Slashdot Mirror
Support Site For Hospital Respirators Found Riddled With Malware
chicksdaddy writes "A web site used to distribute software updates for a wide range medical equipment, including ventilators has been blocked by Google after it was found to be riddled with malware and serving up attacks. The U.S. Department of Homeland Security is looking into the compromise. The site belongs to San Diego-based CareFusion Inc., a hospital equipment supplier. The infected Web sites, which use a number of different domains, distribute firmware updates for a range of ventilators and respiratory products. Scans by Google's Safe Browsing program in May and June found the sites were rife with malware. For example, about six percent of the 347 Web pages hosted at Viasyshealthcare.com, a CareFusion Web site that is used to distribute software updates for the company's AVEA brand ventilators, were found to be infected and pushing malicious software to visitors' systems."
1. Reduce health care expenses
2. Kill sick people
3. Blame the Chinese
4. Profit.
I bet most are due to staff members browsing other infected sites
Hello, is HIPPA home?
I thought these people, the medical drug/supply industry in general, held themselves to higher regard than others, which translated into better business practices. I mean, they're dealing with peoples lives here.
Guess even they aren't immune from technological ineptitude and poor management.
>> "A web site used to distribute software updates for a wide range medical equipment, including ventilators has been blocked by Google...
Yes, that will stop them, because the only way people find information is through Google.
A lot of sites are infected by bots who probe domains for tell-tale signs of security holes. Take a look at the logs for any website. You'll see regular GET requests from thousands of ip addresses looking for pages of well known applications (like phpmyadmin).
The site was probably running some package with a hole in it.
I run a url-shortner. Links to such compromised sites are always being further obfuscated through the shortner. It's a never ending process.
All the hospitals I worked on still use IE 6 and XP SP 2 which has not had an update in over 2 years with +100 exploits. With that and some of the most top IT and well paid infrastructures in the industry I can't see how anything could go wrong?
http://saveie6.com/
afaiu if manufactures of medical hardware cut corners making stuff that is not up to spec. like replacing components with out the right approvals, not following procedures etc. it generally involves federal agents and handcuffs
Your honor, I swear, grandma was hacked!
Any sufficiently advanced incompetence is indistinguishable from malice.
3rd party Vendors / suppliers make it hard to find who is at fault.
but it does say something about the importance of the websites
Free speech was meant to be free for all... how can anyone grow up in a nanny state ?
So the site is riddled with malware, like hundreds of other sites out there I imagine. That is their webserver, which probably lives with some hosting provider somewhere and has no contact with the stuff they use for development of those medical devices.
Besides I don't really think that malware designed for whatever those servers ran will run on medical hardware..
Admit nothing. Deny Everything. Make Counter-accusations.
Companies are cutting corners all the time. Outsourcing IT support and web site maintenance, so it doesn't surprise me they don't know their own sites are serving up malware.
And it all rolls downhill. The company running their web site runs 5,000 sites with two stressed out staff and can't keep up with sites that get boned. The host probably has thousands of domains and they don't have the staff to check on all their customer sites.
So all this shit falls on a handful of people who are overworked and underpaid by management who don't give a crap about anything but getting their bonus and boning the HR director.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
So the site is riddled with malware, like hundreds of other sites out there I imagine. That is their webserver, which probably lives with some hosting provider somewhere and has no contact with the stuff they use for development of those medical devices.
Besides I don't really think that malware designed for whatever those servers ran will run on medical hardware..
let's see updates framed out to a supplier that likely framed out the website to a 3rd party hosting with a 3rd party place who build the web site.
likely there is no contact with the stuff they use for development of those medical devices.
As I understand, medical hardware was not the target. This is plain malware nesting in plain vulnerable software. The company happens to be in the medical field, the firmware for their product does not seems to have been infected.
Back in the day, when I had the first pre-802.11b device at the hospital I worked at, I helped a bit with testing medical devices for interference from wireless networking equipment.
Almost everything was fine except for some respirators, which went kerplooie when a device was within about 2 feet.
Talking to the manufacturer, they kept saying how they had a medical device exemption from the FCC for radio frequency interference. That's meant to shield outbound RF, but transmitters are good antennas and all. Long-and-short, they cut corners because the FCC said they could. And their devices are tasked with keeping critically ill people alive. Awesome.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
The server is running II6 so the OS is probably Windows Server 2003. The site is built on ASP.NET. The IP address is registered to the company, so they're probably running their own in-house data center. My guess is they don't have anyone in IT that actually knows what the hell they are doing, which is typical of Windows shops thanks to bean counters and short-sighted management.
Nothing worthwhile ever happens before noon
They were probably running Wordpress on IIS.
Your medical information is protected, even from, especially from YOU by the idiot on the other end of the phone muttering "HIPAA"
The biggest problem doesn't exactly lie on the shoulders of the facilities but the vendors. The way things are released through their 510k ties their hands. I work for a vendor that still puts XP SP0 on customers networks because that's how some idiot filed the 510.
Most facilities will segregate these systems and let the malware run rampant even on systems used in surgery.