Pierluigi Paganini
May 30, 2016
Many security experts believe that medical industry lack of a proper security posture, despite it is a high-tech sector the vast majority of medical equipment was not designed with a security by design approach. Another element to consider is that the healthcare industry is becoming a privileged target for cyber criminals, we are assisting to an escalation of the incidents that are involving medical infrastructure.
Now the US Computer Emergency Response Team (US-CERT) has issued a warning after the discovery of a major issue (CVE-2016-4328) in one of the most popular medical application, the MEDHOST.
The medical application is used for acquiring patient data and experts discovered hardcoded admin credential in its code.
“MEDHOST PIMS, previously branded as VPIMS, contains hard-coded credentials that are used for customer database access. An attacker with knowledge of the hard-coded credentials and the ability to communicate directly with the application database server may be able to obtain or modify sensitive patient information.” reads the alert issued by the US-CERT.
The MEDHOST application is a widely adopted application used in the health care industry to manage patient data in the perioperative three stages of surgery.
It allows tracking patients and related conditions in the surgical process that allows remote management, it has been estimated that more than 1,000 health care facilities use several solutions designed by the same vendor.
Once the attacker gets the hardcoded admin credential, he could access any data present in the MEDHOST application, and he could do it if the remote login is not properly monitored.
In order to mitigate the security problem, the US-CERT suggests to apply the upgrade issued by the vendor and in any case restrict network access.
“As a general good security practice, only allow connections from trusted hosts and networks. Restricting access would prevent an attacker from using the hard-coded credentials from a blocked network location.” continues the US-CERT
In the specific case the patch management process worked very efficiently, the vendor issued the patch for the MEDHOST PIMS just a month after the disclosure of the vulnerability that occurred in March.
https://www.surveymonkey.com/r/secbloggerwards2016
Thank you
Pierluigi
[adrotate banner=”9″]
(Security Affairs – MEDHOST, hacking)
