Subject: [Mud] [Dumpsterfire] Vulnerabilities found in GE anesthesia machines (fwd) José María Mateos via Dumpsterfire

From: Michael Richardson <[email-masked]>
Date: Wed, 17 Jul 2019 17:25:55 -0400 (EDT)

Subject: [Dumpsterfire] Vulnerabilities found in GE anesthesia machines
From: José María Mateos via Dumpsterfire<[email-masked]>
To: Dumpsterfire mailing list <[email-masked]>
Date: Tue, 16 Jul 2019 18:24:16 -0400
List-Id: Dumpsterfire - the mailing list for IoT security and privacy failures <dumpsterfire.firemountain.net>

Via RISKS Digest 31.33:

https://www.zdnet.com/article/vulnerabilities-found-in-ge-anesthesia-machines/

GE recommends not connecting vulnerable anesthesia machines to hospital
networks.

Security researchers have discovered vulnerabilities in two models of
hospital anesthesia machines manufactured by General Electric (GE).

The two devices found to be vulnerable are GE Aestiva and GE Aespire
-- models 7100 and 7900. According to researchers from CyberMDX, a
healthcare cybersecurity firm, the vulnerabilities reside in the two
devices' firmware.

CyberMDX said attackers on the same network as the devices -- a
hospital's network -- can send remote commands that can alter devices'
settings.

The researcher claims the commands can be used to make unauthorized
adjustments to the anesthetic machines' gas composition, such as
modifying the concentration of oxygen, CO2, N2O, and other anesthetic
agents, or the gas' barometric pressure.

Cheers,

-- 
José María (Chema) Mateos || https://rinzewind.org

**********************************************************************
The Dumpsterfire mailing list is hosted by firemountain.net.

To unsubscribe or change delivery options:
http://www.firemountain.net/mailman/listinfo/dumpsterfire