Medical device hijack
A medical device hijack (also called medjack) is a type of cyber attack. The weakness they target are the medical devices of a hospital. This was covered extensively in the press in 2015 and in 2016.
Medical device hijacking received additional attention in 2017. This was both a function of an increase in identified attacks globally and research released early in the year. These attacks endanger patients by allowing hackers to alter the functionality of critical devices such as implants, exposing a patient's medical history, and potentially granting access to the prescription infrastructure of many institutions for illicit activities. MEDJACK.3 seems to have additional sophistication and is designed to not reveal itself as it searches for older, more vulnerable operating systems only found embedded within medical devices. Further, it has the ability to hide from sandboxes and other defense tools until it is in a safe (non-VM) environment.
There was considerable discussion and debate on this topic at the RSA 2017 event during a special session on MEDJACK.3. Debate ensued between various medical device suppliers, hospital executives in the audience and some of the vendors over ownership of the financial responsibility to remediate the massive installed base of vulnerable medical device equipment. Further, notwithstanding this discussion, FDA guidance, while well intended, may not go far enough to remediate the problem. Mandatory legislation as part of new national cyber security policy may be required to address the threat of medical device hijacking, other sophisticated attacker tools that are used in hospitals, and the new variants of ransomware which seem targeted to hospitals.
Overview
In such a cyberattack the attacker places malware within the networks through a variety of methods (malware-laden website, targeted email, infected USB stick, socially engineered access, etc.) and then the malware propagates within the network. Most of the time existing cyber defenses clear the attacker tools from standard serves and IT workstations (IT endpoints) but the cyber defense software cannot access the embedded processors within medical devices. Most of the embedded operating systems within medical devices are running on Microsoft Windows 7 and Windows XP. The security in these operating systems is no longer supported. So they are relatively easy targets in which to establish attacker tools. Inside of these medical devices, the cyber attacker now finds safe harbor in which to establish a backdoor (command and control). Since medical devices are FDA certified, hospital and cybersecurity team personnel cannot access the internal software without perhaps incurring legal liability, impacting the operation of the device or violating the certification. Given this open access, once the medical devices are penetrated, the attacker is free to move laterally to discover targeted resources such as patient data, which is then quietly identified and exfiltrated.
Organized crime targets healthcare networks in order to access and steal the patient records.
Impacted devices
Virtually any medical device can be impacted by this attack. In one of the earliest documented examples testing identified malware tools in a blood gas analyzer, magnetic resonance imaging (MRI) system, computerized tomogram (CT) scan, and x-ray machines. In 2016 case studies became available that showed attacker presence also in the centralized PACS imaging systems which are vital and important to hospital operations. In August 2011, representatives from IBM demonstrated how an infected USB device can be used to identify the serial numbers of devices within a close range and facilitate fatal dosage injections to patients with an insulin pump in the annual BlackHat conference.
Impacted institutions
This attack primarily centers on the largest 6,000 hospitals on a global basis. Healthcare data has the highest value of any stolen identity data, and given the weakness in the security infrastructure within the hospitals, this creates an accessible and highly valuable target for cyber thieves. Besides hospitals, this can impact large physician practices such as accountable care organizations (ACOs) and Independent Physician Associations (IPAs), skilled nursing facilities (SNFs) both for acute care and long-term care, surgical centers and diagnostic laboratories.
Instances
There are many reports of hospitals and hospital organizations getting hacked, including ransomware attacks,Windows XP exploits, viruses, and data breaches of sensitive data stored on hospital servers.
Community Health Systems, June 2014
In an official filing to the United States Securities and Exchange Commission, Community Health Systems declared that their network of 206 hospitals in 28 states were targets of a cyber-attack between April and June 2014. The breached data included sensitive personal information of 4.5 million patients including social security numbers. The FBI determined that the attacks were facilitated by a group in China and issued a broad warning to the industry, advising companies to strengthen their network systems and follow legal protocols to help the FBI restraint future attacks.
Medtronic, March 2019
In 2019 the FDA submitted an official warning concerning security vulnerabilities in devices produced by Medtronic ranging from Insulin pumps to various models of cardiac implants. The agency concluded that CareLink, the primary mechanism used for software updates in addition to monitoring patients and transferring data during implantation and follow-up visits, did not possess a satisfactory security protocol to prevent potential hackers from gaining access to these devices. The FDA recommended that health care providers restrict software access to established facilities while unifying the digital infrastructure in order to maintain full control throughout the process.
Scope
Various informal assessments have estimated that medical device hijacking currently impacts a majority of the hospitals worldwide and remains undetected in the bulk of them. The technologies necessary to detect medical device hijacking, and the lateral movement of attackers from command and control within the targeted medical devices, are not installed in the great majority of hospitals as of February 2017. A statistic would note that in a hospital with 500 beds, there are roughly fifteen medical devices (usually internet of things (IoT) connected) per bed. That is in addition to centralized administration systems, the hospital diagnostic labs which utilized medical devices, EMR/EHR systems and CT/MRI/X-ray centers within the hospital.
Detection and remediation
These attacks are very hard to detect and even harder to remediate. Deception technology (the evolution and automation of honeypot or honey-grid networks) can trap or lure the attackers as they move laterally within the networks. The medical devices typically must have all of their software reloaded by the manufacturer. The hospital security staff is not equipped nor able to access the internals of these FDA approved devices. They can become reinfected very quickly as it only takes one medical device to potentially re-infect the rest in the hospital.
Countermeasures
On 28 December 2016 the US Food and Drug Administration released its recommendations that are not legally enforceable for how medical device manufacturers should maintain the security of Internet-connected devices. The United States Government Accountability Office studied the issue and concluded that the FDA must become more proactive in minimizing security flaws by guiding manufacturers with specific design recommendations instead of exclusively focusing on protecting the networks that are utilized to collect and transfer data between medical devices. The following table provided in the report highlights the design aspects of medical implants and how they affect the overall security of the device in focus.