Story image

Warnings issued: ‘Hackable’ hospital syringes could be fatal

13 Sep 17

Many worst fears have been realised after news emerged that specific automated syringes within hospitals are ‘hackable’.

Independent researcher Scott Gayou determined not one but eight vulnerabilities within Smiths Medical’s Medfusion 4000 wireless Syringe Infusion Pump.

What does this mean exactly? The MedFusion 4000 is a popular product that is used commonly on critical care, pediatric, and neonatal patients.

The device is a replacement for manual dosing and is regarded as a ‘safer’ option as it ensures patients get the precise dose required because anything else could be fatal – for example, in newborns.

The report from Scott Gayou was released by the Department of Homeland Security and comes with very specific warnings.

“Successful exploitation of these vulnerabilities may allow a remote attacker to gain unauthorised access and impact the intended operation of the pump,” the report states.

“Despite the segmented design, it may be possible for an attacker to compromise the communications module and the therapeutic module of the pump.”

Essentially, a skilled hacker could take advantage of the security flaw within the device from anywhere in the world and take over and control it.

The company plans to fix the security flaw and release a new version in 2018, but until then, hospitals have been warned.

Director of Government Relations at McAfee, Gordon Morrison says cybercrime is building as we progress further with the Internet.

“IT and security professionals in healthcare organisations are facing unprecedented pressure – from an increase in demand and complexity of services, to the threat of legacy IT and a number of new compliance issues like GDPR and the Information governance toolkit,” says Morrison.

“Alongside these challenges, hospitals are going through immense digital transformation, with new connected medical devices being introduced to improve the doctor and patient experience.”

Morrison asserts that despite the massive potential of the healthcare Internet of Things, it’s a double-edged sword as many of these devices are prone to hacking, which is putting both hospital networks and the patients themselves at risk.

“It is essential to ensure these devices are not introduced at the expense of the safety of the patient and their data,” says Morrison.

“Achieving this will be twofold: ensuring that the devices are built securely by design and with the necessary security controls in place; as well as a security policy for connected devices in hospitals, to ensure that they can’t access sensitive data and are regularly patched against newly-discovered vulnerabilities.”

Symantec releases neural network-integrated USB scanning station
Symantec Industrial Control System Protection Neural helps defend against USB-borne cyber attacks on operational technology.
SingleSource scores R&D grant to explore digital identity over blockchain
Callaghan Innovation has awarded a $318,000 R&D grant to Auckland-based firm SingleSource, a company that applies risk scoring to digital identity.
Ramping up security with next-gen firewalls
The classic firewall lacked the ability to distinguish between different kinds of web traffic.
Spark Lab launches free cybersecurity tool for SMBs
Spark Lab has launched a new tool that it hopes will help New Zealand’s small businesses understand their cybersecurity risks.
Gartner names LogRhythm leader in SIEM solutions
Security teams increasingly need end-to-end SIEM solutions with native options for host- and network-level monitoring.
Cylance makes APIs available in endpoint detection offering
Extensive APIs enable security teams to more efficiently view, enrich, and contextualise real-time intelligence collected at the endpoint to keep systems secure.
SolarWinds adds SDN monitoring support to network management portfolio
SolarWinds announced a broad refresh to its network management portfolio, as well as key enhancements to the Orion Platform. 
JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t.