Vulnerability Discovered in Philips HDI 4000 Ultrasound Systems
A vulnerability has been discovered in Philips HDI 4000 Ultrasound systems which could be exploited to gain access to ultrasound images. In addition to stealing data, an attacker could doctor ultrasound images to prevent diagnosis of a potentially life-threatening health condition.
Philips HDI 4000 Ultrasound systems are based on legacy operating systems such as Windows 2000 which are no longer supported. Any vulnerability in the operating system could be exploited to gain access to the system and patient data.
One such vulnerability – CVE-2019-10988 – was detected by security researchers at Check Point, who reported the problem to Philips. US-CERT has recently issued an advisory about the vulnerability.
Philips HDI 4000 Ultrasound systems reached end of life in December 2013 and are no longer sold, updated, or supported by Philips, yet many healthcare organizations continue to use the systems even through they are vulnerable to attack. US-CERT warns that multiple exploits are already in the public domain and could be used to gain access to the systems.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Since the devices are no longer supported, Philips will not be issuing an update or patch to correct the flaw. Until the systems can be retired and replaced, defensive measures should be taken to reduce the risk of the flaws being exploited.
The DHS Cybersecurity Infrastructure Security Agency (CISA) recommends users of Philips HDI 4000 Ultrasound systems should restrict system access to authorized individuals and apply the rule of least privilege. All accounts and services that are not 100% necessary should be disabled, and defense in depth strategies should be adopted.
It is strongly advisable to replace these aging systems with newer technology that runs on supported operating systems.
According to US-CERT, the vulnerabilities require a relatively high level of skill to exploit and an attacker would need access to the same local subnet as the device, hence the CVSS v3 base score of 3.0 out of 10.
