Docs ran a simulation of what would happen if really nasty malware hit a city's hospitals. RIP :(

The lessons will be costly in money and lives

I can understand that medical equipment was not created with security in mind. Who in their right mind would want to hack a pacemaker ?

The problem is that there are many people who are not in their right mind, for whatever reason. So now we're going to have to add security to our medical environment and we're going to have to do it right, because when you're having a heart attack the last thing you want is the doctor having mistyped his password wrong for the third time and locking his account.

Take results with a pinch of salt

The group ran a simulation exercise with the authorities ... The three-day simulated cyber-disaster involved one hospital in the city being infected by destructive malware that crippled essential services, followed by other digital assaults on hospitals across the city on the second day, and then a physical attack similar to the 2013 Boston marathon bombing on day three.

From the article, no systems were actually infected and the sequence of events was obviously chosen to create a worse case scenario. I see a security expert spreading FUD and trying to drum up custom.

Not to say that hospitals and medical equipment don't need better security etc., only not sure what the real benefit of running the simulation - wonder what the lessons learnt are, that a hospital could be put immediately into practice.

It's not a slight risk times one

Suppose for sake of argument that the probability of severe consequences is 1 in 100 and 'merely' disruptive 1 in 10. Now attack 100 hospitals. Oh my giddy aunt!

We have to realise that this isn't the same as an isolated event such as say a fire or lunatic with a grudge and a few bullets or passwords, but a many thousands of targets campaign. It's the environment that's deadly not just a couple of bits of kit.

All plausible

however, although the devices themselves may not be able to be secured, it can be made harder by putting them on a private network, and using MAC authentication etc. This will reduce exposure to many network based threats. Every enterprise has a few devices (vendors like to call them appliances) like this.

As for attacks being made locally - this can never really be mitigated technically - equipment has to be out all the time therefore staff eyes are the best defence here until new designs are approved. In my experience devices are more likely to be stolen than hacked anyway...

Entangled

Some emergency services of hospitals need coordinated efforts at full capacity and full attention from a number of different sources now. If one computer-dependent service is crippled, that will easily influence negatively throughout the system. No med tech equipment needs to be affected: decreased availability of patient history or lab results is enough to cause delays and increase risks.

Who in their right mind has internet/computer controlled and connected refrigerators? The rest makes sense but that's just a bit far fetched.

Seems you can't win.

If you don't do anything, hospitals get pwned, people die, and survivors sue.

If you try to rush things, Murphy strikes, people die, and survivors sue.

And we can't expect fallible, even diabolical humans to get it right the first time, either.

Not just the UK, I was in a rather nasty vehicle accident just over a year back in a not so foriegn hospital, and I ended up in a burns unit in a isolated room with its own aircon etc for two months while bits grew new covering skin and I was attended to by aliens with just their eyes visible, and while I was in there, I saw a few things that made my hair curl a bit. First the machine that went ping that hooked onto me, was networked back to a central nurses station so if anyone popped off, they could rush in to their rescue which was awkward as I kept pulling the ping sensors off when asleep. This connected to a in room display with a rubber keyboard (so it could be disinfected daily) in the room itself also for staff to enter extra data taken or food/drugs administered during regular observations in room into some central database of stuff done to each person. I was given the printouts from my records on discharge, it was pretty impressive to read.

I was quite surprised to see a nurse able to pop onto their facebook account using the obs entry computer one night, especially as the machine was unpatched XP, and the machine that went ping ran windows 98...

Also I was permitted a tablet and a smartphone after I agreed to use brand new devices and that they could be passed through decontamination protocols. I was not allowed to use wifi under any circumstances as use of it would disrupt their local equipment signalling network but 4g was ok. I bluetooth shared my tablet to the phone after some rooting activity to get out and get some sanity saving connectivity. On one occasional I accidentally switched the wifi on for a few seconds, and it managed to find a open ap and sign onto it before I pulled it down as quick as I could.

