Cybersecurity threats are now so common it’s inevitable that your company and products will be attacked – if it hasn’t already happened. Within seconds of connecting to the internet, any new device or IP address is scanned for vulnerabilities by giant botnets made up of millions of compromised devices, including many poorly protected household items such as network-connected cameras, thermostats and even lightbulbs.

In a dramatic demonstration of just how aggressive malware botnets are, a French researcher recently programmed a server to appear online as a computer running a vulnerable older version of the Windows operating system.

Within 90 minutes the server was infected, reset and infected again six times – once in just three minutes – by WannaCry ransomware, which encrypts all data on a hard drive and demands payment to unlock it (1). While the initial WannaCry outbreak in May 2017 was contained, hundreds of new WannaCry variants still infest the Internet.

In another demonstration showing how connected “Internet of Things” devices can compromise an entire computer network, a low-end surveillance camera was attacked by the Mirai worm just 98 seconds after it was plugged in. The worm entered using the camera’s default password, and would have taken control of every computer, router and device on the network had the researcher not isolated the camera before connecting it (2).

This same Mirai botnet temporarily shut down Twitter, Netflix and Reddit along with a host of smaller companies in a major cyberattack in October 2016. Its variants remain active to this day, and could launch a new attack at any time.

Winning the cybersecurity arms race

To defend themselves, device manufacturers, software developers and computer security experts find themselves locked in a perpetual arms race with hackers and malware developers. Constant vigilance and quick responses are required (see Fig. 1).

Historically, it’s taken several months from outbreak detection until a security patch can be developed and deployed. But as can be seen from the history of the WannaCry ransomware, this isn’t quick enough. By the time a fix for the original WannaCry worm was developed two months after its initial detection, its source code had spread far and wide, and new variations continue to develop (see Fig. 2).

Historically, it’s taken several months from outbreak detection until a security patch can be developed and deployed. But as can be seen from the history of the WannaCry ransomware, this isn’t quick enough. By the time a fix for the original WannaCry worm was developed two months after its initial detection, its source code had spread far and wide, and new variations continue to develop (see Fig. 2). 

It’s now generally recognised that security patches must be developed and deployed to all vulnerable devices within 30 days to prevent a new threat from becoming a major problem. In a recent event, 143 million American consumers had personal and financial data stolen from a major credit card reporting agency. Attackers compromised systems due to a known vulnerability, for which a patch was available for 2 months prior to the attack but had not been applied – a development that could be life threatening when medical devices are involved.

In addition, hackers may target device source code and other intellectual property held by device developers and end-user health systems. The stolen information may be held for ransom or sold to other potential attackers. For example, in June 2016, a hacker known as “The Dark Overlord” offered to sell for about $500,000 source code and digital signatures that would allow attackers to break into healthcare administrative software. The hacker also offered personal data from millions of patients stolen from clinics and insurance companies (3).

These examples illustrate the range and potential severity of the cybersecurity threats that medical device makers face. While it’s not possible to predict every threat, here are five you are likely to see in the near term:

  • Ransomware – Hackers threaten patients, caregivers, or the manufacturer with the interruption of a patient’s device functions, such as dosing of medication, or disruption of communications between devices and critical data servers, in exchange for ransom
  • Collateral damage – General malware or viruses interfere with device software and potentially assimilate a device into a botnet to launch denial of service or other attacks on IT infrastructure that underpin critical services, such as Mirai-like attacks on DNS providers
  • Privacy breaches – Exposure of sensitive clinical data harms patients, violates privacy laws with steep financial penalties, or places users in physical danger by revealing their real-time location. Hacking into medical databases through unprotected devices also exposes patients to identity theft
  • Device takeover – Cardiac or other devices are taken over through a near-field communication device, unsecured USB ports, or remotely though internet-enabled connections, threatening patient safety
  • Financial vulnerability – Cybersecurity vulnerabilities can be exposed publicly to manipulate the stock price or gain other financial advantages over a manufacturer.

Guarding against these and other cybersecurity threats is essential to protect patients and company finances. In fact, the FDA, EMA and other regulators consider cyber threats to be so dangerous they now require cybersecurity risk management plans that cover the entire lifespan of new and existing devices.

ICON has the experience and expertise to help you win the online arms race with hackers. For guidance on developing and maintaining an effective medical device cybersecurity risk management programme, contact us.

 

References: 

(1) Cimpanu C. Honeypot Server Gets Infected with WannaCry Ransomware 6 Times in 90 Minutes. BleepingComputer, May 14, 2017. 

(2) Coldewey D. This security camera was infected by malware 98 seconds after it was plugged in. Techcrunch.com, Nov 16, 2016. 

(3) Kirk J. 'The Dark Overlord' Advertises Stolen Source Code. Bank Info Security, July 14, 2016.