Slashdot Mirror
Hackers Can Falsify Patient Vitals (bleepingcomputer.com)
Hackers can falsify patients' vitals by emulating data sent from medical equipment clients to central monitoring systems, a McAfee security researcher revealed over the weekend at the DEF CON 26 security conference. BleepingComputer: The research, available here, takes advantage of a weak communications protocol used by some patient monitoring equipment to send data to a central monitoring station. McAfee security researcher Douglas McKee says he was able to reverse engineer this protocol, create a device that emulates patients vitals, and send incorrect information to a central monitoring station. This attack required physical access to the patient, as the attacker needed to disconnect the patient monitoring client and replace it with his own device that feeds incorrect patient vitals to the central station monitored by medical professionals. But McKee also devised another method of feeding central monitoring stations without needing to disconnect the patient monitoring client.
mcfuckee reports an analog hacker can write false data on patient chart.
"This attack required physical access to the patient, as the attacker needed to disconnect the patient monitoring client and replace it with his own device that feeds incorrect patient vitals to the central station monitored by medical professionals"
How do I get a job as a "Security Researcher"?
If you have physical access to the person you want to harm and that person is already in a state where they need life monitoring equipment and can apparently not shout to the nurse or anything... It seems easier to just.. you know... harm them.
Shoot some Drano on the IV drip or what ever.
Seems pretty convoluted and slower to rig up some hack.
But they need editor acce...err...nm
Sig Follows: "Suppose you were an idiot. And suppose you were a member of Congress. But I repeat myself." -- Mark Twain
And this, kids, is why no network admin with the brains G_d gave your average cockroach allows unauthenticated computers on a network. Granted, some of these older units still use serial connections up to an aggregator, but TFA mentioned ARP spoofing. I accidentally shut down half a basement at a hospital at one point by plugging my laptop into a port in the training room. The ports on that network switch were locked to specific MAC addresses, and would actually shut down if a network adapter with any other MAC address than the designated one were plugged in. It was somewhat embarrassing.
And it's also one of the reasons why every reasonable EMR requires that human eyes look at the data before adding it to the database. Yes, you could fudge factor vitals readings to a certain extent, but the human body is a collection of systems that have really nice feedback loops to maintain equilibrium. If you see a change in one measurement, there will almost always be a corresponding change in one or more others. So, it's not enough to change an SpO2 reading. You not only need to know what the clinically valid ranges are for an SpO2 reading, but what changing SpO2 will do for respiration and pulse rate. And then you get to add additional factors (like COPD) into the mix.
So, all in all, this would take someone with some level of medical training, a specific goal in mind, an almost criminally stupid network admin, and active cooperation from the patient to make it work.
Karma: Chameleon - mostly influenced by bad '80s New Wave music
This attack required physical access to the patient
If you have physical access to a patient that has one of these machines hooked up to them then you could just as easily inject something into their IV line because they are definitely going to have one. A simple bacteria or viral load would be far easier and make their death look natural. Faking their vitals and hoping they die from their existing injuries is just a stupid plan.
Anons need not reply. Questions end with a question mark.
"Before The Devil Knows Your Dead" showed you don't need hax0r skillz at all to pull this off.
"Love heals scars love left." -- Henry Rollins
This is an extremely misleading article. There is no facts presented and no proof of any of claims. As usual with mainstream media these are quick to be funded by Clinton Foundation to spread anti-Russia propaganda to hurt our president.
Test leads and a lot of medical cabling is very cheaply made and unshielded. It is very easy to use induction to modify the reading the equipment is getting from the test leads without disconnecting anything. Disconnecting things would trigger alarms on the stuff sending data to the central monitoring station. Of course, you still need access to the patient.
The kind that is used when developing monitoring equipment...