A Kaspersky Lab Global Research & Analysis Team (GReAT) expert has conducted real field research at one private clinic in an attempt to explore its security weaknesses.<\/p>\n
Vulnerabilities were found in medical devices that opened a door for cybercriminals to access the personal data of patients, as well as their physical well-being, the cybersecurity company said.<\/p>\n
A modern clinic is a complicated system, Kaspersky Lab said.\u00a0 It has sophisticated medical devices that comprise fully functional computers with an operating system and applications installed on them.<\/p>\n
Doctors rely on computers, and all information is stored in a digital format. In addition, all healthcare technologies are connected to the Internet.<\/p>\n
“So, it comes as no surprise that both medical devices and hospital IT infrastructure have previously been targeted by hackers,” Kaspersky said. The most recent examples of such incidents are ransomware attacks against hospitals in the US and Canada, it said.<\/p>\n
Clinics store personal information about their patients. They also own and use very expensive, hard to fix and replace equipment, which makes them a potentially valuable target for extortion and data theft.<\/p>\n
The outcome of a successful cyberattack against a medical organisation could involve the following:<\/p>\n
The first thing that a Kaspersky Lab expert decided to explore, while conducting this research, was to understand how many medical devices around the globe are now connected to the Internet, the cybersecurity firm said.<\/p>\n
Modern medical devices are fully-functional computers with an operating system and most of these have a communication channel to the Internet. By hacking them, criminals could interfere with their functionality, Kaspersky Lab said.<\/p>\n
A quick search for Internet-connected devices showed hundreds of devices – from MRI scanners, to cardiology equipment, radioactive medical equipment and other related devices,\u00a0Kaspersky said.<\/p>\n
“This discovery leads to worrisome conclusions – some of these devices still work on old operational systems such as Windows XP, with unpatched vulnerabilities, and some even use default passwords that can be easily found in public manuals.<\/p>\n
“Using these vulnerabilities criminals could access a device interface and potentially affect the way it works,” it said.<\/p>\n
The most obvious and logical way to access data is to try to attack a medical facility’s local network. “During the research a vulnerability was found in the clinic\u2019s Wi-Fi connection. Through a weak communications protocol access to the local network was gained,” Kaspersky said.<\/p>\n
During further exploration of the network, Kaspersky Lab said its expert discovered a new vulnerability in a medical device application.<\/p>\n
A command shell was implemented in the user\u2019s interface that could give cybercriminals access to personal patient information, including their clinical history and information about medical analysis, as well as their addresses and ID details.<\/p>\n
Moreover, through this vulnerability the whole device controlled with this application could be compromised.<\/p>\n
For example, among these devices could be MRI scanners, cardiology equipment, radioactive and surgical equipment. Firstly, criminals could alter the way the device works and cause physical damage to the patients. Secondly, criminals could damage the device itself at immense cost to the hospital.<\/p>\n
“Clinics are no longer only doctors and medical equipment, but IT services too. The work of a clinic\u2019s internal security services affects the safety of patient data and the functionality of its devices,” said Sergey Lozhkin, senior researcher at Kaspersky Lab\u2019s GReAT.<\/p>\n
“Medical software and equipment engineers put a lot of effort into creating a useful medical device that will save and protect human life, but they sometimes completely forget about protecting it from unauthorised external access.”<\/p>\n
When it comes to new technologies, safety issues should be addressed at the first stage of the research and development (R&D) process, Kaspersky Lab said.<\/p>\n
Hacking tools that terrorise the internet<\/a><\/strong><\/p>\n