McAfee Enterprise’s Advanced Threat Research Team has unveiled a new study about vulnerabilities they found with pumps created by German healthcare giant B. Braun.
The report chronicles the problems with B. Braun’s Infusomat Space Large Volume Pump and the SpaceStation, both of which are built to be used in adult and pediatric medical facilities. Infusion pumps are designed to help nurses and doctors skip time-consuming manual infusions and have gained prominence in recent years as many hospitals digitize their systems.
According to the study, attackers could take advantage of the vulnerabilities to change how a pump is configured in standby mode, allowing altered doses of medication to be delivered to patients without any checks.
The OS of the pump does not check where the commands it gets are from or who is sending data to it, giving cyberattackers space to attack remotely. The use of unauthenticated and unencrypted protocols also gives attackers multiple avenues to gain access to the pump’s internal systems that regulate how much of each drug needs to go to a patient.
“Malicious actors could leverage multiple 0-day vulnerabilities to threaten multiple critical attack scenarios, which can dramatically increase the rate of medication being dispensed to patients. Medical facilities should actively monitor these threats with special attention, until a comprehensive suite of patches is produced and effectively adopted by B. Braun customers,* McAfee’s Advanced Threat Research Team said in the study.
“Through ongoing dialogue with B. Braun, McAfee Enterprise ATR disclosed the vulnerability and have learned that the latest version of the pump removes the initial network vector of the attack chain.”
Douglas McKee, Steve Povolny and Philippe Laulheret — members of McAfee’s Advanced Threat Research Team — explain in the report that the changes to the amount of medication given to a patient would look like a simple device malfunction and would “be noticed only after a substantial amount of drug has been dispensed to a patient, since the infusion pump displays exactly what was prescribed, all while dispensing potentially lethal doses of medication.”
McAfee noted that there are more than 200 million IV infusions administered globally each year using pumps like the ones supplied by B. Braun. The company is one of the leaders in an IV pump market that brought in $13.5 billion in 2020 in the US.
Shaun Nordeck, a doctor working at a Level 1 Trauma Center, contributed to the study and said the ability to remotely manipulate medical equipment undetected, with potential for patient harm, is effectively weaponizing these point of care devices.
“This is a scenario previously only plausible in Hollywood, yet now confirmed to be a real attack vector on a critical piece of equipment we use daily,” Nordeck said of the study. “The ransomware attacks that have targeted our industry rely on vulnerabilities just like these; and is exactly why this research is critical to understanding and thwarting attacks proactively.”
McAfee informed B. Braun of the vulnerabilities in January and the company has since updated the pumps to solve the problem. But the emergence of the issue opens up an entirely new slate of attacks that could be leveraged if other network-based vulnerabilities are found. The report notes that even though B. Braun has fixed the problems, many hospitals are still running the vulnerable tools and software.
“The medical industry has lagged severely behind others in the realm of security for many years — it’s time throw away the digital ‘band-aids’ of slow and reactive patching, and embrace a holistic ‘cure’ through a security-first mindset from the early stages of development, combined with a rapid and effective patch solution,” McKee, Povolny and Laulheret said.
McAfee ended up discovering five separate, new vulnerabilities related to the pumps — CVE-2021-33886, CVE-2021-33885, CVE-2021-33882, CVE-2021-33883 and CVE-2021-33884 — which cover B. Braun’s Infusomat Large Volume Pump Model 871305U, a SpaceStation Model 8713142U docking station that holds up to 4 pumps and a software component called SpaceCom version 012U000050, all of which were released in 2017.
“When looking at how the pump and its communication module handles communication and file handling, we observed that critical files are not signed (CVE-2021-33885), most of the data exchanges are done in plain-text (CVE-2021-33883), and there is an overall lack of authentication (CVE-2021-33882) for the proprietary protocols being used,” the report said.
Security researchers have previously discovered cybersecurity vulnerabilities with infusion pumps from multiple companies besides B. Braun like Medtronic, Hospira Symbiq and others. But recently the German government released a study on infusion pumps, including those from B. Braun, as part of a larger examination of medical device cybersecurity.
“SpaceCom is an embedded Linux system that can run either on the pump from within its smart-battery pack or from inside the SpaceStation. However, when the pump is plugged into the SpaceStation, the pump’s SpaceCom gets disabled,” the study found.
“SpaceCom acts as the external communication module for the system and is separated from the pump’s internal operations, regardless of where it is running from. An important function of SpaceCom is to be able to update the drug library and pump configuration stored on the pump. The drug library contains information such as ward and department, a list of pre-configured drugs with their default concentrations, information messages to be printed on the screen when selected, and more importantly, soft, and hard limits to prevent medication error.”
Part of why infusion pumps are so widely used now is because they help nurses regulate doses of drugs automatically, with some systems deploying databases with more than 1500 key/value pairs.
One difficulty that cyberattackers may face is that the pump’s RTOS is not network connected but would need to be accessed to make any changes.
“Although this attack chain presents a complete method to modify critical pump data, it is important to recognize the conditions required for this attack to be successful. These pumps are designed to be network connected to a local internal network,” the researchers explained.
“Therefore, under normal operating conditions an attacker would need to have found a method to gain access to the local network. Could this attack take place over the internet? Technically speaking, yes; however, it would be very unlikely to see a setup where a pump is directly internet-connected.”
There are also other measures taken by B. Braun to protect the device, including a feature that makes it so the pump ignores requests while already delivering medication, meaning the attack can only be leveraged when the pump is idle or in standby mode in between infusions. Nurses are also instructed to check the dosage and medication levels before setting anything, and regulations in multiple countries explain in detail how the device is supposed to be managed by nurses.
But gaining access to local networks is not as difficult as it once was and McAfee noted that the “prerequisites for this attack are minimal and are not enough to mitigate the overall threat.” Once a local network is accessed, cybercriminals could take a number of steps to make their work easier, including clearing the current trusted server configuration and rewriting it to an attacker-controlled server.
Attackers can even reboot the entire operation to make sure none of their changes are noticed by hospital staff.
Nordeck, who has spent more than 20 years as a doctor in private settings and in the US Army, said ICU’s are high-pressure environments where there is an increased risk for infusion errors since these critical and often medically complex patients have multiple infusions which are being adjusted frequently.
“Errors, however, are not limited to the ICU and may just as easily occur in the inpatient ward or outpatient settings,” Nordeck said. “Essentially with each increase in variable (patient complexity or acuity, number of medications, rate changes, nurse to patient ratio, etc.) there is an increased risk for error.”
Nordeck added that “something as routine as correcting a person’s high blood sugar or sodium level too quickly can cause the brain to swell or damage the nerves which can lead to permanent disability or even death.”
While the researchers noted that ransomware attacks are far more likely right now, it was important for healthcare institutions to harden themselves against the kinds of emerging attacks that continue to pop up from time to time.
“Device manufacturers clearly aim to produce safe and secure products as evidenced by built-in safeguards. However, flaws may exist which allow the device to succumb to a ransom attack or potentially cause harm,” Nordeck added.
“Therefore, manufacturers should collaborate with security professionals to independently test their products to detect and correct potential threats and thereby preserve patient safety and device security.”
