Slashdot Mirror
Researchers: Thousands of Medical Devices Are Vulnerable To Hacking
itwbennett writes: At the DerbyCon security conference, researchers Scott Erven and Mark Collao explained how they located Internet-connected medical devices by searching for terms like 'radiology' and 'podiatry' in the Shodan search engine. Some systems were connected to the Internet by design, others due to configuration errors. And much of the medical gear was still using the default logins and passwords provided by manufacturers. 'As these devices start to become connected, not only can your data gets stolen but there are potential adverse safety issues,' Erven said.
every-damn-thing is, IF it's connected. once.
Most anyone that has dealt with these devices have known this for a decade. Almost all MRI machines are insecure in every way. Hell even the little drug dose meter boxes have an open serial port on them.
Do not look at laser with remaining good eye.
... by those tricksy hobbitses ...
Proofreading. Try it.
Meanwhile, Win 10 is pushing updates without asking that have bricked some computers.
Heck, would you like to post how any car since 1992 can easily be hacked remotely?
-- Tigger warning: This post may contain tiggers! --
Speaking as a contractor that looks after a number of health organisation in Australia.
All devices that we are putting in are vlaned and have specific firewall rules so that
a. They can only contact the IP and port of the govt server that requires the information from the device.
b. Nothing on both the internal network and the external network cannot get access to it all.
Other than that, there is nothing we can do. The govt IT manages those devices including passwords.
We also have to deal with computer illiterate health professionals which certainly doesn't help with the whole situation.
So no doubt Raytheon will get another no-bid $billion contract to 'secure' hospitals.
https://www.youtube.com/watch?v=b0w36GAyZIA
Medical devices really get put through a very very anal (no pun intended, eww) process before receiving regulatory approval. While I am not claiming that processi s perfect they are some of the safest and most tamper and foolproof devices produced. So I conclude this article is basically FUD.
"this show is amazing. it's like the howard the duck of tv shows. it's a show about technology that uses 0% real technology." ref
Embedded XP!
And they never get updated, since that would likely require re-authorization for that equipment state, by the FDA. Which, costs the vendor money, which they are loathe to spend.
Why yes, I do work in IT in a VERY large state healthcare system.
Perhaps this is my failure to truly understand the scope of the problem, but where is the real motivation for hackers to compromise MRI machines and CAT scanners? Seriously. Why would somebody go to any level of effort and for that matter risk the felony charges that would come as a result?
I am not questioning that such a thing would be a violation of privacy. I am also not questioning that there is potential for serious harm to be maliciously done to or against somebody. I merely question the scope of the threat in terms of motivating factors. It is clear to me the motivating factor of compromising email. Serious hackers are motivated by Nationalism/Activism, financial gain, or sexual thrill/lulz. Hack the email account of important people or enemies and use private information to damage them or their cause. This can also get you closer to hacking their bank account for money, or possibly finding lewd or compromising content that can be used to blackmail them for money. Or maybe you are just doing it for the thrill of potentially finding sexual content that others are not supposed to see.
Beyond just the occasional script kiddie doing it for the lulz, I don't see many motivating factors to go through the trouble. Even if you leave the door to your house wide open, the vast majority of people won't risk walking in, especially if they know there is little of value in the house, and especially if they know the danger of being caught. It is still trespassing even if your door is open because of the fact that you weren't invited.
And I'm pretty sure it was made in the 90s.
Medical devices are highly regulated. Clinical trials are extremely expensive to run, and the FDA can demand new clinical trials every time you push through a software update. At the very least, you have to file with the FDA (for every single software update) a document demonstrating that nothing substantial was changed in the operating of the device.