Para brindar el contenido más relevante a los lectores de HealthCare Business News, le pedimos que comparta un poco de información sobre quién es usted (tarda dos segundos y listo).
Registro
What you need to know about the latest Philips, Silex and GE hack vulnerabilities
The U.S. Department of Homeland Security ICS-CERT has issued cyber vulnerability advisories for the Philips Brilliance CT system, and the Silex Technology SX-500/SD-320AN and GE Healthcare MobileLink.
Many of the weak spots are familiar, involving relatively low-level skills that could let a hacker change his or her privileges to an elevated user level, enabling access to other parts of the system – even possibly gaining entry to the larger network using hard-coded credentials for authentication.
Philips had been working on the issue, which it said in its statement involved the following systems:
• Brilliance 64 version 2.6.2 and below
• Brilliance iCT versions 4.1.6 and below
• Brillance iCT SP versions 3.2.4 and below
• Brilliance CT Big Bore 2.3.5 and below.
Philips confirmed the flaw, advising that the vulnerability is not exploitable remotely, noting that “an attacker would need local access to the kiosk environment of the medical device to be able to implement the exploit.”
So far, there are no reports of a hack using this vulnerability in the real world.
It has also fixed the hardcoded credentials vulnerabilities “for all Brilliance iCT 4.x and above versions,” it stated.
Going forward, the company advises that users set products up “within specifications,” especially software and security settings.
It also suggested more broadly that sites “implement a comprehensive, multilayered strategy to protect their systems from internal and external security threats, including restricting physical access of the scanner to only authorized personnel.”
The second Homeland advisory concerned the Silex Technology SX-500/SD-320AN and GE Healthcare MobileLink.
Again, hacking skill level required is low, but in this case the hack can be done remotely.
One flaw would let unauthorized hackers change system settings, due to a problem of verification in the software. Another flaw is the way memory is “cleaned” that could permit code to be planted by a hacker and then executed.
After researcher Eric Evenchick of Atredis Partners brought these problems to the attention of the companies, the vulnerabilities were fixed, he reported to Homeland.
Updates are available with these fixes and Silex Technologies and GE Healthcare recommend the following steps be taken by their users:
-CVE-2018-6020 (GE MobileLink/SX-500) – Enable the “update” account within the web interface, which is not enabled by default. Set the secondary password for the “update” account to prevent unauthenticated changes to the device configuration.
