Claroty Questions CISA and US FDA’s Suggestion of Backdoor Transmitting via Patient Monitors

0

The CISA and US Food and Drug Administration have released two security alerts suggesting that the Contec CMS8000 patient monitor and variants, which are manufactured in China and used in healthcare settings to monitor human vital signs, contain a backdoor communicating to a Chinese IP address.

The alert states explicitly that this backdoor is a “hidden functionality”, pointing to a hardcoded-IP address in China for the outbound communication of patient data and firmware updates.

Researchers at cybersecurity firm Claroty have since investigated the vulnerability and reached the conclusion that it is most likely not a hidden backdoor, but instead an insecure/vulnerable design that introduces significant cyber risk to the patient monitor users and hospital networks.

Specifically, the vulnerabilities could allow patient monitors to be remotely controlled by an unauthorised user, and also lead to the exfiltration of sensitive patient data.

Clatoty’s conclusion is mainly based on the fact that the vendor, and resellers who re-label and sell the monitor, list the IP address in their manuals and instruct users to configure the Central Management System (CMS) with this IP address within their internal networks. In addition, the upgrade flow requires a physical button press during the patient monitor boot process.

The hardcoded IPs found in the device are 202.114.4.119 (CMS server) over TCP ports 515-520, 202.114.4.120 (HL7 server) over TCP port 511.

Claroty says that absent additional threat intelligence, the absence of any hidden functionality is important because it demonstrates a lack of malicious intent, and therefore changes the prioritisation of remediation activities. Said differently, this is not likely to be a campaign to harvest patient data and more likely to be an inadvertent exposure that could be leveraged to collect information or perform insecure firmware updates.

Regardless, because an exposure exists that is likely leaking PHI randomly or could be used in some scenarios for malicious updates, the exposure should be remediated as a priority.

Remediation recommendations include:

  • It is heavily recommended that organisations with this patient monitor block all access to the subnet 202.114.4.0/24 from their internal network, blocking devices from attempting to upgrade their firmware from a WAN server or send PII in the future.
  • Claroty has seen some OEM examples of the CONTEC CMS8000 where the default network configuration for the CMS can be modified. If this is possible, do not leverage the default 202.114.4.119 IP address for your CMS.
  • If you do need to leverage a CMS for monitoring and providing updates to the CONTEC CMS8000 patient monitors or its white label variants and must use the 202.114.4.119 hard-coded IP address, we recommend applying static routes and/or network segmentation to ensure that this traffic is routed only to your CMS and not externally.
  • If not using the HL7 capabilities of the patient monitor, it is recommended blocking all network traffic outbound to 202.114.4.120 to prevent potential PII/PHI leakage.
  • These patient monitors are still running vulnerable code that will always be attempting to connect to an externally routable IP address, so it is recommended to replace them with a more secure device unless the vendor modifies firmware to prevent this action in the future.
Share.