It turns out that it doesn’t take much of a skill level to exploit quite a few GE Healthcare products.
Cybersecurity analysts, Lior Bar Yosef and Elad Luz of CyberMDX reported these vulnerabilities to GE Healthcare just this week.
GE Imaging and Ultrasound Products, the kind we depend on for critical diagnosis and life-saving maintenance are vulnerable to unprotected transmission of credentials, exposure of sensitive information to unauthorized control operation.
Successful exploitation of these vulnerabilities could occur if an attacker gains access to the healthcare delivery organization’s (HDO) network. If exploited, these vulnerabilities could allow an attacker to gain access to affected devices in a way that is comparable with legitimate GE (remote) service user privileges. A successful exploitation could expose sensitive data such as a patient health information (PHI) or could allow the attacker to run arbitrary code, which might impact the availability of the system and allow manipulation of the system functions.
The following versions of GE imaging and ultrasound products are affected:
Modality | Product |
MR | 3.0T Signa HDxt / 3.0T Signa HDx, versions HD 16, HD23
1.5T Brivo MR355 / Optima MR360, versions SV20.1, SV23.0 1.5T Signa HDx / 1.5T Signa HDx, Signa HDi / Signa VIBRANT, versions HD16, HD23 |
Ultrasound, General Imaging | LOGIQ 5 [BT03], LOGIQ 7 (BT03, BT04, BT06], LOGIQ 9 [BT02, BT03, BT04, BT06] |
Ultrasound, Cardiovascular | Vivid I [BT06], Vivid 7 {BT02-BT06], EchoPAC (Turnkey) [BT06], Image Vault (Turnkey) [4.3] |
Ultrasound, Women’s Health | Voluson 730 [BT05, BT08] |
Advanced Visualization | AW 4.0 to AW 4.6, AWS2.0 to AW3.0 |
Affected versions of the following can be determined by visiting the GE Customer Portal | |
Interventional | Innova 2000, 3100, 4100, 2100-IQ, 3100-IQ, 4100-IQ, 212-IQ, 313-IQ
Optima 320, CL320i, CL323i, CL320, 3100 Optima IGS 320, 330; Innova IGS 5×0, 6×0, 7×0 |
Advanced Visualization | AW 4.0 to AW 4.6, AWS2.0 to AW3.0 |
X-Ray | Brivo XR118, XR383, XR515, XR575; Definium 5000, 6000, 8000, AMX 700; Discovery XR650, XR656, XR656+; Optima XR640, XR646, XR220amx, XR200amx; Precision 500D, WDR1 |
Mammography | Seno 200D, DS, Essential; Senographe Pristina |
Computed Tomography | BrightSpeed Elite, Elite Select, Edge, Edge Select
Brivo CT385 Discovery CT590RT, CT750HD LightSpeed VCT, Pro16, RT16 Optima Advance, CT520, CT540, CT660, CT580, CT580RT, CT580W, CT670, CT680 Quantum, Expert & Professional Revolution EVO,HD,ACT, ACTs, CT, Discovery CT, Frontier, Frontier ES |
Nuclear Medicine, PET/CT | Brivo NM 615
Discovery NM 630, NM 750b, NM D530c, NM/CT D570c, NM/CT 670 Infinia Discovery NM830, NM/CT 860, NM/CT850, NM/CT 870, MI MI DR, IQ Optima NM/CT 640 Ventri Xeleris PET Discovery IQ, IQ upgrade PETrace 800 |
The affected products may allow specific credentials to be exposed during transport over the network. In other words, the diagnostic or real-time data can be altered on its way to the nurse’s computer and patient’s care protocol and information database as well as control the affected systems.
A vulnerability base score of 9.8 (out of a possible 10) has been calculated
The affected products may also allow exposed or default credentials to be utilized to access or modify sensitive information.
- CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health
- COUNTRIES/AREAS DEPLOYED: Worldwide
- COMPANY HEADQUARTERS LOCATION: United States
GE says it has identified mitigations for specific products and releases and will take proactive measures to ensure proper configuration of the product firewall protection and change default passwords on impacted devices where possible. GE recommends users refer to the GE Healthcare Product Security Portal for more details on mitigations and how proactive actions may apply to affected devices.
In addition to the product specific recommendations, GE recommends utilizing the standard clinical network security best practices. Suggested clinical best practices include:
- Ensure proper segmentation of the local hospital/clinical network and create explicit access rules based on source/destination IP/port for all connections, including those used for remote support. Specific ports to consider may include those used for TELNET, FTP, REXEC, and SSH
- Utilize IPSec VPN and explicit access rules at the Internet edge before forwarding incoming connections to the local hospital/clinical network.
All healthcare organizations and their third-party IT support entities must perform proper impact analysis and risk assessment prior to deploying any security measures.
If basic precautions are not taken, one can only imagine the results possible, God forbid.
These include life threatening outcomes in a healthcare facility, enormous fines and liabilities as well as competence reputation to the point of closure.
I encourage all providers and their subcontractors to consult the section for control systems security recommended practices on the ICS webpage on us-cert.cisa.gov. Several recommended practices are available for reading and download.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
Ron Benvenisti
FEMA Certified – NIST Zero-Day Counter Terrorism Licensed – Patented DHS SaaS Cybersecurity Assessment, Remediation and Management
GSA Listed – DOD MURI ID
Ocean County Committee District 4 – Lakewood District 26
LETS BECOME ANTI MEDICINE ANTI ULTRA SOUNDS ANTI XRAYS!!!!
GO ALTERNATIV HEALTH!!!!
GO ANTI VAXCING!!!
GO ANTI MASKING!!!
GO COVID DENIERS!!!!
Basically, in very short, these machines are computers and connected to networks etc and can be hacked just like any other computer or network in the world. I don’t believe there is a network in the world that CANNOT be hacked. Your local doctor’s office computer network can also be hacked and the hackers could gain access to PHI or billing information too. Medical facilities are very worried about HIPAA violations because there can be HUGE penalties so they do pay for network and cyber security and do take this information seriously.
But why print this article on the lakewood scoop? It is not relevant to your readership. Just trying to scare people?
GO AWAY!!!!!!!
Wasn’t “YEAH” the guy carrying a sign with all of that walking up and down Clifton? It must be him even though I couldn’t see his face through both masks.
To, “what is the point of this article?”. Get back to me after you spend a few years in the military. I won’t hold my breath, blowhard. PS, if you’re so sure of yourself, don’t let anyone with a cell phone or an x-box or Nintendo near your pacemaker.