Medical equipment is increasingly connected to the internet. This offers all kinds of advantages, but also makes it essential to adequately protect these devices and the data stored on them from unauthorised access. Unfortunately, things sometimes go wrong, a recent data breach at US manufacturer of portable oxygen concentrators Inogen being a case in point. In the data leak, data of 30,000 customers fell into the hands of unauthorised persons.
Inogen itself reported the data breach to the US Securities and Exchange Commission (SEC). One or more attackers managed to access the e-mail account of an Inogen employee on 2 January using stolen login credentials, after which they were able to access this account until 14 March. The attackers were thus able to operate unhindered for almost two months. How they managed to get their hands on the employees' login details is not known.
Identification numbers, type numbers and health insurance
The US company has had the data breach investigated by a forensics firm. This investigation shows that the attacker managed to access Inogen customer data. Among other things, Medicare identification numbers, users' health insurance information and the specific type of device customers use were leaked. Inogen stresses that medical data, Social Security numbers (the US counterpart of the citizen service number) and financial data were not captured.
Unfortunately, this is not the first time that medical devices have proved susceptible to cyber attacks. This while such attacks can have far-reaching consequences. For instance, security problems can allow malicious parties not only to get their hands on customer data, but in some cases also to manipulate medical devices. Depending on the type of medical device manipulated, this can lead to a lot of inconvenience, physical injury or, in the worst case, even fatalities.
Pacemaker from St. Jude Medical
An example of a security vulnerability that has the potential to cause fatalities is a vulnerability in pacemakers from the manufacturer Abbott, which formerly operated under the name St. Jude Medical. This security vulnerability allowed attackers to affect the pacemaker's operation. This allowed them to drain the battery faster, disable the pacemaker or adjust its rhythm.
The leak in pacemakers was brought out by investment firm Muddy Waters and research firm MedSec. The manner in which this was done has caused much controversy, as Muddy Waters and MedSec did not give Abbott the opportunity to fix the problems before they were made public. This is common practice when reporting security problems and prevents disclosure of a vulnerability from compromising the security of end users. However, despite this questionable procedure, the vulnerabilities in the pacemakers are serious.
No authentication
The security problem is in the Merlin@home devices, which are placed in patients' homes and communicate with pacemakers. The Merlin@home devices also transmit data from the pacemakers to Abbott servers. However, the Merlin@home devices were found to be able to connect to pacemakers without authentication, allowing any Merlin@home device to be linked to any pacemaker. Anyone with a Merlin@home device in their hands as a result can use it to control not only their own pacemaker, but also those of third parties. A Merlin@home device can be bought through online marketplaces for several tens of dollars, among others.
Abbott's vulnerable pacemakers are used by hundreds of thousands of people worldwide. In the United States (US) alone, for example, 465,000 patients had to have their pacemaker's software updated to fix the security problem. Incidentally, there are no known cases of pacemakers being hacked in practice.
Vulnerable medical scanners
Earlier this year, researchers from Israel's Ben-Gurion University showed that medical scanners such as MRI and CT scanners are susceptible to cyber attacks. Many of these devices do not receive security updates, which in practice means that owners of medical devices cannot close security problems discovered in these devices and thus remain vulnerable to cyber attacks. Because information about such security problems can easily be found on the internet, this makes it a breeze for attackers to break into the devices.
Such an attack on a medical scanner can have all kinds of consequences. For instance, attackers can increase the radiation dose, manipulate scan results, make the medical scanner digitally inaccessible so that it can no longer be controlled or disable the device completely. Incidentally, in their study, the researchers also looked at the security of other medical systems, including information systems. Many of these systems were found to have security problems. CT scanners were found to contain the most vulnerabilities of all the systems investigated. More information on Ben-Gurion University's research can be found here.
Author: Wouter Hoeffnagel
Source: Inogen / Securities and Exchange Commission
Source: Muddy Waters / MedSec
Source: Ben-Gurion University
Source photo: Pixabay / methodshop
