Advisory: GE Healthcare Imaging and Ultrasound Products Vulnerabilities | Ron Benvenisti

It turns out that it doesn’t take much of a skill level to exploit quite a few GE Healthcare products.

Cybersecurity analysts, Lior Bar Yosef and Elad Luz of CyberMDX reported these vulnerabilities to GE Healthcare just this week.

GE Imaging and Ultrasound Products, the kind we depend on for critical diagnosis and life-saving maintenance are vulnerable to unprotected transmission of credentials, exposure of sensitive information to unauthorized control operation.

Successful exploitation of these vulnerabilities could occur if an attacker gains access to the healthcare delivery organization’s (HDO) network. If exploited, these vulnerabilities could allow an attacker to gain access to affected devices in a way that is comparable with legitimate GE (remote) service user privileges. A successful exploitation could expose sensitive data such as a patient health information (PHI) or could allow the attacker to run arbitrary code, which might impact the availability of the system and allow manipulation of the system functions.

The following versions of GE imaging and ultrasound products are affected:

Modality Product
MR 3.0T Signa HDxt / 3.0T Signa HDx, versions HD 16, HD23

1.5T Brivo MR355 / Optima MR360, versions SV20.1, SV23.0

1.5T Signa HDx / 1.5T Signa HDx, Signa HDi / Signa VIBRANT, versions HD16, HD23

Ultrasound, General Imaging LOGIQ 5 [BT03], LOGIQ 7 (BT03, BT04, BT06], LOGIQ 9 [BT02, BT03, BT04, BT06]
Ultrasound, Cardiovascular Vivid I [BT06], Vivid 7 {BT02-BT06], EchoPAC (Turnkey) [BT06], Image Vault (Turnkey) [4.3]
Ultrasound, Women’s Health Voluson 730 [BT05, BT08]
Advanced Visualization AW 4.0 to AW 4.6, AWS2.0 to AW3.0
Affected versions of the following can be determined by visiting the GE Customer Portal
Interventional Innova 2000, 3100, 4100, 2100-IQ, 3100-IQ, 4100-IQ, 212-IQ, 313-IQ

Optima 320, CL320i, CL323i, CL320, 3100

Optima IGS 320, 330; Innova IGS 5×0, 6×0, 7×0

Advanced Visualization AW 4.0 to AW 4.6, AWS2.0 to AW3.0
X-Ray Brivo XR118, XR383, XR515, XR575; Definium 5000, 6000, 8000, AMX 700; Discovery XR650, XR656, XR656+; Optima XR640, XR646, XR220amx, XR200amx; Precision 500D, WDR1
Mammography Seno 200D, DS, Essential; Senographe Pristina
Computed Tomography BrightSpeed Elite, Elite Select, Edge, Edge Select

Brivo CT385

Discovery CT590RT, CT750HD

LightSpeed VCT, Pro16, RT16

Optima Advance, CT520, CT540, CT660, CT580, CT580RT, CT580W, CT670, CT680 Quantum, Expert & Professional

Revolution EVO,HD,ACT, ACTs, CT, Discovery CT, Frontier, Frontier ES

Nuclear Medicine, PET/CT Brivo NM 615

Discovery NM 630, NM 750b, NM D530c, NM/CT D570c, NM/CT 670

Infinia

Discovery NM830, NM/CT 860, NM/CT850, NM/CT 870, MI MI DR, IQ

Optima NM/CT 640

Ventri

Xeleris

PET Discovery IQ, IQ upgrade

PETrace 800

The affected products may allow specific credentials to be exposed during transport over the network. In other words, the diagnostic or real-time data can be altered on its way to the nurse’s computer and patient’s care protocol and information database as well as control the affected systems.

A vulnerability base score of 9.8 (out of a possible 10) has been calculated

The affected products may also allow exposed or default credentials to be utilized to access or modify sensitive information.

  • CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: United States

GE says it has identified mitigations for specific products and releases and will take proactive measures to ensure proper configuration of the product firewall protection and change default passwords on impacted devices where possible. GE recommends users refer to the GE Healthcare Product Security Portal for more details on mitigations and how proactive actions may apply to affected devices.

In addition to the product specific recommendations, GE recommends utilizing the standard clinical network security best practices. Suggested clinical best practices include:

  • Ensure proper segmentation of the local hospital/clinical network and create explicit access rules based on source/destination IP/port for all connections, including those used for remote support. Specific ports to consider may include those used for TELNET, FTP, REXEC, and SSH
  • Utilize IPSec VPN and explicit access rules at the Internet edge before forwarding incoming connections to the local hospital/clinical network.

All healthcare organizations and their third-party IT support entities must perform proper impact analysis and risk assessment prior to deploying any security measures.

If basic precautions are not taken, one can only imagine the results possible, God forbid.

These include life threatening outcomes in a healthcare facility, enormous fines and liabilities as well as competence reputation to the point of closure.

I encourage all providers and their subcontractors to consult the section for control systems security recommended practices on the ICS webpage on us-cert.cisa.gov. Several recommended practices are available for reading and download.

Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.

Ron Benvenisti

FEMA Certified – NIST Zero-Day Counter Terrorism Licensed – Patented DHS SaaS Cybersecurity Assessment, Remediation and Management

GSA Listed – DOD MURI ID

Ocean County Committee District 4 – Lakewood District 26

 

This content, and any other content on TLS, may not be republished or reproduced without prior permission from TLS. Copying or reproducing our content is both against the law and against Halacha. To inquire about using our content, including videos or photos, email us at [email protected].

Stay up to date with our news alerts by following us on Twitter, Instagram and Facebook.

**Click here to join over 20,000 receiving our Whatsapp Status updates!**

**Click here to join the official TLS WhatsApp Community!**

Got a news tip? Email us at [email protected], Text 415-857-2667, or WhatsApp 609-661-8668.

5 COMMENTS

  1. Basically, in very short, these machines are computers and connected to networks etc and can be hacked just like any other computer or network in the world. I don’t believe there is a network in the world that CANNOT be hacked. Your local doctor’s office computer network can also be hacked and the hackers could gain access to PHI or billing information too. Medical facilities are very worried about HIPAA violations because there can be HUGE penalties so they do pay for network and cyber security and do take this information seriously.

    But why print this article on the lakewood scoop? It is not relevant to your readership. Just trying to scare people?

    • Wasn’t “YEAH” the guy carrying a sign with all of that walking up and down Clifton? It must be him even though I couldn’t see his face through both masks.

  2. To, “what is the point of this article?”. Get back to me after you spend a few years in the military. I won’t hold my breath, blowhard. PS, if you’re so sure of yourself, don’t let anyone with a cell phone or an x-box or Nintendo near your pacemaker.

Comments are closed.