Ripple20 Threatens Increasingly Connected Medical Devices

Earlier this month, JSOF security researchers disclosed the "Ripple20" vulnerabilities, a series of flaws affecting connected devices in the enterprise, industrial, and healthcare industries. Experts worry about the implications for connected medical devices, which could provide attackers with a gateway into a hospital network or enable them to affect patient care.

Ripple20 exists in a low-level TCP/IP software library built by software company Treck. Many IoT device manufacturers build the library directly into their devices or integrate it through embedded third-party components. As a result, organizations may not know they're exposed.

These vulnerabilities range in severity from small bugs with subtle effects to major flaws that could enable denial of service or information disclosure. Two of them could lead to remote code execution and allow a successful attacker to assume control over a target device. While an attacker would need to be on the network to exploit most of the Ripple20 vulnerabilities, this usually isn't difficult because many connected devices are often connected to the Internet by mistake.

Healthcare is "particularly susceptible" to Ripple20, report researchers with CyberMDX who aided JSOF in the investigation by helping to profile devices and identify exposure. Among the devices confirmed vulnerable are Baxter infusion pumps in the Sigma series, some B. Braun infusion pumps, a variety of Carestream products, some Schneider/APC UPS devices; some Digi network tools, some HP printers, and some Ricoh printers, all of which may put hospitals at risk.

"Inside hospitals we saw all kinds of affected devices," says Elad Luz, head of research with CyberMDX. Nonmedical devices such as network switches and printers, while not directly connected to patient health, are still critical to the workflow of providing medical care. 

"The Ripple20 vulnerabilities potential for manipulating the software of the device they run on," Luz explains. Most hospitals have "a fleet" of connected infusion pumps, for example, all of which have a user interface that lets care providers configure when functionality starts and stops. In a worst-case scenario, an attacker could interfere with the pump's capabilities and interrupt patient care; however, Luz points out that most attacks aren't meant to cause physical harm.

People who target medical devices, like most cybercriminals, are usually motivated by money. It's more likely they're planning to launch a ransomware attack or find medical records to sell on the black market. There, health data can fetch a higher price than credit card numbers because it can't be changed, Luz continues. Attackers may also seek to cause market manipulation by targeting a major healthcare organization with a cyberattack, he adds.

Vulnerabilities Plague Medical Devices
The security of connected medical devices is a growing concern as more of these products go online. Healthcare providers are driven by a need to treat a growing patient population, provide more telemedicine, and attempt to stem rising healthcare costs. Technology can help them do this; however, the integration of connected devices may also put patients and data at risk. 

"The reality we face is that medical devices can be in a hospital setting for 15 to 20 years, but new cybersecurity threats are emerging daily," said Rob Suárez, CISO at medical technology firm Becton, Dickinson and Company, in a panel held today on secured connected health. As cyberattacks continue to increase, many hospitals still lack a dedicated security expert, he said.

Medical devices are especially vulnerable compared with other IoT devices, PCs, and smartphones, Luz explains. Most of the connected medical products his team sees have a cybersecurity standard from 10 to 20 years ago, and they typically have different kinds of vulnerabilities. Many of these are design flaws, he adds. Medical devices may have poor means of authentication, connections for receiving telemetry, or managing and configuring the device.

The Ripple20 flaws are coding bugs and point to a problem in the software supply chain. In many cases, both inside and outside the healthcare field, companies receive a piece of software but don't know much about it. "If you don't know what the product is built out of, when those components end up having vulnerabilities, you don't know where to look," Suárez said.

What Hospitals Can Do
Treck released a new version of its software library (6.0.1.67) to address the Ripple20 flaws; however, the company can't update devices directly. The company offers vendors a development kit for when they package network stacks for their products. Until they use it to develop product firmware updates, the devices cannot be updated. 

"For hospitals, the challenging part is finding those affected devices," says Luz. If you're responsible for security at a hospital with 10,000 connected products of different models and vendors, locating the vulnerable ones will be difficult. 

Some medical devices require in-person updates, meaning the hospital would need a contract with the vendor to bring someone on-site to apply updates. This could prove tricky, he notes, as medical devices are critical and may not be available for updates at any time. Some vendors have a connection to the hospital and can automatically update affected machines remotely. Some may require a user to install an update. 

Related Content:

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really bad day" in cybersecurity. Click for more information and to register for this On-Demand event.