This year’s MRMCD16 had a topic that immediately
let me submit a talk about medical device security: “diagnosis:critical”. Or to
quote the official website:
Security issues in soft- and hardware have a low chance of healing, especially
in medical IT.
Despite years of therapy using code reviews and programming guidelines, we still
face huge amounts of vulnerable software that probably is in need of palliative
treatment.
Security vulnerabilities caused by the invasion of IT in the medical sector are
becoming real threats. From insulin pumps over analgesic pumps through to pace
makers, more and more medical devices have been hacked already. This year’s
motto “mrmcd2016 - diagnosis:critical” stands summarizing for the current state
of the whole IT sector.
Niklaus and me had the chance to talk about our research on RedStar OS on the
32nd Chaos Communication Congress in Hamburg this year. You can see the talk
online at
media.ccc.de
or on Youtube.
We talked about the details of the watermarking mechanism that
we found in July
and additional features of RedStar OS like it’s “Virus Scanner” and the system
architecture. During the days after our talk we were able to find watermarks
applied by RedStar OS in the wild on some sites on the Internet. We can confirm
at least 7 different instances of RedStar OS that have applied watermarks to
JPGs. Cleaning up the data is work in progress and we will get back to you with
the results! Niklaus has put our presentation and additional resources in the
git. Feel free to join us in our
research and make the world a safer place!
That was the opener for my presentation on the Security in Medical Devices at
CodeBlue 2015 last week in Tokyo, Japan. A
Code Blue
often describes a patient in a critical condition, mostly needing resuscitation.
That just seemed to be a perfect match, also in the sense that the condition of
some medical devices out there are still pretty critical concerning security. If
you follow our current research on this you know what I am talking about. I hope
that we are not talking about this topic anymore three years from now. That
would mean that we have made the world a safer place, although it took some time
… 😉
During the last few months information about one of North Koreas operating
systems was leaked. It is a Linux based OS that tries to simulate the look and
feel of a Mac. Some of it’s features have already been discussed on
variousblogposts and news
articles.
We thought we would take a short look at the OS. This blog post contains some of
the results.
As you can imagine, most interesting for us was to investigate features that
impact the privacy of the users. There are some
publications concerning the security
of the OS, this is an aspect that we will not cover in this post. We will stick
to a privacy issue that we identified in this post. As ERNW has a long history
of “Making the World a Safer Place”, we consider this topic an important one.
The privacy of potential users (especially from North Korea) may be impacted and
therefore we think that the results must be made available for the public. So,
here we go …
Last week I gave a short interview for Süddeutsche Zeitung on the security of
medical devices. You can find it
here.
Unfortunately it is in German so I decided to sum up some of my key points that
made it into the article and some that didn’t in this blog post.
The medical devices that we have been looking into include patient monitors,
syringe pumps, EEGs, home monitoring devices and an MRI. All of these devices
had major flaws that look like they came straight out of the 90s. Sometimes, we
were able to crash the machines by simply doing a port scan, sometimes we could
get around access controls protecting PIN codes of devices, and in most cases we
were able to render the machine unusable. All these attacks were performed over
the network and no physical access to the device was needed.
As you might know we are continuously doing
research on medical devices.
I presented some of the new results at
Power of Community 2014
last week and we thought we would share some of the details with you here. The
focus of the previous work was testing medical devices that are used in
hospitals like patient monitors, syringe pumps or even MRIs. This time we looked
at a device that every user can use at home and which is available to anyone on
the market: A smart scale.
I had the pleasure to participate in this year’s
Power of Community
and was invited to talk about the insecurity of medical devices. The conference
is based in Seoul, Korea and started in 2006. It has a strong technical focus
and it is a community driven event. For me it was great to participate as mostly
hackers from Asia were there and I got the chance to talk to a lot of nice folks
that I wouldn’t be able to meet otherwise. This is especially true for the host,
vangelis.
We just got
credits
for a flaw we found in SAP Netweaver. The issue is a reflected
Cross-Site Scripting
(XSS). It can be triggered in the administrative interface for the Internet
Communication Manager (ICM) and Web Dispatcher. This means that the targets for
this XSS will definitely be users with administrative privileges. This makes it
especially juicy for an attacker.
SAP rated the vulnerability with CVSS and a Base Score of 4.3 having a Base
Vector of AV:N/AC:M/AU:N/C:N/I:P/A:N. Which again opens the discussion on how
to rate the impact of XSS by using CVSS. CVSS
states that XSS
“should be scored with no impact to confidentiality or availability, and
partial impact to integrity“, which is clearly arguable. Especially when
thinking of the impact on confidentiality. As you might know by now, we tried to
tackle the problem of rating vulnerabilities ourselves with the
ERNW Rapid Rating System
(ERRS) and it was not an easy task. 😉 However, SAP states that this is a
correction with high priority, so you should apply the patches as soon as
possible.
One of our guiding principles at ERNW is “Make the World a Safer Place”. There
could not be a topic that matches this principle more than the security or
insecurity of medical devices. This is why we started a research project that is
looking at how vulnerable those devices are that might be deployed in hospitals
around the world. Recently the U.S. Food and Drug Administration (FDA) has put
out
a recommendation concerning
the security of medical devices. It recommends that “manufacturers and health
care facilities take steps to assure that appropriate safeguards are in place to
reduce the risk of failure due to cyberattack, which could be initiated by the
introduction of malware into the medical equipment or unauthorized access to
configuration settings in medical devices and hospital networks”. We thought
that we should take a look at how manufacturers deal with security for these
devices.
Michael Thumann and me had the chance to give a talk at this year’s
ISSE conference in Brussels, Belgium. ISSE was
founded in 1999 as an initiative of the European Commission Directorate General
Information Society. The con had a focus on eGovernment, electronic business
processes and the corresponding security issues.
We talked about the ERRS, the
ERNW Rapid Rating System,
that can be used to perform a vulnerability rating for findings that result from
different kinds of sources. Audits and Pentests will find a vast amount of
vulnerabilities in the infrastructure. To deal with these vulnerabilities, you
have to use some kind of prioritization in order to use resources effectively.
We tried to adopt the strengths from metrics like CVSS and developed our own set
of parameters to calculate the metric, focussing on the relevant customer
questions concerning vulnerabilities from all kinds of sources.