesterol content of spam, it's probably already wreaked its share of havoc on heart monitors... it's about time the heart monitors gave something back.

Windows is unsupportable, shouldn't be embedded

[Locutus]

Let me get this straight, we know Microsoft drops support for its OSes and that includes security patches, yet hospital equipment manufacturers are loading Windows on equipment costing millions? Come on folks, what's wrong with this picture.

Atleast with open source, the equipment manufacturer can backlevel a patch or hire someone to do this. They can't do this with Windows or it costs too much for them to do it. I can't imagine getting source access to an unsupported OS is something Microsoft wants. If they don't want it, they price it off the market.

So is anyone in the press bringing up the issue of companies embedding Windows in products which are expected to last more then 10 years like MRI machines and other hospital equipment? This isn't your standard corporate IT department that keeps throwing away good hardware every three to five years.

It's plain and simple, Windows is unsafe and unsupportable in any long life application.

LoB

Re:Windows is unsupportable, shouldn't be embedded

[kullnd]

It doesnt matter, equipment is certified, and applying patches and new versions to this equipment would require very expensive recertifications, the costs of which get passed to the facilities running this equipment --- It's not going to get upgraded regardless of whether that capibility exists... Healthcare is largely "If it isnt broken, don't fix it" ... The correct action is: don't put the critical equipment on a network that isnt 100% secure, it's really quite simple.

Re:Does it bother anyone else.....

[Trogre]

what part of 10 year old equipment didn't you understand?
The part where they connected it to a *network*.

At that time your looking at Red Hat 5. think about it. linux wasn't ready back then for mission critical stuff.
Of course it was. Well, perhaps the RedHat distro was a bit immature back then, but Debian certainly was ready, as was Slackware. But that's not really the point. The question is, why were Microsoft's non-realtime, closed-source solutions considered for controlling mission-critical medical hardware?

Re:Keep the hospital network away from the Interne

[petermgreen]

trouble is conficker can spread through flash sticks too, so it's fairly easy for it to jump from the internet to an isolated network.

Re:Does it bother anyone else.....

[dougisfunny]

You mean we can't nuke it from orbit?

Re:Does it bother anyone else.....

[Riven.exe]

Newer isn't always better.

But better almost always IS newer. After all, how are you supposed to improve something that doesn't exist?

Re:Does it bother anyone else.....

[iluvcapra]

Users get used to periodic failures and work around them, just like desktop users do.

It seems to me that failures like this are tolerable as long as the different systems have enough decoupling, and enough human attention is in the loop to modulate the system. If the system reporting your 3-month historical blood pressure crashes, no biggie, but if the actuator making my respirator move relied on a web page's embedded OLE control always returning the right value over XMLRPC, I'd be a little more nervous. Well, a lot more nervous.

Re:Does it bother anyone else.....

[TClevenger]

I'm intrigued by your implication that windows, or any other OS wasn't written with these goals in mind. Perhaps, it's just not quite so easy to achieve?

When you're writing software that does a single specific task, on very specific hardware, it's very easy to achieve reliability and security. These mainstream consumer operating systems are designed to run a vast array of generalized computing applications on a vast array of hardware. The application developers and equipment makers can only control a very tiny portion of the code running in these systems.

Re:Does it bother anyone else.....

[awpoopy]

...(Windows 2000 is not something I'd consider reliable...

Windows 2000 was perfectly reliable until windows 2003/xp came out - then (as if by magic) - it wasn't.
I think it was also right after a few ms updates and patches were rolled out.

Re:Does it bother anyone else.....

[TClevenger]

And I hate when I have to defend Microsoft on this, but there is no proof that Windows OS is inherently unstable when it's in use by medical devices.

Stability is not the issue; security is, and it's pretty much proven that Windows is inherently insecure when it's in use in medical devices. In Linux, at least you can easily pare it down to the smallest set of functions you need (to the point of completely excluding TCP/IP or the entire networking stack if you choose), whereas Windows XP Embedded still gets Windows viruses.

