Medical device hijack

A medical device hijack (also called medjack) is a type of cyber attack. The weakness they target are the medical devices of a hospital. This was covered extensively in the press in 2015 and in 2016.^{[1][2][3][4][5][6][7][8][9][10][11]}

Medical device hijacking received additional attention in 2017. This was both a function of an increase in identified attacks globally and research released early in the year.^{[12][13][14][15][16]} These attacks endanger patients by allowing hackers to alter the functionality of critical devices such as implants, exposing a patient's medical history, and potentially granting access to the prescription infrastructure of many institutions for illicit activities.^[17] MEDJACK.3 seems to have additional sophistication and is designed to not reveal itself as it searches for older, more vulnerable operating systems only found embedded within medical devices. Further, it has the ability to hide from sandboxes and other defense tools until it is in a safe (non-VM) environment.

There was considerable discussion and debate on this topic at the RSA 2017 event during a special session on MEDJACK.3. Debate ensued between various medical device suppliers, hospital executives in the audience and some of the vendors over ownership of the financial responsibility to remediate the massive installed base of vulnerable medical device equipment.^[18] Further, notwithstanding this discussion, FDA guidance, while well intended, may not go far enough to remediate the problem. Mandatory legislation as part of new national cyber security policy may be required to address the threat of medical device hijacking, other sophisticated attacker tools that are used in hospitals, and the new variants of ransomware which seem targeted to hospitals.

Overview

In such a cyberattack the attacker places malware within the networks through a variety of methods (malware-laden website, targeted email, infected USB stick, socially engineered access, etc.) and then the malware propagates within the network. Most of the time existing cyber defenses clear the attacker tools from standard serves and IT workstations (IT endpoints) but the cyber defense software cannot access the embedded processors within medical devices. Most of the embedded operating systems within medical devices are running on Microsoft Windows 7 and Windows XP. The security in these operating systems is no longer supported. So they are relatively easy targets in which to establish attacker tools. Inside of these medical devices, the cyber attacker now finds safe harbor in which to establish a backdoor (command and control). Since medical devices are FDA certified, hospital and cybersecurity team personnel cannot access the internal software without perhaps incurring legal liability, impacting the operation of the device or violating the certification. Given this open access, once the medical devices are penetrated, the attacker is free to move laterally to discover targeted resources such as patient data, which is then quietly identified and exfiltrated.

Organized crime targets healthcare networks in order to access and steal the patient records.

Because of the vast breadth of interconnection between medical devices and hospital networks, there are security concerns because medical equipment are not usually considered for routine discovery scans within the context of IT. The IP addresses connecting these devices to the hospital network might lack the necessary software patching and this exposes both the network and devices to a plethora of vulnerabilities.^[19]

Impacted devices

Virtually any medical device can be impacted by this attack. In one of the earliest documented examples testing identified malware tools in a blood gas analyzer, magnetic resonance imaging (MRI) system, computerized tomogram (CT) scan, and x-ray machines. In 2016 case studies became available that showed attacker presence also in the centralized PACS imaging systems which are vital and important to hospital operations. In August 2011, representatives from IBM demonstrated how an infected USB device can be used to identify the serial numbers of devices within a close range and facilitate fatal dosage injections to patients with an insulin pump in the annual BlackHat conference.^[20]

Impacted institutions

This attack primarily centers on the largest 6,000 hospitals on a global basis. Healthcare data has the highest value of any stolen identity data, and given the weakness in the security infrastructure within the hospitals, this creates an accessible and highly valuable target for cyber thieves. Besides hospitals, this can impact large physician practices such as accountable care organizations (ACOs) and Independent Physician Associations (IPAs), skilled nursing facilities (SNFs) both for acute care and long-term care, surgical centers and diagnostic laboratories.

Instances

There are many reports of hospitals and hospital organizations getting hacked, including ransomware attacks,^{[21][22][23][24]} Windows XP exploits,^[25][26] viruses,^[27][28][29] and data breaches of sensitive data stored on hospital servers.^{[30][22][31][32]}

Community Health Systems, June 2014

In an official filing to the United States Securities and Exchange Commission, Community Health Systems declared that their network of 206 hospitals in 28 states were targets of a cyber-attack between April and June 2014.^[33] The breached data included sensitive personal information of 4.5 million patients including social security numbers. The FBI determined that the attacks were facilitated by a group in China^[34] and issued a broad warning to the industry, advising companies to strengthen their network systems and follow legal protocols to help the FBI restraint future attacks.^[35]

Medtronic, March 2019

In 2019 the FDA submitted an official warning concerning security vulnerabilities in devices produced by Medtronic ranging from Insulin pumps to various models of cardiac implants.^[36] The agency concluded that CareLink, the primary mechanism used for software updates in addition to monitoring patients and transferring data during implantation and follow-up visits, did not possess a satisfactory security protocol to prevent potential hackers from gaining access to these devices. The FDA recommended that health care providers restrict software access to established facilities while unifying the digital infrastructure in order to maintain full control throughout the process.^[36]

Scope

Various informal assessments have estimated that medical device hijacking currently impacts a majority of the hospitals worldwide and remains undetected in the bulk of them. The technologies necessary to detect medical device hijacking, and the lateral movement of attackers from command and control within the targeted medical devices, are not installed in the great majority of hospitals as of February 2017. A statistic would note that in a hospital with 500 beds, there are roughly fifteen medical devices (usually internet of things (IoT) connected) per bed.^[37] That is in addition to centralized administration systems, the hospital diagnostic labs which utilized medical devices, EMR/EHR systems and CT/MRI/X-ray centers within the hospital.

