Patient Monitors Altered, Drug Dispensary Popped In Colossal Hospital Hack Test (theregister.co.uk)

It's not just hospital networks that are in danger; mask.of.sanity writes with this story at The Register: Security researchers have exploited notoriously porous hospital networks to gain access to, and tamper with, critical medical equipment in attacks they say could put lives in danger. In tests, hospital hackers from the Independent Security Evaluators research team popped patient monitors, making them display false readings which could result in medical responses that injury or kill patients. Full paper here.

Comments

Well

[jarablue]

Um, don't hook them up to the network? Have nurses do actual work with written data instead of some need with always being online? I could be talking out of my ass here but everything doesn't need to be online. Really?

Re:Well

[Anonymous Coward]

1973 called, they want their medical technology back. Please include a supply of leaches and a decent tome on the four medical humors. Oh, and a bone saw.

Re:Well

[Lisias]

How do you think electronic medical records get updated, exactly?

Using a secure intranet, bridged only to authorised pars using a VPN ?

Re:Well

[Khyber]

Leeches are still used medically today and with good reason, you ill-educated nitwit.

Ditto bone saws.

Re:Well

[Khyber]

"God forbid we try and track a patient long term, especially those with complex medical issues."

What, too lazy to use a fucking fax machine?

What're you going to do when your medical records system loses power and you can't access patient information?

That's why every doctor's office I go to keeps a CARBON COPY BACKUP.

"Popped"

[Anonymous Coward]

This word is used twice this way in the summary. What does it mean to "pop" a dispensary or patient monitor?

Security? Thats for nerds.

[bazmail]

This is symptomatic of the general tech ignorant populace not caring about security intil its too late. This incident will blow over and security will be forgotten about again until the real bad guys come calling.

The new IoT stuff is wide open to hackers too. People seem to only only care if they can control something with their iphone so can show off to friends. The sales people and manufacturers know this all too well and don't give a fuck about it.

Come on

[nospam007]

For the last 100 years any idiot could 'hack' the patient file hanging on the foot of the bed with a tool called a 'pen', changing 5 milligrams to 75 or whatever.
Now you need some brains.

Re:Come on

[Fish (David Trout)]

For the last 100 years any idiot could 'hack' the patient file hanging on the foot of the bed with a tool called a 'pen', changing 5 milligrams to 75 or whatever.

Quite true, but in order to do that you had to be physically present.

Now you need some brains.

Brains is not the problem.

The fact that you can do such nefarious hacking remotely is the problem. You no longer need to be physically present.

THAT is what is concerning.

Re:Come on

[jomama717]

"Hacking" a hand-written chart requires physical access to the chart, which requires physical access to the hospital room, which means you'll likely be seen by the front desk (who would need to actively let you in), security cameras, nurses, the patient etc. If the networked devices are vulnerable you could modify every chart from the back of a van in the parking lot or, worst case, from your parents' basement.

The paper says ...

[Ihlosi]

The paper says they didn't hack the patient monitor, only considered such devices as possible attack targets.

Re:The paper says ...

[SlaveToTheGrind]

Where do you see that? Page 36 sure sounds like they did:

On a disconnected network segment, our team demonstrated an authentication bypass attack to gain access to the patient monitor in question, and instructed it to perform a variety of disruptive tasks , such as sounding false alarms, displaying incorrect patient vitals, and disabling the alarm.

Paper records suck to manage

[sjbe]

What, too lazy to use a fucking fax machine?

Great, now you have multiple copies in random locations with no cohesion AND you need extra staff to manage all the extra paper. Congratulations for taking a bad system and making it worse.

What're you going to do when your medical records system loses power and you can't access patient information?

Every hospital has fallback procedures for this exact scenario. These include robust power backup including generators. Furthermore even if there is a complete power loss for a time paper records are not going to make things better, especially in a large hospital. I don't think you comprehend just how hugely inefficient paper records actually are to use. Ironic given that you are posting to a site like slashdot.

That's why every doctor's office I go to keeps a CARBON COPY BACKUP.

No they don't. My wife is a doctor and I've worked in hospital systems. I'm aware of NO medical office that keeps a carbon copy backup of all their paperwork. In fact I've never even seen a piece of carbon paper in a doctors office in the last 20 years.