Re:Does it bother anyone else.....

[kullnd]

It is when doing such updates could break very costly certification processes that medical equipment must have... which is kind of important in the healthcare industry... The correct action is PROTECT the equipment from external threats --- there is no reason for a heart monitor to get on google.

The fix is simple: use Unix-based systems

[synthespian]

Here's a vaccine: use Unix and Unix-like systems. No medical device should be running Windows. You do see stuff with Unix, such as some CT scans, but the way Microsoft's marketing is strong, you see a lot of stuff on Windows. Also, because it allows for easy installation on a widespread platform.

Here's a big opportunity for open-source developers: ship the whole thing, computer, OS, *and* your image analysis software for microscopy - or whatever (of course, the ugly part for Linux is the GPL - but then there's always a choice of BSD or solaris).

BTW, how come retarded managers get to choose Windows for medical devices, and the NYSE sticks to Linux for their systems? Answer: because there is a shitload of money in the NYSE and big fish at the sea and they can't afford retards managing their IT infrasructure.

On another note, I suspect things are even worse in other corners of the world. For instance, a couple of weeks ago I was having a coffee with the guy reponsible for major IT infrastructure in the government health sector (this in Brazil, and I'll not disclose specific info), and he told me a horror story of how they run very old, unpatched software, that they *can't possibly* upgrade because, as these things go in the developing world, the budget wasn't always there when they needed, so they missed upgrades, and to upgrade the things, they can't just go from, say, version 5 to 7, because Microsoft doesn't work that way...BTW, the guy - a top manager - was clueless regarding, say, OpenBSD. He just bought pre-packaged Microsoft shite. How sad...He did mention that TCO for Linux was higher, because of lack of specialized workers (as opposed to a legion of incompetent sysadmins wannabes we see all the time in the Free Software meetings), and that they had made a half-assed atempt once.

OTOH, the public health sector should run open source software for security reasons. Period. If .mil does, why doesn't .gov?

Re:Keep the hospital network away from the Interne

[madmod]

With the Internet locked out, the only thing left is to train employees never to introduce USB sticks into the system--at the risk of picking up a law suit or loss of employment.

Re:Does it bother anyone else.....

[KnowledgeKeeper]

what part of 10 year old equipment didn't you understand? What part of Win NT and win 2K makes you think the hardware can even run anything newer? At that time your looking at Red Hat 5. think about it. linux wasn't ready back then for mission critical stuff. At best they could have gone with OS/2 warp.

They could have gone with Solaris ;)

Re:Does it bother anyone else.....

[synthespian]

And OS/2 warp is, like, totally supported today.

Re:Does it bother anyone else.....

[synthespian]

For a life-critical system they probably shouldn't be running ANY version of Windows.

"Hahahaha, children, the things we've seen."

Like telemedicine types wiring ECG real-time data to Linux (*) with MySQL and PHP interfaces. Is that acceptable/safe? I don't think so...

(*) not Real-Time Linux.

Re:Does it bother anyone else.....

[kullnd]

No, it's just reality when you work in Healthcare IT, and for patient safety reasons, it's better this way...

Your comment leads me to believe that you don't know anything about Health Care IT and should maybe move on to another topic.

The issue in this story is not the fact that the equipment is unpatched, the issue is that some idiot allowed a threat to reach the equipment in the first place.

Re:Does it bother anyone else.....

[synthespian]

The problem is that people have come to expect features that can't be easily delivered without a general purpose OS, and the issues that come with that are pretty much invisible to anyone who would be likely to scream about it, including the FDA. Users get used to periodic failures and work around them, just like desktop users do.

We can't expect Mr. Surgeon, who's been rebooting his Wintel boxen for two decades, who thinks it's "natural" for computers to get a "virus" to scream about it.

