Malicious hackers are getting a lot more sophisticated and cleverly using older malware on medical devices to infiltrate health-care systems, according to a report by the security research company TrapX Security.

TrapX is a security firm that offers health-care systems solutions to monitor and detect cybersecurity threats, including decoys in health-care networks that are intended to catch unforeseen malware attempting to steal patient records.

In a follow-up to a 2015 report, MEDIJACK 1, where TrapX warned about medical devices being used as pivot points to attack hospital systems, the company says they have found numerous cases where hackers are using loopholes in newer operating systems to break into computers still running older and more vulnerable operating systems such as Windows XP. The findings are disclosed in an updated MEDIJACK 2 report.

"Once the attackers were inside the network, many medical devices became easy targets in which they could launch their campaign," the report states.

While the hackers pose severe safety risks, at this point they are using the hacks to gain access to patient health records to initiate a ransomware attack or steal the data to be sold on the black market.

Something Old, Something New

"A unique finding during the investigation was that the attack utilized an old malware variant, such as a variant of the MS08-067 worm, [for] which the signatures were well known," states the report. "Windows 7 and later versions had eliminated the vulnerabilities that this worm sought to exploit, so that it appeared to be of no concern – even if it was detected by other security solutions since the vast majority of workstations would not be vulnerable. The malware utilized for this attack was specifically selected to exploit older versions of Windows, and given the general endpoints were using newer Windows versions, they would not be affected by the threat."

The report states during such attacks workstations with newer versions of Windows ignored the attacks, which meant endpoint security programs failed to kick in to protect the computer. After infecting the computers without notice, the worms could go on to try find other computers in the system that used older versions of Windows that are no longer supported by Microsoft and gives hackers access to patient records.

"Once the attackers were inside the network, many medical devices became easy targets in which they could launch their campaign," adds the report. "Based upon the forensics from these case studies and others, we conclude that MEDJACK.2 attackers are intentionally moving to old variants of attack vectors to specifically target medical devices, knowing they have no additional security protections."

While security researchers in the past have raised concerns, for instance, that attacks could be used to target individual patients and potentially put their lives at risk, TrapX says, for now, hackers are primarily targeting the data stored in the health-care networks.

They also highlight a recent report from IBM Security that suggests in 2015 there was a dramatic shift hacking targets. While the financial sector had long been a primary target, the health-care industry became a bigger target by 2016, primarily because it has become harder to break into the financial industry.

"The drivers for this include both the economic rewards and the relative difficulty (or ease) with which an attacker can successfully exploit a targeted enterprise," said TrapX. "There is substantial economic gain to be enjoyed by the theft of medical records, which have among the highest value on the black market, ranging from $10 to $20 per patient record.

"As we have discovered, medical devices are not well defended by standard cyber-defense practices. Standard cyber-defense solutions cannot defend nor remediate these devices," the report added.

TrapX warns that while health-care systems and medical device companies are starting to wise up to the threat of malicious hacking, there is still a significant lack of funding and other resources to tackle the threats.

"The onslaught of medical-device hijack attacks is accelerating, and it's becoming increasingly more challenging for hospitals to detect and prevent them," said Moshe Ben Simon, TrapX co-founder and vice president.

"To mitigate these attacks going forward, TrapX recommends that hospital staff review budgets and cyber-defense initiatives at the organizational board level and consider bringing in technologies that can identify attacks within their networks, not just at the perimeter," he added. "In addition, health-care organizations need to implement strategies that review and remediate existing medical devices, better manage medical device end-of-life and carefully limit access to medical devices. It becomes essential to leverage technology and processes that can detect threats from within hospital networks."

Devices As Entry Points

Rick Popko, a TrapX spokesman, said the security company realized in 2014 that health-care systems were being specifically targeted by malicious hackers by using medical devices as entry-points. One of the biggest advantages of using the devices is that even after a hospital is able to remove the malicious software from their system, another infected device that comes into contact with the hospital network can re-infect the system, and the cycle begins anew.

"Most medical devices have older operating systems which are less resilient to modern cyber attacker threats, making them fertile ground for an attacker," he said. "Further, both hospitals and device manufacturers are prohibited by law to sanction the installation of third party cyber-security software on FDA-certified devices.

"Consequently, these devices are relatively unprotected and unscanned by the rest of the hospital’s cyber defense," he added. "Even when a back door is detected within one of these devices, it can take a week or two to install a replacement system, or to find the window in the department to take the medical device out of production."

While FDA has been criticized by some security experts for not stepping in sooner to build a new cybersecurity framework for medical devices, Popko says FDA has been trying to give health-care providers more flexibility to deal with the issue on their own. However, he notes that providers are often not the best equipped to handle threats from malicious hackers. (See [A#01160425004].)

"Also, while the FDA has tried to guide the manufacturers to incorporate best security practices, they have often been slow to react," he added. "In order to contain these sophisticated threats, hospitals and other health-care institutions need to work very closely with the medical device manufacturers to take more informed initiatives addressing the current cyber threat. This really isn’t happening today."

Popko says while it's easy to blame government agencies for not doing more, he notes no one could have imagined how fast current cyber-threats have evolved.

*Follow Ferdous Al-Faruque @alfaruque

Device Hacks Becoming More Sophisticated, Targeted, Security Firm Warns

More from Regulation

More from Policy & Regulation