Security News Hackers Can Falsify Patient Vitals

[LASER_oneXM]

Content source

https://www.bleepingcomputer.com/news/security/hackers-can-falsify-patient-vitals/

Hackers can falsify patients' vitals by emulating data sent from medical equipment clients to central monitoring systems, a McAfee security researcher revealed over the weekend at the DEF CON 26 security conference.

The research, available here, takes advantage of a weak communications protocol used by some patient monitoring equipment to send data to a central monitoring station.

Attack possible because of Rwhat protocol

McAfee security researcher Douglas McKee says he was able to reverse engineer this protocol, create a device that emulates patients vitals, and send incorrect information to a central monitoring station.
This attack required physical access to the patient, as the attacker needed to disconnect the patient monitoring client and replace it with his own device that feeds incorrect patient vitals to the central station monitored by medical professionals.
But McKee also devised another method of feeding central monitoring stations without needing to disconnect the patient monitoring client.
A variation of the attack requires the attacker to be on the same network as the patient monitoring client in order to ARP spoof the central monitoring station.

 

[ZeroDay]

Thanks for the share. Anyone that actually does this needs locking up for life and some serious therapy. There's hacking and then there's playing with someone's life like it's a game.

 

[In2an3_PpG]

Thanks for the share. Anyone that actually does this needs locking up for life and some serious therapy. There's hacking and then there's playing with someone's life like it's a game.

Therapy doesn't work. How about death? Or too harsh? I am not much for life imprisonment.

 

[ZeroDay]

Therapy doesn't work. How about death? Or too harsh? I am not much for life imprisonment.

If they cause someone else's death or long term serious damage to someone's life then yes, they should face the same end. Hacking anything to do with hospitals is completely crossing the line in my opinion.

 

[vtqhtr413]

I read about this when it came out and the manufacturer, after being notified of this flaw stated, they didn't consider it a realistic scenario.