More than half of MioT devices remain susceptible to the BlueKeep, DejaBlue and other bugs despite security patches. Why?

Following an opinion piece in CybersecAsia on the clear and present dangers of connected medical devices being hacked, the world saw its first report this year about such MioT devices being vulnerable to the BlueKeep exploit.

While the infamous BlueKeep vulnerability was already patched by Microsoft almost a year ago, researchers now warn that almost half (more than 55% of medical imaging devices, including MRIs, XRays and ultrasound machines)  are still vulnerable because they are powered by outdated Windows versions via the remote desktop protocol (RDP) flaw.

Researchers said they found that 22% of a typical hospital’s Windows devices were vulnerable to BlueKeep. Even worse, the number of connected medical devices running Windows that are vulnerable to BlueKeep is considerably higher—around 45%.

Outdated Windows versions exposed medical devices to other vulnerabilities such as DejaBlue.

Healthcare organisations have been attractive targets among hackers for a while now. This is largely due to the vast amounts of personal information which hospitals and other healthcare organisations store and transfer electronically. This valuable data can be used to obtain expensive medical services and prescription medications, as well as to fraudulently acquire government health benefits.

According to Tony Jarvis, Chief Technology Officer, Asia Pacific, Check Point Software Technologies: “From a regulatory perspective, the inherent vulnerabilities associated with healthcare devices, such as a lack of encryption of sensitive data as well as hard-coded or default login credentials, prevent IT professionals from even implementing security patches, should such patches even exist.”

Jarvis noted that the benefits of connected medical devices cannot be ignored. However, healthcare organisations must be aware of potential vulnerabilities and do their best to mitigate any perceived risks. He recommends network segmentation are a best practice which would allow IT professionals in the healthcare sector to embrace new digital medical solutions while segregating them from other critical systems, thereby reducing the risk of vulnerabilities spreading throughout the hospital.

“Once best-practice cyber-hygiene is implemented and enforced, IT security teams can rest assured that their patients’ records, and in turn their organisations’ finances and reputation, are well protected,” he added.