Detection and remediation

These attacks are very hard to detect and even harder to remediate. Deception technology (the evolution and automation of honeypot or honey-grid networks) can trap or lure the attackers as they move laterally within the networks. The medical devices typically must have all of their software reloaded by the manufacturer. The hospital security staff is not equipped nor able to access the internals of these FDA approved devices. They can become reinfected very quickly as it only takes one medical device to potentially re-infect the rest in the hospital.

Countermeasures

On 28 December 2016 the US Food and Drug Administration released its recommendations that are not legally enforceable for how medical device manufacturers should maintain the security of Internet-connected devices.^[38][39] The United States Government Accountability Office studied the issue and concluded that the FDA must become more proactive in minimizing security flaws by guiding manufacturers with specific design recommendations instead of exclusively focusing on protecting the networks that are utilized to collect and transfer data between medical devices.^[40] The following table provided in the report^[40] highlights the design aspects of medical implants and how they affect the overall security of the device in focus.

See also

• Computer security § Medical systems

References

1. "Medical Devices Used as Pivot Point in Hospital Attacks: Report - SecurityWeek.Com".
2. Ragan, Steve (4 June 2015). "Attackers targeting medical devices to bypass hospital security".
3. "Medical data, cybercriminals' holy grail, now espionage target". Reuters. 5 June 2017.
4. "'MEDJACK' tactic allows cyber criminals to enter healthcare networks undetected". 4 June 2015.
5. "MEDJACK: Hackers hijacking medical devices to create backdoors in hospital networks".
6. "Hospitals Can Protect Against Data Breach Using Deception Technologies – Electronic Health Reporter".
7. "Encrypting medical records is vital for patient security – Third Certainty".
8. "Medjacking: The newest healthcare risk?". 24 September 2015.
9. "Epidemic: Researchers Find Thousands of Medical Systems Exposed to Hackers". 29 September 2015.
10. "Medical Devices a Target for Online Hackers – JD Supra".
11. Hacking Healthcare IT in 2016
12. "Medical Devices Are the Next Security Nightmare – WIRED". Wired.
13. "4 cybersecurity threats every hospital C-suite admin should be familiar with in 2017".
14. "MEDJACK.3 Poses Advanced Threat To Hospital Devices". 16 February 2017.
15. "The lurker in your MRI machine wants money, not your life – Archer Security Group". 16 February 2017.
16. "San Mateo cyber security firm uncovers malware on medical devices". 16 February 2017.
17. ProQuest 1799648673
18. "Connected medical devices spark debate at RSA Conference session".
19. "Medical Device Security in the IoT Age". ieeexplore.ieee.org. Retrieved 2024-01-31.
20. Hei X., Du X. (2013) Conclusion and Future Directions. In: Security for Wireless Implantable Medical Devices. SpringerBriefs in Computer Science. Springer, New York, NY
21. Leetaru, Kalev. "Hacking Hospitals And Holding Hostages: Cybersecurity In 2016". Forbes. Retrieved 29 December 2016.
22. "Cyber-Angriffe: Krankenhäuser rücken ins Visier der Hacker". Wirtschafts Woche. 7 December 2016. Retrieved 29 December 2016.
23. "Hospitals keep getting attacked by ransomware — Here's why". Business Insider. Retrieved 29 December 2016.
24. "MedStar Hospitals Recovering After 'Ransomware' Hack". NBC News. 31 March 2016. Retrieved 29 December 2016.
25. Pauli, Darren. "US hospitals hacked with ancient exploits". The Register. Retrieved 29 December 2016.
26. Pauli, Darren. "Zombie OS lurches through Royal Melbourne Hospital spreading virus". The Register. Retrieved 29 December 2016.
27. "Grimsby hospital computer attack: 'No ransom has been demanded'". Grimsby Telegraph. 31 October 2016. Retrieved 29 December 2016.^{[permanent dead link]}
28. "Hacked Lincolnshire hospital computer systems 'back up'". BBC News. 2 November 2016. Retrieved 29 December 2016.
29. "Lincolnshire operations cancelled after network attack". BBC News. 31 October 2016. Retrieved 29 December 2016.
30. "Legion cyber-attack: Next dump is sansad.nic.in, say hackers". The Indian Express. 12 December 2016. Retrieved 29 December 2016.
31. "Former New Hampshire Psychiatric Hospital Patient Accused Of Data Breach". CBS Boston. 27 December 2016. Retrieved 29 December 2016.
32. "Texas Hospital hacked, affects nearly 30,000 patient records". Healthcare IT News. 4 November 2016. Retrieved 29 December 2016.
33. "Form 8-K". www.sec.gov. Retrieved 2019-09-15.
34. "Community Health says data stolen in cyber attack from China". Reuters. 2014-08-18. Retrieved 2019-09-15.
35. "Advice to Healthcare Providers on Ransomware from the Head of the FBI". The National Law Review. Retrieved 2019-09-15.
36. Health, Center for Devices and Radiological (2019-03-21). "Cybersecurity Vulnerabilities Affecting Medtronic Implantable Cardiac Devices, Programmers, and Home Monitors: FDA Safety Communication". FDA.
37. "The Healthcare CIO Factbook". 13 January 2021.
38. Becker, Rachel (27 December 2016). "New cybersecurity guidelines for medical devices tackle evolving threats". The Verge. Retrieved 29 December 2016.
39. "Postmarket Management of Cybersecurity in Medical Devices" (PDF). Food and Drug Administration. 28 December 2016. Retrieved 29 December 2016.
40. Medical Devices : FDA Should Expand Its Consideration of Information Security for Certain Types of Devices : Report to Congressional Requesters. Washington, D.C: United States Government Accountability Office; 2012.