However, the physicians, engineers and computer people who make the devices and softwares should display a higher standard. IMHO, for instance, it's unacceptable to just "hack away" at C/C++ in such systems. At the very least some formal methods should be applied. Safe(r) languages, like SPARKAda
http://en.wikipedia.org/wiki/SPARK_(programming_language)
Code analyzers with formal theory behind them, such as PolySpace
http://www.mathworks.com/products/polyspace/index.html
Etc.
If a system needs rebooting in the middle of surgery, than it's criminal.
There's cultural barrier against safer languages and formal methods and we need to overcome it.

Re:Does it bother anyone else.....

[ctmurray]

I read once that there were a few reasons NASA was always pretty far behind on processors compared with home PC's. Keep in mind this is from memory.

1. By waiting the get processors who's flaws are well known (no surprises)

2. They can get radiation hardened chips. It takes time to develop such a chip, and you want the one with known flaws, so by definition the chip is out of date.

3. The power requirements are low.

Re:Does it bother anyone else.....

[khayman80]

Good lord, you got modded troll for that? WTF?!

Re:Does it bother anyone else.....

[DarkVader]

Are you kidding?

Red Hat 5 was far more ready for mission critical systems than anything M$ has ever released, and likely more ready than anything M$ will ever release.

Re:Does it bother anyone else.....

[DarkVader]

Actually, what this story proves is that that approach is unworkable, and threats WILL reach the equipment.

It's time for a new approach. Seriously.

Re:Does it bother anyone else.....

[wazza]

Being a health care worker, I would have thought that being responsible, and *not* bypassing the hospital's IT access controls - no matter how "pathetic" - was part of your job?

Just sayin'...

This is why critical systems developers

[symbolset]

This is why the manufacturers fold their tents every five years and move on.

Don't get sick.

I wish it were that simple

[symbolset]

The network is not trusted. Not ever. Not even a lab network with air gap. For the lifetime that these devices are expected to see somebody will defeat the network security, even if they have to invent a parallel port to wifi adapter.

The trick is to never expose services to the network on clients. Ever. Clients are for using services, not providing them. And audit your network periodically to ensure the damned clients haven't started listening without permission. When you implement this policy expect to have considerable disruption as you discover precisely what services are running on clients that are used for important work. It's very scary. Port monitoring can be used also to detect if a client is performing services on a "stealth" port. There's a whole lot more to running a secure network but most people don't even do this much so locking down broadcast and monitoring for slow scanning and other steps are pretty moot.

Also, audit your servers. Each server needs to have services exposed. But it should have those required only. By default all ports should be not listening and this should be checked with snort before the required services are started.

And of course turn off auto run.

Re:I wish it were that simple

[kullnd]

The idea is that critical equipment should be on a trusted network, nothing should be on that network except for what is absolutely required to be on that network, and anything accessing something inside that network from the outside should be A) Avoided completely if possible and B) Controlled by every means possible if it absolutely must talk to something inside of that network ... We have many separate networks running for this very reason, security at the border is critical when you are dealing with this type of equipment, especially if patching / updating is not possible, which is true for much medical equipment. .

Maybe "simple" is not the right word for it, but it is definitely possible if the proper effort is put forward to make it happen.

Re:I wish it were that simple

[symbolset]

No.

Re:Does it bother anyone else.....

[jc42]

Physical separation people. It's the ONLY way.

That doesn't work very well any more. Most small devices now come with wireless comm capabilities, bluetooth or IR or wifi or CDMA or .... These are generally not obviously "network" connections to non-experts, and many don't have any visible external signs that they're included or working.

This was one of the things that has been learned by the people studying the problems with electronic voting equipment in recent elections. The people in charge will insist that the machines not be networked, but they don't seem to understand that wireless networking connections are possible. So some of the machines that "weren't networked" had running IR and/or bluetooth installed and enabled, and people were able to use these to access the machines from across the room and modify their data.

