- CISA issues warning of Chinese-made screen, quietly forwarding sensitive data
- More devices were found with malicious code in the firmware
- The company tried and failed to tackle the error
At least three health units built by Chinese manufacturers were found with firmware back doors that seem to forward sensitive information to a Chinese university.
US Cyber Security and Infrastructure Security Agency (CISA) recently issued a warning about Contec CMS8000, a patient monitor used in hospitals and clinical environments to track vital signs such as ECG, blood pressure, oxygen saturation (spoination), airway rate and temperature.
The agency said an independent researcher discovered that the device was involved in malicious activity and connected to a hard-coded external IP address. Bleeping computer managed to decide that the IP address belonged to a “Chinese University,” but did not say which one.
No patch
The researchers then revealed the malicious activity was tied to a back door planted in the firmware, which would safely download and run files on the device. The back door would allow unknown third parties to perform programs externally, take over patient screens completely and send patient data over the pond. The activity was also not logged to fly under the radar of the administrators who administered the units.
Further study revealed that the same IP address was discovered in software for other medical devices, including a pregnancy patient monitor from another Chinese health producer, bleeping computer added. The FDA said it also found it in Epsimed MN-120 patients (essentially re-labeled Contec CMS8000 units).
CISA reached out to Contec, it informed the back door, and the company came back with “more firmware pictures” to mitigate the problem. However, each of the firmware updates did not deal with the problem properly, which allowed the back door to continue to function.
As the vulnerability is not yet fully addressed, CISA called on all users to discontinue the end points from the wider network if possible.
Via Bleeping computer
