Recent research has identified a new trend in cyber attacks targeting connected medical devices—by simply monitoring the network traffic for common error messages, hackers can gain valuable insight into the inner workings of a device’s application.
New research from Zingbox, a provider of a healthcare Internet of Things (IoT) analytics platform, identifies new trends in connected medical device hacking that could impact patients’ protected health information (PHI).
Hackers are leveraging error messages from connected medical devices, including radiology, X-ray and other imaging systems, to gain valuable insights. These insights are then used to refine the attacks, increasing the chance of a successful hack, according to the research.
The information gathering phase of a typical cyberattack is a very time intensive phase where hackers learn as much as they can about the target network and devices, according to researchers. By simply monitoring the network traffic for common error messages, hackers can gain valuable insight into the inner workings of a device’s application; the type of web server, framework and versions used; the manufacturer that developed it; the database engine in the back end; the protocols used; and even the line of code that is causing the error, researchers note.
Hackers can also target specific devices to induce error messages. With this information, the information gathering phase is greatly shortened and they can quickly customize their attack to be tailored to the target device.
Zingbox’s research discovered that information shared as part of common error messages can be leveraged by hackers to compromise target connected devices. What’s more, hackers can “trick” or induce medical devices into sharing detailed information about the device’s inner workings. Leveraging this information quickens a hacker’s access to a hospital’s network, the researchers found.
“Hackers are finding new and creative ways to target connected medical devices. We have to be in front of these trends and vulnerabilities before they can cause real harm,” Xu Zou, Zingbox CEO and co-founder, said in a statement.
“Imagine how much more effective hackers can be if they find out that a device is running on IIS Web Server, using Oracle as backend and even gathering usernames,” Daniel Regalado, principal security researcher at Zingbox and co-author of Gray Hat Hacking, said in a statement. “That will help them to focus their attack vectors towards the database where PHI data might be stored.”
The research also revealed that the healthcare industry has made great strides in collaborating across providers, vendors and manufacturers: there was rapid response and a willingness to generate patches for their medical devices from three out of seven manufacturers whose devices were included in the study. However, the researches note, there is still work to be done to bring the urgency of these findings as well as increased collaboration between security vendors and device manufacturers.
