PwnedPiper threatens thousands of hospitals worldwide, patch your systems now

Image: ZDNet

The bundle utilized to power pneumatic tubes successful implicit 3,000 hospitals astir the satellite has 9 captious vulnerabilities that could halt infirmary operations if exploited by a savvy attacker. 

Discovered by researchers astatine information level supplier Armis and dubbed PwnedPiper, the vulnerabilities are successful the Nexus Control Panel bundle utilized by Translogic pneumatic conduit systems (PTS) built by Swisslog Healthcare. Tube systems successful hospitals are commonly utilized to present medicine, transport humor and different indispensable aesculapian supplies, and nonstop laboratory samples crossed buildings that would instrumentality sizeable clip to present connected foot. According to Swisslog Healthcare, their automated transport systems are utilized successful implicit 2,300 hospitals successful North America and implicit 3,000 worldwide.

SEE: Security incidental effect policy (TechRepublic Premium)

PTS are often net connected, Armis said, but "despite the prevalence of these systems, and the reliance of hospitals connected their availability to present care, the information of these systems has ne'er been thoroughly analyzed oregon researched." 

Five of the vulnerabilities successful PwnedPiper impact distant codification execution, which an attacker could usage to entree a infirmary web and past instrumentality implicit Nexus stations. Control implicit a Nexus presumption tin beryllium utilized to harvest information connected infirmary unit and machine systems, arsenic good arsenic get web layouts utilized to determination laterally and motorboat ransomware attacks.

Armis describes the 9 vulnerabilities it uncovered, arsenic "critical." They include:

• CVE-2021-37163 - Two hardcoded passwords that are accessible done the Telnet server connected the Nexus Control Panel
• CVE-2021-37167 - Privilege escalation vulnerability owed to a idiosyncratic publication being tally by root
• CVE-2021-37161 - Memory corruption bug successful the implementation of the TLP2-0 protocol: Underflow successful udpRXThread
• CVE-2021-37164 - Memory corruption bug successful the implementation of the TLP2-0 protocol: Off-by-three stack overflow successful tcpTxThread
• CVE-2021-37165 - Memory corruption bug successful the implementation of the TLP2-0 protocol: Overflow successful hmiProcessMsg
• CVE-2021-37162 - Memory corruption bug successful the implementation of the TLP2-0 protocol: Overflow successful sccProcessMsg
• CVE-2021-37166 - GUI socket Denial Of Service

• CVE-2021-37160 - Unauthenticated, unencrypted, unsigned firmware upgrade

According to the company, a palmy attacker could power the full conduit web and its stations by exploiting the Nexus Control Panel software. In addition, Armis warns that an attacker "could alteration blase ransomware attacks that tin scope from denial-of-service of this captious infrastructure to full-blown man-in-the-middle attacks that tin change the paths of the networks' carriers, resulting successful deliberate sabotage of the workings of the hospital."

"Understanding that diligent attraction depends not lone connected aesculapian devices, but besides connected the operational infrastructure of a infirmary is an important milestone to securing healthcare environments," said Nadir Izrael, co-founder and CTO astatine Armis.

SEE: How to negociate passwords: Best practices and information tips (free PDF) (TechRepublic)

The fig of attacks against hospitals and aesculapian facilities has been connected a dependable summation since the outbreak of the COVID-19 pandemic. Several hospitals person faced ransomware attacks, coating the menace of ransomware and cyberattacks against the healthcare industry successful stark light: It's not a possibility, it's reality.  

Swisslog volition merchandise spot v7.2.5.7

Armis told Swisslog astir its Nexus PTS power bundle vulnerability connected May 1, 2021, and reports that it has been moving with the institution to guarantee patches are disposable and due information measures are intelligibly outlined for customers. As a result, Swisslog has released a security advisory and is expected to merchandise a spot for the disclosed vulnerabilities connected August 2. According to the company, this patch, v7.2.5.7, "will resoluteness each disclosed vulnerabilities, but the unsigned firmware upgrade vulnerability (CVE-2021-37160), which volition beryllium resolved successful a aboriginal release."

Armis' Ben Seri and Barak Hadad, the researchers down the report, volition beryllium presenting their discoveries astatine Black Hat USA, and Armis has published information for hospitals connected however to combat PwnedPiper.

Also spot

• How to go a cybersecurity pro: A cheat sheet (TechRepublic)
• Security threats connected the horizon: What IT pro's request to cognize (free PDF) (TechRepublic)
• Checklist: Securing integer information (TechRepublic Premium)
• Online information 101: Tips for protecting your privateness from hackers and spies (ZDNet)
• Cybersecurity and cyberwar: More must-read coverage (TechRepublic connected Flipboard)