Also, you and I know that wifi and bluetooth are or can be network connections. But your boss probably doesn't know this. They aren't visible and don't have wires, so they can't be "connections", now can they? And why would any medical administrators expect that a computer infection could spread through the air without any physical contact? ;-)

Re:Does it bother anyone else.....

[Brett Buck]

The main point should be the fact that network design and security model is defected in this case, not what OS is running or software it's running on top of what OS. There is no foolproof OS known to mankind as of yet, and I highly doubt medical device manufactures can do any better at developing OS/software than software companies. And I hate when I have to defend Microsoft on this, but there is no proof that Windows OS is inherently unstable when it's in use by medical devices.

        It's not so much that it is inherently unstable, it's that it (and anything remotely like it) are so complex under the hood that you have no way of every testing or proving it works. Do you suppose that Windows contains a function from a library somewhere, that wasn't explicitly tested? Yes? BZZZT! Fail! At least for a truly life-critical system. It's not at all clear what the deal was here, but in the most critical situations the OS is written from scratch, and sometimes consists of "see clock leading edge, jump to location 80octal, run". Of course there's a break point where the risk of doing this sort of programming is greater than the risk of using something more complex with more history, but I would sure lean more towards the former than the latter, if it was my grandmother hooked up to it.

          Brett

Re:Does it bother anyone else.....

[Spit]

Even DOS would be more suitable for this application.

MS software and embedded or safety-critical system

[woboyle]

I spent many years developing real-time software for embedded, real-time, and safety-critical systems, and all I can say is that ANYONE who uses Microsoft software for such should be arrested for endangering the public safety! Remember the disaster that was the Denver International Airport automated baggage handling system? That had to be pulled out entirely because after years of effort and 100's of millions of US Dollars? It was built on NT. When I heard about that (before it was deployed), I screamed, saying that it could not possibly work! Well, my opinion was vindicated (unfortunately). So, the fact that many of these safety-critical medical systems which are built with MS software have proven vulnerable to the most pernicious malware we have ever seen, does not surprise me in the least. I hope that the hardware and software companies who have developed and sold these systems to hospitals and such are forced to recall all these systems, and certify them to Blue Book security standards. Shame on them! A good example of why management should not be making engineering decisions, IMHO...

Re:Does it bother anyone else.....

[The Grim Reefer2]

what part of 10 year old equipment didn't you understand? What part of Win NT and win 2K makes you think the hardware can even run anything newer?

At that time your looking at Red Hat 5. think about it. linux wasn't ready back then for mission critical stuff.

At best they could have gone with OS/2 warp.

Actually Solaris was pretty popular for MRI scanners back then. GE eventually switched to Linux which they currently use. Siemens and Phillips went with Windows.

Summary

[Geminii]

Insecurely designed systems insecurely administered on insecure network insecurely connected to insecure internet run afoul of common problem; patients feel insecure?

Re:Does it bother anyone else.....

[pHus10n]

That wasn't even remotely "troll" behavior. It's informative, accurate, and well written. Wow.

Re:Does it bother anyone else.....

[KDR_11k]

Special equipment like that always runs old OSes. I've seen ATMs use Windows ME when XP has been out for a few years already. I'm surprised they aren't still on DOS.

Re:Does it bother anyone else.....

[KDR_11k]

AFAIK the radiation hardness is affected by the channel size, the modern 40nm or whatever chips operate at very, VERY tiny voltages which are lower than the noise space tends to add while the really old stuff is so big you need a significant voltage to switch a bit.

Re:Does it bother anyone else.....

[KDR_11k]

Windows was designed for user friendliness and such, it's much easier to secure the system when it doesn't provide much driver support (just enough to deal with the hardware it's meant for rather than generalized support for all kinds of configurations and purposes), much UI, etc.

Windows Powered!

