>>8517501
>>8517311
Hacker Can Send Fatal Dose to Hospital Drug Pumps
https://wikileaks.org/hackingteam/emails/emailid/1078206
When security researcher Billy Rios reported earlier this year that he’d found vulnerabilities
in a popular drug infusion pump that would allow a hacker to raise the
dosage limit on medication delivered to patients, there was little cause
for concern.
Altering the allowable limits of a particular drug simply meant that
if a caregiver accidentally instructed the pump to give too high or too
low a dosage, the pump wouldn’t issue an alert. This seemed much less
alarming than if the pumps had vulnerabilities that would allow a hacker
to actually alter the dosage itself.
Now Rios says he’s found the more serious vulnerabilities in several models of pumps made by the same manufacturer, which would allow a hacker to surreptitiously and remotely change the amount of drugs administered to a patient.
“This is the first time we know we can change the dosage,” Rios told WIRED.
The vulnerabilities are known to affect at least five models of drug
infusion pumps made by Hospira—an Illinois firm with more than 400,000
intravenous drug pumps installed in hospitals around the world.
The vulnerable models include the company’s standard PCA LifeCare
pumps; its PCA3 LifeCare and PCA5 LifeCare pumps; its Symbiq line of
pumps, which Hospira stopped selling in 2013 due to concerns raised by the FDA over other quality and safety issues with the pumps; and its Plum A+ model of pumps. Hospira has at least 325,000 of the latter model alone installed in hospitals worldwide.
These are the systems that Rios knows are vulnerable because he’s
tested them. But he suspects that the company’s Plum A+3 and its
Sapphire and SapphirePlus models are equally vulnerable too.
Hospira did not respond to a request for comment.
Earlier this year, Rios went public with information about a different security issue with Hospira’s LifeCare pumps.