News Backdoor uncovered in China-made patient monitors — Contec CMS8000 raises questions about healthcare device security

[Admin]

The CISA and FDA have released security warnings about the Contec CMS8000, which is used for patient monitoring.

Backdoor uncovered in China-made patient monitors — Contec CMS8000 raises questions about healthcare device security : Read more

 

[Dr3ams]

I think any computer hardware, no matter where it's made, has the potential for "backdoors". Most governments wouldn't be able to resist the temptation. For consumers, there is no way of getting around it.

 

[KennyRedSocks]

"it doesn't mention the university, the IP address, or the country it is sending data to"

It doesn't sound like they're too sure of their findings.

 

[JTWrenn]

"it doesn't mention the university, the IP address, or the country it is sending data to"

It doesn't sound like they're too sure of their findings.

That selective quotation really makes you look like you have an agenda here. Here is the part you cut out with that quoting
"The agency mentions the IP address is not associated with any medical device manufacturer. Still, it is a third-party university, though it doesn't mention the university, the IP address, or the country it is sending data to. The CISA also ruled out this coding was meant to be an alternative update system as it does not contain standard update procedures such as tracking updated versions or doing integrity checks. Instead, it has the remote file shared and transmitted to the IP address."

They know what it is but have not shared it. Stop it.

 

[ezst036]

Of course they found a back door. They'll find others.

We live in an age where information is more valuable than money and China knows they need to have all the information.

 

[mitch074]

Of course they found a back door. They'll find others.

We live in an age where information is more valuable than money and China knows they need to have all the information.

The fact that it's using a fixed IP address to a university smells like 2 possibilities :
1- early debug/qualification code that wasn't removed at the end of the qualification program (any code modification requires validation when it's for medical devices - that enables deactivating such remote access)
2- cheap way for a university to get samples data.
If it were a real back door, it would have been obfuscated, and if it were for a state agency, it would not point to a public facility.
Also, this kind of 'attack' is easy to circumvent : block non-approved IP addresses in outbound traffic.

 

[USAFRet]

Also, this kind of 'attack' is easy to circumvent : block non-approved IP addresses in outbound traffic.

For reliable devices, that should net be needed.
Whatever the reason, why is it there?

Just like with inexpensive security camera things...a hardcoded admin pwd, that you, the buyer, has no influence over.
Left there by clueless/incompetent devs, or on purpose to extract data.

 

[P.Amini]

What China is doing is really pathetic..

 

[King_V]

What China is doing is really pathetic..

It's only pathetic if it doesn't work. Otherwise, it's a bargain way to get data that would otherwise be far more expensive to acquire.

 

[Vanderlindemedia]

I think any computer hardware, no matter where it's made, has the potential for "backdoors". Most governments wouldn't be able to resist the temptation. For consumers, there is no way of getting around it.

Yep but this actually, contains a backdoor. Sending private or confidential information, such as name of the doctor, the patient and all that, to a unknown source.

Company's need to double packet sniff check all the outgoing data from such places.

 

[NinoPino]

What China is doing is really pathetic..

Also if the IP is that of a USA University ?

 

[NinoPino]

For reliable devices, that should net be needed.

Here I do not agree, network filtering should be done for any device.
In the case of a medical monitoring tool, "reliable" does not imply "IT secure".

Whatever the reason, why is it there?

@mitch074 give some plausible examples.

Just like with inexpensive security camera things...a hardcoded admin pwd, that you, the buyer, has no influence over.
Left there by clueless/incompetent devs, or on purpose to extract data.

Agree.

 

[adamXpeter]

What China is doing is really pathetic..

Nah, CISA just catched the US Uni making the FDA approved firmware.

 

[adamXpeter]

For reliable devices, that should net be needed.

I assume you wanted to write not. There are no reliable devices, see NIST SP 800-207 – Zero Trust Architecture.

 

[snemarch]

So:

1. On startup, the device connects to a NFS share and blindly copies/overwrites local files. ANYTHING could be installed this way.
2. During normal operation, patient data is constantly being sent to the remote server using a custom protocol.

 

[SunMaster]

It's only pathetic if it doesn't work. Otherwise, it's a bargain way to get data that would otherwise be far more expensive to acquire.

You left out the ethical aspect.

 

[mitch074]

For reliable devices, that should net be needed.
Whatever the reason, why is it there?

Just like with inexpensive security camera things...a hardcoded admin pwd, that you, the buyer, has no influence over.
Left there by clueless/incompetent devs, or on purpose to extract data.

see point 1 in the comment you (selectively) quoted.

 

[USAFRet]

see point 1 in the comment you (selectively) quoted.

"1- early debug/qualification code that wasn't removed at the end of the qualification program (any code modification requires validation when it's for medical devices - that enables deactivating such remote access)"

Exactly.
Failure to remove that smacks of clueless dev process and validation.

 

[mitch074]

You left out the ethical aspect.

From what I've seen, US firms (among others) embrace ethics only when it brings them money or once they've been caught being blatantly unethical. Pot, kettle.

 

[mitch074]

"1- early debug/qualification code that wasn't removed at the end of the qualification program (any code modification requires validation when it's for medical devices - that enables deactivating such remote access)"

Exactly.
Failure to remove that smacks of clueless dev process and validation.

Yeah. As if no company (including US ones) had ever been guilt-free of such.

 

[USAFRet]

Yeah. As if no company (including US ones) had ever been guilt-free of such.

Maybe, probably, certainly.
But completely off-topic.

 

[das_stig]

So if the evidence is accurate, in the USA all these devices will be ordered to be removed from usage, but they won't and a mass sue ball at the company. They will plead ignorance, offer a few million to the lawyers and whoever and change the code, but medical companies will be too lazy to upgrade devices and cost too much, so will probably just block IP and let it get swept under the rug.

In EU, they will be given a stay and ordered to change code and probably will, and company gets a fine for GDPR breach.

In UK, they will be given a stay and ordered to change code, they won't as UK regulator toothless, NHS has no cash to update them and Government will just IP blocked and the company will win a new contract to replace them at twice the price at the next procumbent funding meeting, as some locla MP will demand we buy British, as the company rent a broom cupboard in his constituency, even if everything is built in China and foreign owned company.

 

[NinoPino]

So if the evidence is accurate, in the USA all these devices will be ordered to be removed from usage, but they won't and a mass sue ball at the company. They will plead ignorance, offer a few million to the lawyers and whoever and change the code, but medical companies will be too lazy to upgrade devices and cost too much, so will probably just block IP and let it get swept under the rug.

In EU, they will be given a stay and ordered to change code and probably will, and company gets a fine for GDPR breach.

In UK, they will be given a stay and ordered to change code, they won't as UK regulator toothless, NHS has no cash to update them and Government will just IP blocked and the company will win a new contract to replace them at twice the price at the next procumbent funding meeting, as some locla MP will demand we buy British, as the company rent a broom cupboard in his constituency, even if everything is built in China and foreign owned company.

I suppose, nothing relevant will happen, just a normal software/firmware upgrade.
Without forgetting, that the problem exists only if they are directly connected to the internet, without protection.

 

[King_V]

You left out the ethical aspect.

That's not under the definition of "pathetic" . And if we're talking ethical, then exactly which government is clean in that regard?

--------
Pathetic
adjective

1.
arousing pity, especially through vulnerability or sadness.
"she looked so pathetic that I bent down to comfort her"

2.
miserably inadequate; of very low standard.
"he's a pathetic excuse for a man"

 

[KennyRedSocks]

They know what it is but have not shared it

Why not?
What's their "agenda"?