Slashdot Mirror
Researcher: Drug Infusion Pump Is the "Least Secure IP Device" He's Ever Seen
chicksdaddy writes: This is a bad month for the medical equipment maker Hospira. First, security researcher Billy Rios finds a raft of serious and remotely exploitable holes in the company's MedNet software, prompting a vulnerability alert from ICS CERT. Now, one month later, ICS CERT is again warning of a "10 out of 10" critical vulnerability, this time in Hospira's LifeCare PCA drug infusion pump. The problem? According to this report by Security Ledger the main problem was an almost total lack of security controls on the device. According to independent researcher Jeremy Williams, the PCA pump listens on Telnet port 23. Connecting to the device via Telnet, he was brought immediately to a root shell account that gave him total, administrator level access to the pump without authentication. "The only thing I needed to get in was an interest in the pump," he said. Richards found other examples of loose security on the PCA 3: a FTP server that could be accessed without authentication and an embedded web server that runs Common Gateway Interface (CGI). That could allow an attacker to tamper with the pump's operation using fairly simple scripts. Also: The PCA pump stores wireless keys used to connect to the local (medical device) wireless network in plain text on the device. That means anyone with physical access to the Pump (which has an ethernet port) could gain access to the local medical device network and other devices on it. The problems prompted Richards to call the PCA 3 pump "the least secure IP enabled device" he has ever worked with.
In 5, 4, 3.....
Which OS is that thing running?
I work in animal health care and I don't see devices like this... nothing even freaking close. Truly stunning security was this lax.
There are only 10 kinds of people in the world. Those that understand binary and those that don't.
That's frickin' amazing. I can't wait to hear about drug pumps spamming from formail.cgi.
I forget what 8 was for.
You can also exploit the thing by opening it up and cutting wires.
Look, this is a medical device. People carry it around with them. Sometimes, a technician may need to make changes to it. They do that by plugging into an ethernet port on the device. Otherwise, it is never plugged in.
Do I need a security passcode on everything that somebody could walk up to? Give me a break. My microwave doesn't have one either.
Once your opponent has physical access to the sensitive medical devices that keep you alive, you're fucked. He could just as well put bleach in the insulin bag.
the coroner has no clue.
This vulnerability has been there for YEARS. And I believe Hospira has a updated firmware.
Blame the various Biomed departments for not installing the updated boards.
Also, the best way to attack a Hospita implementation is at the database that it talks to.
You have a strong command of English, and write persuasively in your criticisms. This worries me.
I'm concerned that someone may read your post and think that you are something other than completely ignorant about this topic.
For the good of all, please never comment on a security-related article again.
Sounds as insecure as some phone systems - but much more of a worry.
Sounds like development on the cheap and pocket the profits for selling the niche product for a fortune.
The problem is that somebody else can get to the supply. The system goes through a lot of trouble to make sure somebody doesn't siphon off the drug. Getting into the guts of the machine, bypassing the log functions and bog knows what else might be very tempting to the right person. All the more so since the pumps are used all of the time - you could have a good supply of your favorite narcotic.
I give it a couple of weeks before a simple exploit gets published somewhere.
Faster! Faster! Faster would be better!
Typically they are a small button you push. With a minimum timeout until the next dose set by the doctor is allowed.
Things like this do not need remote access. People need to get off their butts and manually operate sensitive devices like this. Who are these people trying to connect every damn thing to a network?
The first device you have ever seen in your entire life is the least secure device you have ever seen, because you've seen nothing else. Get lost, kid.
Is supposed to be the extensive testing and super security the industry is so renowned for.
If you're going to steal the drugs, you're just going to slip into the room, snip the tube, and walk out with the bottle of narcotics. You're not going to bother to hack the system so that it doses out an extra mg or two for you to siphon off. Even if you did manage to bypass any other hurdles and got the machine to dose out more than it was suppose to, at most you'd get fairly limited supply before they realized they went through a bottle of narcotics far faster than the machine should have been administrating it.
It's even easier. You just shut it off and pull the drug while they're sleeping.
My dad had that happen at least once during a weeks long hospital stay. They took forever figuring out how to get him more morphine... as he'd already been prescribed and there are at least reasonable safeguards on the overprescription side.
They even had an idea who it was, as missing drugs was a problem in that ward. They didn't do anything, just said "watch out for that guy". I'm sure they eventually caught him... it's extremely likely someone like that is going to make a mistake... but he sure was hurting a lot of people along the way. The hospital sure could have tried harder to catch him.
the device makers collect the big bucks on every sale, facilities turn around and charge patients big bucks every time they're utilized (even though they save staff hours... or maybe because of that..... greedy fucks), and then also charge big bucks for the drugs (as much as $1000 or more per dose) that drip through them.
with all the revenue these things generate, you'd think that maybe somewhere someone would put at least a little effort into security of them... but nope.
As a former employee of Hospira who was outsourced (after starting from day 1 and working there for 6 years) - I am not surprised. Moving all IT and development offshore was going to have its consequences, and reading this makes me gloat.
I had a PCA hooked up after having my broken my collar bone and shattered my wrist re-assembled. The method for me to get a shot of morphine was to simply push a button. The system was set that I could only get a certain number of presses per hour.
That said I didn't use the button at all. They had given me oral painkillers and I was fine with those for the 8 hours I had to wait before they let me go home. For the most part I was just seriously bored. My entertainment was my laptop and watching tv shows on it. It would have been trivial for me to connect an Ethernet cable and mess away.
Barnaby Jack
not a bug, it's a feature ;)
This honestly says very little.
And yet, the stock price is at an all-time high. Must be all the media attention!