Slashdot Mirror
Researcher: Drug Infusion Pump Is the "Least Secure IP Device" He's Ever Seen
chicksdaddy writes: This is a bad month for the medical equipment maker Hospira. First, security researcher Billy Rios finds a raft of serious and remotely exploitable holes in the company's MedNet software, prompting a vulnerability alert from ICS CERT. Now, one month later, ICS CERT is again warning of a "10 out of 10" critical vulnerability, this time in Hospira's LifeCare PCA drug infusion pump. The problem? According to this report by Security Ledger the main problem was an almost total lack of security controls on the device. According to independent researcher Jeremy Williams, the PCA pump listens on Telnet port 23. Connecting to the device via Telnet, he was brought immediately to a root shell account that gave him total, administrator level access to the pump without authentication. "The only thing I needed to get in was an interest in the pump," he said. Richards found other examples of loose security on the PCA 3: a FTP server that could be accessed without authentication and an embedded web server that runs Common Gateway Interface (CGI). That could allow an attacker to tamper with the pump's operation using fairly simple scripts. Also: The PCA pump stores wireless keys used to connect to the local (medical device) wireless network in plain text on the device. That means anyone with physical access to the Pump (which has an ethernet port) could gain access to the local medical device network and other devices on it. The problems prompted Richards to call the PCA 3 pump "the least secure IP enabled device" he has ever worked with.
In 5, 4, 3.....
Which OS is that thing running?
I work in animal health care and I don't see devices like this... nothing even freaking close. Truly stunning security was this lax.
There are only 10 kinds of people in the world. Those that understand binary and those that don't.
That's frickin' amazing. I can't wait to hear about drug pumps spamming from formail.cgi.
I forget what 8 was for.
You can also exploit the thing by opening it up and cutting wires.
Look, this is a medical device. People carry it around with them. Sometimes, a technician may need to make changes to it. They do that by plugging into an ethernet port on the device. Otherwise, it is never plugged in.
Do I need a security passcode on everything that somebody could walk up to? Give me a break. My microwave doesn't have one either.
Once your opponent has physical access to the sensitive medical devices that keep you alive, you're fucked. He could just as well put bleach in the insulin bag.
the coroner has no clue.
The device at hand here is designed to allow for the patient to administer - while in the hospital - the analgesics (pain medication). It isn't described well in this summary how the patient is supposed to interact with the pump in order to dictate when the medication is administered.
While this security is indeed abysmal, patients who need PCA aren't likely capable of hacking their pump via telnet; think of the last time you needed narcotic pain medication and try to imagine yourself pulling a laptop out of a bag, connecting an ethernet cable, starting telnet, etc...
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
This vulnerability has been there for YEARS. And I believe Hospira has a updated firmware.
Blame the various Biomed departments for not installing the updated boards.
Also, the best way to attack a Hospita implementation is at the database that it talks to.
Not this specific device, but the very similar network exploits for a drug pump specifically and potential impact were already described in Sharper Security, pages 56-57, 68-70.
Sounds as insecure as some phone systems - but much more of a worry.
Sounds like development on the cheap and pocket the profits for selling the niche product for a fortune.
The first device you have ever seen in your entire life is the least secure device you have ever seen, because you've seen nothing else. Get lost, kid.
Is supposed to be the extensive testing and super security the industry is so renowned for.
all of a sudden he's the leetest hacker who's ever lived
the device makers collect the big bucks on every sale, facilities turn around and charge patients big bucks every time they're utilized (even though they save staff hours... or maybe because of that..... greedy fucks), and then also charge big bucks for the drugs (as much as $1000 or more per dose) that drip through them.
with all the revenue these things generate, you'd think that maybe somewhere someone would put at least a little effort into security of them... but nope.
As a former employee of Hospira who was outsourced (after starting from day 1 and working there for 6 years) - I am not surprised. Moving all IT and development offshore was going to have its consequences, and reading this makes me gloat.
Barnaby Jack
not a bug, it's a feature ;)
This honestly says very little.
And yet, the stock price is at an all-time high. Must be all the media attention!