Despite the FDA’s move to make infusion pumps safer—and actions taken to secure pumps, such as the B. Braun Infusomat Space Large Volume Pump, at the software level—cybersecurity experts at McAfee Enterprise have found ways to exploit these devices.
“We pulled on every thread we could and ultimately we found the worst-case scenario,” says Steve Povolny, head of McAfee’s Advanced Threat Research group. “As an attacker, you should not be able to move back and forth from the SpaceStation to the actual pump operating system, so breaking that security boundary and getting access to be able to interact between those two—it’s a real problem. We showed that we could double the rate of flow.”
The researchers found that an attacker with access to a healthcare facility’s network could take control of a SpaceStation by exploiting a common connectivity vulnerability. From there they could exploit four other flaws in sequence to send the medication-doubling command. The full attack isn’t simple to carry out in practice and requires that first foothold in a medical facility’s network.
“Successful exploitation of these vulnerabilities could allow a sophisticated attacker to compromise the security of the Space or compactplus communication devices,” B. Braun wrote in a security alert to customers, “allowing an attacker to escalate privileges, view sensitive information, upload arbitrary files, and perform remote code execution.” The company further acknowledged that a hacker could change the connected infusion pump’s configuration, and with it the rate of infusions.
Read the full article on Wired.
