Hospitals across the nation are banking on the use of wireless and wearable medical device technologies to improve patient care and reduce the possibility of human error. According to Threatpost, however, vulnerabilities within these devices could render them susceptible to attacks and put patients at risk. One drug pump in particular is so vulnerable that security researcher Jeremy Richards said it’s the least secure IP-enabled device he’s ever come across.

Safety First?

Richards claimed that the Hospira PCA3 Drug Infusion pump is so riddled with problems that hospitals should “never hook it up to a human being.” The first big issue? It’s possible to brick the device with a single typo, rendering it completely useless. What’s more, the pumps in question come with a default IP address of 192.168.0.100, a familiar number that could easily be leveraged by malicious actors to grab wireless encryption keys from the medical device, which are stored in plaintext. It gets worse: Using an embedded Ethernet port on the pump, attackers with physical access could gain not only complete control over the device in question, but any other Hospira pumps on the hospital’s wireless network, as well.

According to Wired, researcher Billy Rios found that these pumps don’t require authentication for their drug libraries, meaning anyone with access to the hospital’s network could potentially load up a new drug library and change the dosage being administered. Although this can’t happen on the fly, hackers could alter the upper or lower dosage limit, in turn opening the door for “mistakes” to give patients massive doses or minuscule amounts, both of which could be fatal. Reports of these vulnerabilities have been passed on to Hospira, but so far the company has been quiet on any potential fix.

Back to Basics

While Hospira pumps are currently taking heat for failing basic security tests, they’re just the tip of the iceberg. As noted by InformationWeek, more than 2.5 million implantable medical devices are currently in use, and that number is expected to grow almost 8 percent this year. But the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) found that 300 such devices have unchangeable passwords, meaning if malicious actors ever obtained a complete list, there would be no way to prevent misuse short of tossing the device in the garbage. And last year, Reuters reported that the Department of Homeland Security (DHS) was investigating two dozen cases of possible medical device compromise and “working with manufacturers to identify and repair software coding bugs and other vulnerabilities.”

Despite the potentially lethal impact of compromised medical devices, manufacturers lag behind when it comes to IT security. Passwords are weak or unchangeable, encryption is often nonexistent and hacking one device could grant access to a host of others. With the medical device market set to skyrocket as Internet of Things networks become commonplace, companies need to go back to the drawing board and solve this problem. “Do No Harm” now starts with the device.