This is a story that I heard about before, but I’m posting about it today because it was mentioned on Security Now this week.
Conficker worm found in hospital equipment Mercury News
Apparently, hospitals are taking devices which shouldn’t be connected to the internet and they are then hooking them into the internet. These devices have relatively unpatched versions of Microsoft Windows. Since these devices aren’t meant to be hooked up to the internet, the manufacturers do not keep up with updates to the OS.
Here’s the first problem, the FDA requires a 90 day notice for updates to the firmware of medical devices. The computer virus basically has two life cycles. Either the virus is in the wild before the patch (i.e. zero day). Or the patch goes out (the patch for the security hole that Conficker uses went out in October last year) and then gets reverse engineered as soon as it is released by the people who write viruses. So, if the patch had been submitted to the FDA, it would have been updated in January.
The second problem, is that no one was paying attention since these devices aren’t supposed to be connected…so here we are in May, and security experts are now noticing that devices like imaging machines are sending out for instructions.
I’ve been sitting here theorizing about how this works, but I’m not really sure how. I mean, if the machine is reaching out to the internet on its own (not through a terminal) then it must have an ethernet port. But why would a medical device have an ethernet port if it isn’t meant to be connected to the internet. This may be how the machine gets up. In the day, devices would have a special serial port in the back that would allow for the machine to be set up. This may now have been replaced with an ethernet port since no one has serial ports on their machines any more.
In any case, this is a problem, but probably not a huge one. First off, this is probably a scenario that a virus writer would not have thought about…yet. Viruses that are meant to gather data are usually aimed towards financial data (so this would be more of a problem for a cash register). Second, there isn’t a whole lot of money in your personal medical data. You might get a situation where a virus author can blackmail the hospital for hush money, but there are just easier and more lucrative targets for virus authors.
The problems come where a machine starts trying to do a DDoS attack or starts sending out spam. Medical devices may not have the greatest computing power, and a virus can eat up a lot of a machine’s resources. This could theoretically slow down a machine until it malfunctions. Additionally, there is a new concern where an unrelated trojan, Zeus, issued a command to a botnet which self-destructed 100,000 PCs (or rather their OS). There really isn’t a great reason to do this for someone running a botnet, but now it has been done. The machines obviously didn’t physically blow up, but would you like to have an MRI machine bluescreening on startup?
Chances are, a lot of these devices should have an ability to reimage with the original firmware. Reimage machines, unplug embedded devices from the network (or create an internal network which is separate from internet), and stop using removable storage (USB keys)…then you should be good until patches start coming. However, now that this has happened, security of medical devices should now be an important part of any medical facility…even if that security is ensuring that your devices stand alone.