The Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team (DHS ICS-CERT) have issued warnings to healthcare providers about vulnerabilities in several medical devices manufactured by Silex Technology, GE Healthcare, and Phillips. In their statement, they warn that the vulnerabilities may exploited in such a manner that unauthorized individuals could potentially take control of the devices and access sensitive data.
Phillips Brilliance CT Scanners
In early May, Phillips alerted the National Cybersecurity and Communications Integration Center (NCCIC) about security vulnerabilities affecting its Brilliance CT scanners. Since the discovery, Phillips security specialists have been working to fix the vulnerabilities. The company has been cooperating with DHS to alert users of its devices of the issues in order to reduce risk of data being stolen. To date, no incidents of system breaches due to the vulnerabilities have been discovered.
Three vulnerabilities have been discovered to affect the following scanners:
- Brilliance 64 version 2.6.2 and below
- Brilliance iCT versions 4.1.6 and below
- Brillance iCT SP versions 3.2.4 and below
- Brilliance CT Big Bore 2.3.5 and below
See ICS-CERT advisory (ICSMA-18-123-01) for more information on the nature of the breaches.
The Brilliance CT scanners operate user functions within a contained kiosk environment in the Windows OS. One vulnerabiltiy-CVE-2018-8853 – could be exploited to allow an unauthorized individual or kiosk application user to gain unauthorized elevated privileges and access to unauthorized resources from the underlying Windows OS.
Another vulnerability, CVE-2018-8861, in an issue in the Brilliance CT kiosk environment which could be exploited to allow an unauthorized attacker or limited access kiosk user to break out of the containment of the kiosk environment, gain elevated privileges from the underlying Windows OS, and access resources from the operating system.
CVE-2018-8857 is a vulnerability associated with hard-coded credentials used for inbound authentication and outbound communication. Those credentials could be compromised, allowing access to the system to be gained.
CVE-2018-8853 and CVE-2018-8861 both have a CVSS v3 base score of 6.1, while CVE-2018-8857 has a CVSS v3 base score of 8.4.
As the vulnerabilities require user interaction, they cannot be exploited remotely. According to a statement issued by Phillips, “An attacker would need local access to the kiosk environment of the medical device to be able to implement the exploit.” If exploited, the attacker could execute commands with elevated privileges and gain access to “restricted system resources and information.” The attacker would not need high levels of technical skills to exploit the system vulnerability.
The vulnerabilities are considered low-risk, but under the company’s responsible disclosure policy, an advisory was issued to alert users to the risk. The company also provided information to users to reduce risk to a minimal level.
Phillips recommends only using Brilliance CT products within the specifications authorized by Phillips, such as only using Phillips-approved software, system services, and security configurations. Physical controls should also be implemented to limit access to the devices and protect sensitive information, since the system cannot be access remotely.
Phillips has taken action by remediating hard-coded credentials for its Brilliance iCT 4.x system and later versions and will continue to assess further options for remediating the vulnerabilities.
Silex SX-500, SD-320AN Wireless and GE Healthcare MobileLink
Two vulnerabilities have been discovered to affect certain Silex Technology products and GE Healthcare MobileLink technology.
The vulnerabilities, tracked as CVE-2018-6020 and CVE-2018-6021, have been assigned a CVSS v3 rating of 6.5 and 7.4 respectively. See ICS-CERT advisory (ICSMA-18-128-01)
The following products are susceptible to one or both of the vulnerabilities:
GEH-500 (V 1.54 and earlier), SX-500 (all versions), GEH-SD-320AN (V GEH-1.1 and earlier), and SD-320AN (V 2.01 and earlier). The following GE MAC Resting ECG analysis systems may use vulnerable MobileLink Technology: MAC 3500, MAC 5000 (E.O.L 2012), MAC 5500 and MAC 5500 HD.
An attacker would require a low level of skill to exploit these vulnerabilities. If exploited, they could allow an unauthorized individual to modify system settings and remotely execute code. ICS-CERT notes that public exploits for the vulnerabilities are available.
CVE-2018-6020 concerns a lack of verification of authentication when making certain POST requests, which could allow the modification of system settings. CVE-2018-6021 concerns an improperly sanitized system call parameter, which could allow remote code execution.
The following recommendations have been made by Silex/GE Healthcare:
“To mitigate CVE-2018-6020 on GE MobileLink/SX-500, users should enable ‘update’ account within the web interface, as this is not enabled by default. To prevent changes to device configuration, users should set a secondary password for the ‘update’ account.”
Silex Technology and GE Healthcare have produced updated firmware to resolve the CVE-2018-6021 vulnerability for GE MobileLink/GEH-SD-320AN, which will be available for download from May 31, 2018 once testing of the firmware has been completed.
NCCIS suggests users should minimize network exposure for control system devices and/or systems to ensure they cannot be accessed over the Internet. All controls systems and remote devices should be located behind firewalls and isolated from business networks. If remote access is required, a VPN should be used.
NCCIC has advised users to conduct an impact analysis and risk assessment prior to any attempt to mitigate the vulnerabilities.