The Division of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) has released a notice concerning weaknesses in Siemens CT and PET digital scanner structures. Healthcare companies have been put on warning and notified that there are freely available misuses for all 4 of the weaknesses.
If misused, hackers would be capable to change the working of the appliances, possibly placing patient security at risk. Files stowed on the systems would be available, malware might be copied, and the appliances might be utilized to attack the computer networks to which the appliances connect. The weaknesses can be abused distantly with no user interaction needed.
The weaknesses aren’t in Siemens methods, but the platform on which the methods operate – Windows 7. The weaknesses were there for the last two years and disturb the following Siemens PET/CT methods:
- Siemens SPECT Workplaces/Symbia.net
- Siemens SPECT Systems
- Siemens SPECT/CT systems
- Siemens PET Systems
- Siemens CT Systems
There are 2 code injection weaknesses, one improper limitation of operations in the limits of a memory cushion, and one weakness relating to privileges, permissions, and access controls. All four weaknesses have been prearranged a CVSS v3 mark of 9.8 out of 10.
Siemens has not yet issued patches to rectify the weaknesses even though they are presently being developed. In the intervening time, it’s essential for healthcare companies to take measures to safeguard the appliances, the most essential of which is to detach the appliances from the computer network and operate them in a separate mode, provided this doesn’t endanger patient treatment/safety.
The appliances must remain detached from the computer network until the patches for the weaknesses have been issued. Those patches will be forced out by Siemens and will be operated automatically. Healthcare companies must discuss with their local facility center to learn when the patches are obtainable so they are aware when to reconnect their appliances to have the patches fitted.
ICS-CERT also suggests locating the appliances behind firewalls as well as separating them from other components of the computer network. Healthcare companies that require accessing the appliances distantly must do so utilizing a VPN, even though VPNs might present a safety risk. ICS-CERT suggests modernizing VPNs to the latest type before using them to link to the appliances.