Security researchers say at least 68,000 medical systems - such as MRI scanners and infusion systems - from a "large anonymous group of health, in the United States" are available online for hackers to attack.
Researchers Scott and Mark Erven Collao in piracy Derbyco conference explained that they were able to access many medical devices interfaces using the search engine Shodan, which specifically hunting for Internet-connected devices. The pair explained that through further intelligent research they managed to build a detailed picture of the devices used by the organization of health in particular, including details on where medical devices were in a particular building.
There is no data on the unit while it is available, however: the team reported that they were able to identify "direct attack vectors," which could be used to steal data from patients devices, too.
The team also explained that for six months they ran software that claimed to be an MRI and defibrillator as a honeypot for hackers. During this period, they observed thousands of attempts to connect to devices and 299 attempts to install malicious software on them, suggesting the same thing happens in hospitals worldwide. This could be a problem because, as Collao told The Register, "[Medical Devices] are all running Windows XP or XP Service Pack two ... and probably do not have antivirus because they are critical systems."
It is not, of course, the first time the digital security of medical devices has been questioned. Malware is said to be "rampant" in hospitals, and earlier this year, it emerged that hackers could divert drug infusion pumps. Clearly something must be done - but knowing where to start is perhaps the biggest problem.
Researchers Scott and Mark Erven Collao in piracy Derbyco conference explained that they were able to access many medical devices interfaces using the search engine Shodan, which specifically hunting for Internet-connected devices. The pair explained that through further intelligent research they managed to build a detailed picture of the devices used by the organization of health in particular, including details on where medical devices were in a particular building.
There is no data on the unit while it is available, however: the team reported that they were able to identify "direct attack vectors," which could be used to steal data from patients devices, too.
The team also explained that for six months they ran software that claimed to be an MRI and defibrillator as a honeypot for hackers. During this period, they observed thousands of attempts to connect to devices and 299 attempts to install malicious software on them, suggesting the same thing happens in hospitals worldwide. This could be a problem because, as Collao told The Register, "[Medical Devices] are all running Windows XP or XP Service Pack two ... and probably do not have antivirus because they are critical systems."
It is not, of course, the first time the digital security of medical devices has been questioned. Malware is said to be "rampant" in hospitals, and earlier this year, it emerged that hackers could divert drug infusion pumps. Clearly something must be done - but knowing where to start is perhaps the biggest problem.
1 comments:
very interesting article about medical devices. Though it has cons, the advantages of using medical equipment overpowers cons. like in
Used stryker 1288 HD camera we can see inner organs of the patient which is very useful during diagnosis.
EmoticonEmoticon