Nozomi Networks Labs, which provides OT & IoT security for critical infrastructure, conducted research on a device from the GE HealthCare Vivid ultrasound family and companion software. Nozomi said it detected 11 vulnerabilities affecting systems and software from the company.
Nozomi said in a post at its website that the flaws could have repercussions for the hospital workflow or the security of medical data. The GE HealthCare Product Security Portal has patches and mitigations available for the identified vulnerabilities.
Nozomi looked at the GE HealthCare Vivid T9 ultrasound system and its pre-installed Common Service Desktop web application. It also examined the EchoPAC software that accompanies the technology. The firm identified vulnerabilities through “different attack vectors.”
The research verified the ability to lock the Vivid T9 by means of a proof-of-concept ransomware. After physically accessing the device and removing all Windows security protections — a possibility due to the full privileges obtained — investigators disrupted the device logic while simultaneously showing a picture on the screen asking for the payment of a ransom. A similar payload can also be performed against a doctor’s workstation running EchoPAC.
Additionally, having achieved code execution with full privileges on a target system, Nozomi says nothing can stop an attacker from accessing and manipulating the patient data stored on it.
Nozomi’s takeaways on the GE HealthCare ultrasound vulnerabilities
An attack on a primary healthcare facility’s ultrasound capabilities could have severe, multifacted consequences, Nozomi warned. Ultrasound infrastructure plays a key role in diagnosing and monitoring various medical conditions. The inability to access or use devices could delay critical medical procedures, disrupt accurate diagnoses and impede treatment.
Such an attack could also compromise patient confidentiality, with potential breaches of privacy and legal implications for the hospital. Attackers could misuse or sell exposed patient data, Nozomi said, posing a threat to personal information. Patients could also face harm from the potential hindrances to the accuracy of diagnoses and treatment plans.
Nozomi said GE HealthCare confirmed that their trained medical staff executed medical safety risk assessment following regulatory expectations. GE HealthCare maintains that the associated safety risk is controlled, acceptable or as low as possible.
However, the cybersecurity firm notes the rise of ransomware attacks against healthcare providers in recent years.
Within the past year, LivaNova disclosed a cybersecurity breach that disrupted portions of its information technology systems and business operations. This incident came shortly after another large medtech company, Henry Schein, experienced a significant breach.
GE HealthCare responds
A GE HealthCare spokesperson issued the following statement on behalf of the company:
Maintaining the safety and security of our devices is a top priority. We recently disclosed potential cybersecurity vulnerabilities for several ultrasound systems that, if acted upon, could render a system unusable or disclose limited patient information. We conducted a thorough investigation of the issue and determined existing mitigations and controls are in place and effective.
This is not a recall and GE HealthCare has not received any reports of potential exploitation of vulnerabilities or unauthorized access to data associated with this issue.
