The Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) issued an alert yesterday warning that some 300 medical devices developed by roughly 40 different vendors contain hard-coded passwords that could be used by unauthorized individuals to access these machines and potentially modify critical settings and device firmware.
US-CERT published the alert in concert with a memo from the United States Food and Drug Administration outlining a set guidelines designed to encourage medical device manufacturers to better secure defibrillators, insulin pumps, pacemakers and other devices before they reach patients.
The warning is based on a yet-unreleased report developed by Cylance researchers Billy Rios and Terry McCorkle. The hundreds of vulnerable devices uncovered by the pair of researchers include surgical and anesthesia devices, ventilators, drug infusion pumps, external defibrillators, patient monitors, and laboratory and analysis equipment.
ICS-CERT is coordinating with affected vendors to identify vulnerable devices and provide fixes for them. In the meantime, they are recommending that device manufacturers, healthcare facilities, and users of these devices take proactive measures to minimize the risk of exploitation of these and other vulnerabilities.
ISC-CERT and the FDA are not aware of any in-the-wild exploits.
The two alerts published yesterday are part of an ICS-CERT and FDA partnership aimed at better protecting patients who may receive treatments involving computerized medical devices.
“The Department of Homeland Security’s (DHS) Industrial Control Systems-Cyber Emergency Response Team (ICS-CERT) is working directly with the Food and Drug Administration (FDA) and medical devices manufacturers, health care professionals and facilities to investigate and address the reported vulnerabilities,” said DHS spokesman Sy Lee. “DHS actively collaborates with public and private sector partners every day to identify and reduce adverse impacts on the nation’s critical cyber systems.”