[scubamage]

We had a single NAS that everyone had forgotten about get nailed because it ran a version of win2k called "Windows Powered!" which was basically windows 2000 for storage servers. The issue? You can't run service packs, or patches on it that aren't provided by the manufacturer. The manufacturer hasn't released a patch in 4 years. So we essentially had a 1TB NAS sitting there sharing out a virus that we had no way to patch. Once we located it we isolated it, copied everything to a new nas running windows 2k3 storage server via crossover, and then verified the 2k3 box was clean. However that old nas easily infected 20 other machines - including machines which were shipped to hospitals because they will not allow us to install virus scanners (they want to use their own managed scanners). Further, most QA(quality assurance) workstations which are attached to MR, CR, XR, US, NM and other units tend to be running OLD copies of windows with no virus scanners. You can blame konica, kodak, fuji, and the other imaging companies for that idiotic choice.

too old to be patched

[viralMeme]

"A patch was released by Microsoft last October by November that fixes the problem, but the computers infected were reportedly too old to be patched"

This doesn't make technological sense. If they were capable of running the unpatched version, they were equally capable of running the patched version. I mean Conficker ran ok on these old systems.

blame konica kodak and fuji for Conficker

[viralMeme]

"that old nas easily infected 20 other machines - including machines which were shipped to hospitals because they will not allow us to install virus scanners"

Interesting, would these other machines have been protected if they did have AV installed. See here where they refer to an arbitrary code execution during path canonicalization'. I think they mean a buffer overflow in the RPC service.

Re:blame konica kodak and fuji for Conficker

[scubamage]

The machines infected most likely would have been ok with AV. The initial infection occurred after a fresh copy of win2k3 was installed (which we later identified because of an excess of SMB traffic on the network). They were then patched up to date, but however that did NOT get rid of the virus, it only got rid of the vulnerability allowing infection. Luckily after about 2 months the windows malicious software removal tool started cleaning out conficker, which is when we really realized we had a problem.

patching medical equipment

[viralMeme]

"Before a patch can bve installed on medical equipment, the hardware vendor has to validate the patch"

What are the technological and legal issues in relation to computerized medical equipment. How does one go about validating a patch. Who is responsible when something goes wrong. At least one hospitable has had equipment rebooting during surgery. How do you test the patch, apply patch, scrub up and attend operation, wait for BSOD and click on restore ?

Re:Does it bother anyone else.....

[Petaris]

Or one of the UNIX flavors.

No internet? And then we laughed and we laughed..

[professorguy]

Yeah, let's make sure the medical computers can't get to the internet. Oh wait, that means they no longer work. Now fix it: call the vendor, hear them typing, "Hey, I can't ping that equipment, you must have a network problem. Fix it immediately."

Now while the doctors start to storm the help desk, explain how they chose the wrong requirements for their networked equipment.

Upshot? Doctor puts his thumb down and you are fired. Next person gets the network connection restored. Rinse, lather, repeat.

Yes, I do run a hospital network. If you think your network safety is given a higher priority than the convenience of the equipment configuration and the remote availability for the doctors, you must be stealing something from the pharmacy.

HA!

[professorguy]

the network that the medical equipment is on should be a closed system with no computers that were ever connected to the internet

You haven't bought any medical equipment in the last 10 years have you? Because if you think medical equipment works without the internet, you are wrong.

Now, whether it should connect is a different story. The fact is it does connect and must connect to provide service.

Re:Does it bother anyone else.....

[NewtonFan]

The only problem with this setup remains 24/7 guaranteed availability.

Call the vendor and check if I'm doing it wrong.

[professorguy]

I'm doing it wrong? Not according to GE who makes some of our CT equipment. They specify the exact networking parameters that better be working. If they can't ping the equipment from the support center in (?)India(?), they claim you're doing it wrong.

Not according to MedQuest. Not according to AGM. Not according to Cardinal Health. They all require internet connections to the equipment.

Yeah, but you keep believing that I'm doing it wrong.

Too bad?

[professorguy]

Too bad? If GE can't support your $5million 64-slice CT scanner that's TOO BAD?

