Security Flaws in Patient Medical Devices Put Lives at Risk
Advances in the IoT medical devices market are rapidly innovating how we treat patients, often to a remarkable effect. Layering robotics with medicine and factoring the Internet of Things (IoT) into patient monitoring has opened up a new world for medical treatment, supporting remote patient care. The healthcare IoT market surged throughout the pandemic — and is expected to rise at a rate of 25.9% to $446.52 billion by 2028.
However, there's a catch: Many IoT medical devices are hackable, and compromised devices can lead to catastrophic patient outcomes.
Escalating Cyber Risks: IoT Medical Devices Connected to Outdated Operating Systems
While advanced IoT devices change how patients receive care, recent history sheds light on escalating cyber risks. In 2017, WannaCry ransomware infiltrated outdated Windows systems, entering 70,000 devices across National Health Services hospitals in England and Scotland. Ambulances stalled, hospitals closed, and patient monitoring was disrupted, delaying care and threatening lives.
Lessons from history are often repeated — and sometimes escalated. Gartner predicts that by 2025 attacks on operational technology (OT) environments linked to medical IoT devices will be hacked and weaponized during cyberattacks with the intent to cause physical harm or even death — costing over $50 billion per year.
Just a Few Examples of Hackable IoT Medical Devices
Keeping a close eye on IoT medical devices and their cybersecurity risks is a matter of life or death.
Tread cautiously with these seven IoT medical devices:
1. Next-Generation Teleoperated Surgical Robots: The Raven II
In 2001, Professor Jacques Marescaux used telesurgery and robotics from his offices in New York to perform a cholecystectomy on a 68-year-old woman in France. Since then, experts in robotics and medicine have worked around the clock to make telesurgery a viable option for anyone.
While telesurgery and robotics are most often used while the surgeon is in the same room as the patient, operating over a secure hardwire, surgeons will eventually use them to intervene during situations that are unsafe for humans (like battle scenes, chemical fires, earthquake rescue missions, and pandemics). But there's a catch: Treatment will likely occur over insecure networks — and cybercriminals can easily infiltrate them. During research at the University of Washington, The Raven II, a telesurgery robot, was easily hacked. Even a tiny interference could have deadly consequences in actual practice.
2. Infusion Pumps: The B. Braun Infusomat Space Large Volume Pump and B. Braun SpaceStation
Imagine you're lying in a hospital bed after surgery, blissfully unaware of your body's distressed state thanks to the IV drip of painkillers. And then you suddenly wake up to excruciating pain because someone hacked into the network and shut off the infusion pump — or even worse, you don't wake up at all because a hacker doubled the rate of flow.
Cybersecurity researchers revealed vulnerabilities that could lead to such an overdose when they hacked into the B. Braun Infusomat Space Large Volume Pump and B. Braun SpaceStation. Ironically, these IoT devices have a locked-down software design with thoughtful security features that are intended to keep patients safe from hackers. Researchers found an easy loophole: They hacked into the hospital's network and exploited a common connectivity vulnerability, which allowed them to compromise the security of the B. Braun infusion pumps. "Successful exploitation of these vulnerabilities could allow a sophisticated attacker to compromise the security of the Space or compact plus communication devices, allowing an attacker to escalate privileges, view sensitive information, upload arbitrary files, and perform remote code execution," announced B. Braun in a security statement.
3. Insulin Pumps: Medtronic and Johnson & Johnson
Medical device company Medtronic issued an urgent recall of their insulin pump controllers thanks to researcher Jay Radcliffe discovering connective vulnerabilities, potentially allowing an attacker to overdose the user. And it’s not the first time hackers have exploited vulnerabilities in Insulin Pumps: Back in 2016, Johnson & Johnson announced that one of its insulin pumps could be hacked, possibly overdosing the patients. The solution? Users were asked to disable a remote control feature, patch a vulnerability, and program the device using a maximum insulin release setting. (Now imagine your grandparent was using the insulin pump, and had to take each of those steps to stay safe.)
4. Imaging Devices: GE Imaging and Ultrasound Devices
According to the 2020 Unit 42 IoT Threat Report, a shocking 83% of hospital imaging devices run on unsupported operating systems — an easy entry point for malicious actors.
In 2020, researchers from CyberMDX found critical vulnerabilities attributed to default global credentials used in management software that affected over 100 radiology tools from GE (including molecular imaging devices, mammography devices, MRI machines, CT and PET Scans, advanced visualization, ultrasounds, and X-rays). "Successfully exploiting the vulnerability may expose sensitive data — such as protected health information (PHI) — or could allow the attacker to run arbitrary code," researchers explained. And this could "impact the availability of the system and allow manipulation of PHI."
5. Health Monitors: IntelliVue Information Center iX (PIIC iX) Developed by Philips
Several months ago, researchers at Nozomi Networks Labs discovered five new vulnerabilities in patient monitoring systems. Health monitors track a patient's vitals and alert staff should anything go wrong — and these monitors are particularly vulnerable to attacks because they're connected to the more extensive communications network and have large attack surfaces. A hacker could change settings, obscure the displayed data, or silence alarms, leaving patients in urgent need without help.
6. Digital Smart Pens
Doctors use digital smart pens to prescribe medications and then swiftly transmit them to pharmacies — along with a patient's sensitive information, including their name, address, and health records. Security researcher Saurabh Harit of Spirent SecurityLabs revealed that it's entirely possible to reverse-engineer the pen and uncover all that information. Even worse, a digital smart pen could serve as an entry point into a larger operating system — and cybercriminals could potentially access databases with patient records.
7. Implantable Cardiac Devices: Pacemakers
The U.S. Department of Homeland Security released a medical advisory statement exposing the vulnerabilities in several pacemaker models. Dick Cheney famously had his pacemaker modified back in 2007 to protect against a virtual assassination.
Hospital staff can protect themselves and their patients by following cybersecurity hygiene basics, keeping software and virus protection up-to-date, running vulnerability assessments and adopting zero-trust policies, modernizing legacy systems, training staff on cybersecurity best practices, and following the FDA's Medical Device Safety Action Plan.
