Slashdot Mirror
Support Site For Hospital Respirators Found Riddled With Malware
chicksdaddy writes "A web site used to distribute software updates for a wide range medical equipment, including ventilators has been blocked by Google after it was found to be riddled with malware and serving up attacks. The U.S. Department of Homeland Security is looking into the compromise. The site belongs to San Diego-based CareFusion Inc., a hospital equipment supplier. The infected Web sites, which use a number of different domains, distribute firmware updates for a range of ventilators and respiratory products. Scans by Google's Safe Browsing program in May and June found the sites were rife with malware. For example, about six percent of the 347 Web pages hosted at Viasyshealthcare.com, a CareFusion Web site that is used to distribute software updates for the company's AVEA brand ventilators, were found to be infected and pushing malicious software to visitors' systems."
Hello, is HIPPA home?
I thought these people, the medical drug/supply industry in general, held themselves to higher regard than others, which translated into better business practices. I mean, they're dealing with peoples lives here.
Guess even they aren't immune from technological ineptitude and poor management.
A lot of sites are infected by bots who probe domains for tell-tale signs of security holes. Take a look at the logs for any website. You'll see regular GET requests from thousands of ip addresses looking for pages of well known applications (like phpmyadmin).
The site was probably running some package with a hole in it.
I run a url-shortner. Links to such compromised sites are always being further obfuscated through the shortner. It's a never ending process.
All the hospitals I worked on still use IE 6 and XP SP 2 which has not had an update in over 2 years with +100 exploits. With that and some of the most top IT and well paid infrastructures in the industry I can't see how anything could go wrong?
http://saveie6.com/
Umm, you read the summary or even the title and that is your reaction?
This is a website that releases updates to medical equipment and instead is serving up malware. The fact that Google automated software is the one that caught it and notified visitors about it is but a minor foot note. Thankfully, it doesn't seem that the firmware itself was messed with though the article is light on details.
While, definitely alarming, I wouldn't call it surprisingly however. It in the medical field is generally sorely lacking.
Your honor, I swear, grandma was hacked!
Any sufficiently advanced incompetence is indistinguishable from malice.
This is Google's Safe Browsing function. It's their attempt to flag potentially dangerous sites. IT's not intended to block access to the site entirely, merely warn that it's been infected. It's up to the people who manage the site to fix it.
The right to protest the State is more sacred than the State.
Possibly - but the most malware-infected sites are sometimes the ones you wouldn't expect. Charities. Churches. Fraternal organizations. Anyplace where the servers are operated and maintained by volunteers who don't have a financial stake in the organization's operations, and who don't have a good background in security.
Porn sites, on the other hand, are run by businesses who expect repeat business, and can't afford to scare customers away with malware. Their sites are much LESS likely to be infected, because they have professional IT staffs.
You get the IT support you pay for.
3rd party Vendors / suppliers make it hard to find who is at fault.
I thought the company that hired the shoddy vendor is at fault? Does HIPAA, SOX, etc let you push responsibility onto a vendor that you hired?
Companies are cutting corners all the time. Outsourcing IT support and web site maintenance, so it doesn't surprise me they don't know their own sites are serving up malware.
And it all rolls downhill. The company running their web site runs 5,000 sites with two stressed out staff and can't keep up with sites that get boned. The host probably has thousands of domains and they don't have the staff to check on all their customer sites.
So all this shit falls on a handful of people who are overworked and underpaid by management who don't give a crap about anything but getting their bonus and boning the HR director.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
The problem is that the malware might offer a backdoor for someone to intentionally compromise the integrity of the medical device firmware. Even if it doesn't, the fact that the site is vulnerable means somebody else who's actually skilled (unlike the dumb sks/bots) could independently obtain access for the purpose of modifying the firmware.
Idiot. You don't just change your operating system on a whim in a medical environment. For one thing, the hospital or other institution probably doesn't even own the device, and so has no ability to change the OS. Even if they did, the device probably can't run a different OS. And even if it could, the institution would have to validate the new OS to ensure that it performed all of its functions correctly. Yeah, just change your OS, because a hospital is pretty much the same thing as your home network! Dipshit.
The server is running II6 so the OS is probably Windows Server 2003. The site is built on ASP.NET. The IP address is registered to the company, so they're probably running their own in-house data center. My guess is they don't have anyone in IT that actually knows what the hell they are doing, which is typical of Windows shops thanks to bean counters and short-sighted management.
Nothing worthwhile ever happens before noon
In this case it is used to publicly advertise a critical products, system and security admins failure and force immediate remedial action. Rather and embarrassing way for Google to do it but very effective and all in all, very appropriate.
Chaos - everything, everywhere, everywhen
Blocked by google means blocked by any browser that checks against google's safe site database before opening the page. That includes Chrome (as you might expect) and Firefox. Internet Explorer uses Microsoft's equivalent, I don't know about Opera and Safari.
"Idiot. You don't just change your [malware ridden] operating system on a whim in a medical environment"
There, corrected for you.
But then, maybe you should in fact change your malware ridden operating system on a whim, *specially* in a medical environment.
Because a completely UNPATCHED Linux is magically better, yes?
The problem is that YOU CANNOT UPDATE because of naturally the incredible amount of red tape and testing that MUST be done on a machine on which lives depend. It wouldn't matter if it was running Windows, BSD, or Linux as there would be ZERO PATCHES applied to the machine for most if not all of its life.
That is why frankly all machines of that type need to be running a custom built RTOS with as little OS as possible, preferably just enough to do the function. Now if you want to build that out of Linux, BSD, Windows, or even OS/2? Really makes no difference to me, whatever floats your boat. but since it will never get updated you damned well better make it as thin, stripped down and light as possible.
In the end this is exactly the kind of job that Windows and Linux embedded should be used for, but because its cheaper to just slap a copy of Windows Embedded with everything left at default instead of actually thinking about what the program actually needs to function and stripping out the rest you get dumbshit moves where things like PCs controlling respirators have a fricking web browser.
ACs don't waste your time replying, your posts are never seen by me.