Patient Monitors And Insulin Pumps Are Prime For Hacking

It’s no secret that hackers have successfully held healthcare institutions for ransom – literally. Healthcare is a hacking favorite for a very disturbing reason. Lives may literally be at stake when entire data systems are frozen, and hackers know that. Events like hijacking healthcare using the hacker favorite, ransomware, is a pretty sure bet the ransom will be paid. Even worse, hackers can access patient devices and wreak havoc with their functioning. Anything connected to the IoT (Internet of Things) is up for grabs by hackers, including life saving devices like IV transfusion pumps and newly discovered patient monitors and insulin pumps. Device vulnerabilities most recently found are two Medtronic devices: MyCareLink Patient Monitors and the MiniMed 508 Insulin Pump.

For the second time in six weeks, the ICS-CERT (Industrial Control Systems Cyber Emergency Response Team) released an advisory warning about the two Medtronic devices. All versions of these devices are at risk for hacking, thanks to weaknesses in data authenticity verification and poor password storage. Researchers at Whitescope LLC discovered the vulnerabilities and alerted the National Cybersecurity and Communications Integration. That finding was ultimately made public by the ICS-CERT, with both Medtronic devices issued with a “medium severity” warning.

There’s no shortage of hacking success on healthcare as a whole, and more specifically on medical devices used at hospitals and by patients at home. Earlier this year, a Spirent Security Labs researcher found that for a $7 part, communication with IV pumps was achieved, allowing access and configuration to the device connection point. In other words, a hacker can change the settings on the IV pumps. While healthcare providers need data communication to program devices, these communication links also provide opportunities for those with other motives. Even smart pens that doctors use to send prescriptions to pharmacies were found to expose PII (Personally Identifiable Information) of patients. That information can be used to steal identities and other fraudulent nightmares.

Medtronic responded to the findings by promising to issue a correction to the problems in the near future. Overall, the devices in question are not vulnerable in their default configuration. It’s when hackers find a way to exploit other weaknesses that problems happen. Medtronic suggests device users disable the option to increase dosage and/or pay close attention to device alerts and turn off the option when not in use. In addition, if the manufacturer lets you know you need to update the devices or the software at any time, do it right away. The lesson learned for all involved is when communication between devices and their settings are at risk, so are the patients using them.