Towards the end of my stay I was able to get up out of bed and they brought in people to do various bits and bobs and maintenance to the system to make sure the room was ready for the next unlucky occupant, and one such repair involved someone reflashing the first alert button systems, which turned out to be a single board computer with a ethernet connection behind a lcd panel in the wall connected to the big red button. Chatting to the engineer like y'do, they had reflashed it externally to try and resolve the false alerts before deciding the issue was hardware in the room related, he showmed me how to make it cycle the lcd display to show ip info and version and stuff from button combo's on the panel itself, great, really interesting, no credentials required. And a very recognizable network topology too :-)

Given the machine that went ping had outbound connectivity, I wouldnt mind betting that system had it too and not just to the mothership for reflash purposes. All gluing the infrastructure with that central database of very very personal information at its core...

If your curious, I'm all growed back now, but I have some cool leg, torso and arm scars that I tell children at the swimming pool was from when I was attacked by a man eating great white shark as I poked its eyes out to escape :D

At the end of the day, I was there to be helped, there's no way I would take my curiosity further or try to make any of the excellent staff's jobs harder, and indeed there's no way I'd risk the legal repercussions of taking any of my concerns further without a contract covering engagement to do so.

I think that there's a real dearth of people with the security & testing mindset not being allowed into the operational areas because of a fear of what they might find in what is a already overstretched and underbudgeted area without the resources to address fixes, and that is leaving vectors open that could be shut for smaller expenses without making anyones job more difficult because with patients they already have enough grief to start with. And I have no idea how that network is seperated out, but if its arch'd the way it appeared to be from 3rd party observations, someone with security architectural experience needs involving too.

So I read things like this from derby con and nod my head, life's rich tapestry has yielded a similar experience...

Posting anon, but some people will know me from the above alone.

"With elevators and HVAC systems out, and no refrigeration for medicines, patients had to be shuttled to other medical facilities and some were not making it there alive."

Because we could never do elevators/HVAC/refridgeration without computers?

Honestly, if an attacker can completely take out your elevators/fridges/HVAC, you have a LOT of other problems, and I would question if this "study" goes far enough. What if the attackers instead simply take out the electricity grid and the hospital back-up generators/power sources? The problem here isn't "poor IT security", it's a complete lack of ANY form of effective "business continuity plan" and disaster response planning.

If a hospital can cope with a complete loss of all electricity, it can cope with anything the hackers can throw at it by simply switching everything off. If it can't? The rest is simply details.

Just dont use Windows.

Use Linux, or FreeBSD. Strip down the image to the bare arse of what you need - no surplus crap floating in the install.

Put all cleint applications in a web browser.

Poof! 98% of problem go away, leaving you to spend time looking at the more serious hacking etc.

simple hacking

"All of these deaths, in the simulation, were caused by simple hacking"

Something which apparently takes out things which aren't network connected such as refrigitation and HVAC(*) systems is far from 'simple hacking', as it would have had to take out the electrical and water supplies.

(* Although generally digitally controlled, such systems are rarely ever network connected)

This is really a worse situation

Than you could imagine.

Before IoT hospital care and the machines involved needed a common language, so one was devised (by commitee*) that allowed each machine to talk to another. This language is coded to the point that it would take a person at least a week to be able to read off the codes as if it were plain text.

At least one hospital (one that I know of) uses Perl script to do all of the tasks (nothing wrong with that, right?) because Perl is a get it done language.

All or most of the equipment suppliers are hard codeing in the common language into the various machines, really, I think that the only reason this disaster waiting to happen has not happened is that most hackers would not deam it much of a challenge.

* not naming common language, two letters and a number.

Triage, Defined

The article (or perhaps the doctors, it isn't entirely clear) is confused about the meaning of "triage". The original (Napoleonic War-era) definition divided combat casualties into three categories. The first group was expected to die, no matter what treatment was provided. The second group would probably survive, if treated immediately. The third, less severely injured, group would survive with minimal, perhaps "first aid"-level treatment.

The first group would get palliative, comfort care to make their deaths as easy as possible. It is the SECOND group that got the doctors' attentions, because they were the ones who could PROBABLY be saved.

Watch the video, people

Then babble your armchair expertise.