I'm pretty sure it would be too bad if no patients could be seen because the equipment is down. It's too bad we can't get remote support. It's too bad we are now paying for something that is not generating revenue. It's too bad the head of radiology is yelling at the network admin. It's too bad the CEO has to decide that the head of radiology (who brings in $5 million per month) or the network admin (who COSTS money) needs replacing.

Here's how it goes:
Doc: I want the scanner to work.
Admin: This was a bad pruchasing decision, it wouldn't be safe. I refuse to connect it to the network.
Doc: I want the scanner to work.
Admin#2: But that wouldn't be safe. I refuse.
Doc: I want the scanner to work.
Admin#3: Right away, sir!
--------
Admin#1: Spare change?
Admin#2: You want fries with that?


Should it be this way? Probably not. Is it this way? Oh, yeah.

Re:Too bad?

[nurb432]

If you blindly succumb to some vendors wishes, then you shouldn't be in the position and should be serving fries.

If you then open your network up like was discussed and cant provide a secure set-up, then you should be in jail.

So yes, 'too bad'.

Re:Too bad?

[professorguy]

I didn't say it wasn't done is a 'secure' way. I'm pretty sure it IS secure (3 years without an incident). I know about firewalls and VPN tunnels and vlan segregation and switch access restrictions, etc. But is it 100% secure? It's CONNECTED TO THE INTERNET fer chrissakes. So I guess I should be in jail because there is no way anything connected to the internet can be totally secure.

Let me hear you solution. I'm waiting. Oh? Just tell GE to run their business differently. Yeah, my rural 25-bed has TONS of leverage over GE. Once I snap my fingers, they'll fall right in line.

And then we laughed and we laughed....

Re:Too bad?

[nurb432]

*snip* It's CONNECTED TO THE INTERNET fer chrissakes. So I guess I should be in jail *snip*

Yes, you should be.

Re:Does it bother anyone else.....

[ChrisMaple]

I suppose I'm just being an old fogey here, but I think life-critical medical equipment code should be written in assembler. No code lying around doing nothing. No variables the programmer isn't aware of. And for goodness sake, no damn operating system at all. Sensor data in, massaged data out, and nothing else.

Re:Does it bother anyone else.....

[sexconker]

Anyone smart enough to set the system up for the idiots should be smart enough to disable all unnecessary shit that could pose a problem. In fact, it's their job.

Of course, the easiest thing is to buy hardware without the unnecessary shit in the first place.

Re:Does it bother anyone else.....

[jcr]

Aren't you more concerned that it's not on an isolated network?

That's another major problem. Hard to say which is worse.

-jcr

Re:Does it bother anyone else.....

[Kazoo the Clown]

When the equipment was designed 10+ years ago, and the support contracts were written, noone ever heard of security updates because the equipment was NOT CONNECTED TO THE INTERNET. It was NOT DESIGNED to connect to the internet, period. The fact that it's even possible to connect it to the internet, is the fly in the ointment here. And what if the original manufacturer of the multimillion dollar equipment no longer exists yet the equipment works perfectly fine for the function that it was originally designed, and there's no budget for its replacement?

Why hasn't the internet kept pace with technology and made it impossible to hook ancient insecure gear up to it anyway?

Re:Does it bother anyone else.....

[jc42]

what part of 10 year old equipment didn't you understand? What part of Win NT and win 2K makes you think the hardware can even run anything newer?

My immediate thought on reading this was to think of the 10-year-old machine upstairs that's doing just find running a 2-year-old OS release and software to make it a gateway, firewall, and server machine. Of course, it isn't running the MS Windows that it came with. It's original owner found that it was no longer powerful enough to handle the latest Windows "features", and gave it to me. I installed a then-current linux on it, a release that was much newer than Win NT or 2K, and it's been running just fine since then.

