A team of physicians and computer scientists at the University of California has shown that it is easy to modify medical test results remotely by attacking the connection between hospital laboratory devices and medical record systems.
These types of attacks might be more likely used against high-profile targets, such as heads of state and celebrities, than against the general public. But they could also be used by a nation-state to cripple the U.S.’ medical infrastructure.
The researchers from UC San Diego and UC Davis detailed their findings Aug. 9 at the Black Hat 2018 conference in Las Vegas, where they staged a demonstration of the attack. Dubbed Pestilence, the attack is solely proof-of-concept and will not be released to the general public. While the vulnerabilities the researchers exploited are not new, this is the first time that a research team has shown how they could be exploited to compromise patient health.
These vulnerabilities arise from the standards used to transfer patient data within hospital networks, known as the Health Level Seven standards, or HL7. Essentially the language that allows all devices and systems in a medical facility to communicate, HL7 was developed in the 1970s and has remained untouched by many of the cybersecurity advances made in the last four decades.
Implementation of the standards on aging medical equipment by personnel with little or no cybersecurity training has led to untold amounts of patient data circulating in an unsecure fashion. Specifically, the data are transmitted as unencrypted plain text on networks that do not require any passwords or other forms of authentication.
Data hacking in hospitals has been in the news in recent years. But researchers want to draw attention to how that data, once compromised, could be manipulated. “Healthcare is distinct from other sectors in that the manipulation of critical infrastructure has the potential to directly impact human life, whether through direct manipulation of devices themselves or through the networks which connect them,” the researchers write in a white paper released in conjunction with their Black Hat demonstration.
The vulnerabilities and methodologies used to create the Pestilence tool have been previously published. The innovation here is combining computer science know-how and clinicians’ knowledge to exploit weaknesses in the HL7 standard to negatively impact the patient care process.
Researchers used what’s called a “man in the middle attack,” where a computer inserts itself between the laboratory machine and the medical records system. Maxwell Bland, a master’s student in computer science, automated the attack so it could tackle large amounts of data remotely. Researchers did not infiltrate an existing hospital system, of course. Instead, they built a testbed comprised of medical laboratory testing devices, computers and servers. This allowed the team to run tests, such as blood and urine analysis, intercept the test results, change them and then send the modified information to a medical records system.
Researchers took normal blood test results and modified them to make it look like the patient was suffering from diabetic ketoacidosis, or DKA, a severe complication of diabetes. This diagnosis would cause physicians to prescribe an insulin drip, which in a healthy patient could lead to a coma, or even death.
Researchers also modified normal blood test results to look like the patient had extremely low potassium. Treatment with a potassium IV on a healthy patient would cause a heart attack, which would likely be fatal.
The researchers detail a number of steps that hospitals and government agencies can take to protect medical infrastructure in their Black Hat white paper.
