Check Point researchers demonstrated how it is possible to quickly access IoT medical devices. It serves as a warning not to ignore the security risks of medical devices.
There were big technological developments in the last few years that led to the creation of new medical equipment. However, the IT settings where the devices are used generally lack proper security measures.
One problem is that a lot of medical gadgets still employ legacy systems and operating systems like Windows 2000, Windows XP and Windows 7, which are no longer patched. Also, these have vulnerabilities that can quickly be taken advantage of to get access to patient information or the system connected to the devices. Even if there are patches available, using them may be hard and requires sizeable downtime. As a result, devices usually continue to be unpatched and susceptible to cyberattack.
A lot of healthcare companies also use medical devices developed by different manufacturers. Determining vulnerabilities and making sure there are patches available can be a big challenge.
In a blog post of Check Point, researchers showed the simplicity of hacking a medical device. They hacked an ultrasound machine to show its vulnerability and how they were able to access sensitive patient data.
The OS of the ultrasound machine was Windows 2000. It was so easy to exploit the machine’s vulnerability and access its system. The researchers were able to control the system and download information saved on the device, such as DICOM photos.
The researchers demonstrated how to replace a specific patient’s images and upload malware or ransomware to the device. Although an ultrasound machine was used for demonstration, the vulnerabilities of other medical devices could easily be exploited.
Hackers are attracted to IoT Devices. They like to target healthcare providers since they keep large volumes of highly sensitive data that criminals can use to fake identities, submit falsified tax returns, acquire healthcare services and prescriptions by means of medical identity theft, access the financial accounts of patients, and possibly launch attacks with the intent of harming patients.
Ransomware attacks may also be quite lucrative. By encrypting sensitive medical data, hackers can demand ransoms. In numerous cases, healthcare companies had to give the ransom demand to restore data access.
The problem may likely grow worse with more healthcare devices. Check Point mentioned a Business Insider report that says healthcare IoT devices will grow from 95 million devices (2015) to 646 million (2020). It is expected that at the closing of 2019 87% of healthcare companies will be using IoT devices.
Making sure that devices run on updated operating systems and patching immediately will enhance security. However it would be really difficult to identify and fix vulnerabilities with countless devices connected to the net.
Check Point recommends to have an innovative prevention security solution to handle the security risks of healthcare devices. It would be necessary to do network segmentation. Separate patient information from the remainder of the IT network so that healthcare IT experts can clearly see network traffic and identify strange movement that may suggest a data breach or compromised IoTdevice. Segmentation also help to prevent data theft or isolate encrypting malware that propagate across the network.