This is a common source of very usable hardware for a lot of linux users. We magnanimously offer to take old, slow machines off the hands of Windows users who need something more powerful. The smaller, faster programs that come with linux usually work pretty well on all that obsolete hardware. We do often install bigger disks, of course, and sometimes we get a bit more memory, depending on the apps we want to run. (A caching DNS server can use as much memory as the motherboard will accept.) But we don't complain much about old hardware; old hardware has been pretty good to us. ;-)

Actually, there's an older case in the nearby university lab where my mail email lives. The lab has a gateway/firewall/nameserver machine that's at least 15 years old. Yup; it's an old Intel box, originally created to run Windows. But over 90% of its life has been as a FreeBSD server system. Its plenty big and fast enough for that task. It would be hopeless for any current Windows release, or even for Win 2K, but it would probably run just fine with any of the current *BSD releases, or with a current linux.

Re:No internet? And then we laughed and we laughed

[plover]

Ish. I do not envy you that position, but I understand it.

Can you at least firewall off the equipment down to the bare minimums, like ports 80 and 443? Can you hide them behind a transparent proxy that would bear the brunt of the attacks? Can you maybe access them via Citrix, or a Terminal Services Client, or something that is at least a hop away from the raw internet? Are they at least on a separate partition from the other Windows boxes on your network, so when Dr. Red fires up his laptop and starts spreading malware like wildfire, at least your lab equipment is safe?

It just seems like there are plenty of other mitigation strategies you could use to reduce exposure to these machines without removing

Terrorist computer virus infects hospitals

[David Gerard]

A terrorist attack on the NHS has brought three London hospitals to a halt.

The terrorists, representing an organisation calling itself "Microsoft," apparently used insecure third-party contractors to put a virus-running platform called "Windows" into critical systems in the hospitals, in order to extort money from them on an annual basis.

It is understood that a large percentage of all businesses are infected with the virus, wasting up to 25% of employees' working time and opening the companies to further attacks from related criminal organisations demanding to see all their licenses.

The virus in question, W32.SHILL/SCHOFIELD, takes over the host's IT systems, leading to aches, pains, nausea, vomiting, pumping out prodigious quantities of faeces and a terrible compulsion to spread the infection to others. The patient also walks with a shuddering stumble and asks for their hospital meal to include tasty, tasty brains. Recovery has commenced when they have an overwhelming urge to throw their computer out of the window. "Getting this stuff out of the system makes MRSA look like a walk in the park," said one cleaner, waving his shit-encrusted hands about for emphasis.

When the infection became known, ambulances were diverted to other hospitals. "We have maintained a safe environment for our patients throughout the incident," said a spokesman for Barts NHS Trust, "keeping them in the Clostridium difficile culturing lab rather than risking exposing them to 'Windows.'"

Security is not only a technical problem

[Elbis.Reverri]

What about also explicitly educating the less-technical staff about the reasons for these measures ?

Otherwise it would get perceived as "yet another pointless policy IT is putting in to hinder my productivity".

Obviously they would still want web/twitter... so maybe put a few powerful machines running a bunch of vncservers, and allow the staff to do all the twittering/news browsing from there ?

Re:Its worse than the article says.

[gujo-odori]

I believe that. My daughter recently spent a few days in the pediatric ICU, and at both the hospital she was taken to by ambulance and later, at the hospital to which she was transferred because they have a PICU, I saw lots of computers running Windows 2000. These hospitals are both top-notch, highly regarded institutions in a major metropolitan area of the United States, but they have some pretty antiquated computer equipment. Wouldn't surprise me if they had NT 4.x machines lurking somewhere, too.

I don't think the threat is so much that people will die on the table as a result of computer downtime, but that they will die, for example in the ER as a result of a huge increase in processing backlog brought on when computers are down and paper forms have to be brought out, combined with some human error introduced by trying to read the scribbly handwriting of others.

Crimes against humanity

[mikiN]

Those who dare to install heart monitoring or other life critical equipment running Windows should be deported to The Hague and tried for crimes against humanity. Those who agree to operate such equipment of their own free will should be fired on the spot.
This is about as insane as controlling an 80 foot crane with a Gameboy. Total madness.