1,400+ vulnerabilities found in automated medical supply system

I totally agree Anthony! You'd think these health care facilities could afford to upgrade/ update their end of life OSs! Security matters especially for Health Care!

@Antus67 wrote:
This thread just reinforces a previous article on Health Care facilities not being up to date on cyber security or awareness.

It's the same old, same old... We always learn when it's to late or many people have to suffer or die. It's a shame. 😞

I agree Anthony totally. I think sometimes they take an attitude of "if it aint broke don't fix it" well eventually things get so bad that things have to be done at short notice with no lee way and the impact is greater on the customer/clients.

Just beggars belief that something that important could be allowed to get to that stage of 'decrepitude' security-wise. Someone in the IT deaprtment there needs shooting for allowing it. But unfortunately it is an all to recurrent issue given that these sorts of system 'evolve' over years and that many of the 'holes' get built in as part of the extensions of services, etc. ;)

The device was running on Windows XP, was considered EOL

 
Mar 31, 2016 09:15 GMT  ·  By Catalin Cimpanu Devices are running on EOL Windows XP machines Because these devices were built to run a custom Windows XP build, all of these versions have reached end of life, but in many cases, the medical centers where they are deployed are continuing to use them.
 
The researchers warned ICS-CERT, who, together with BD, CareFusion's parent company and the device's manufacturer, has issued public alerts on this topic, warning hospital to upgrade to newer devices.
 
Out of the 1,418 vulnerabilities, security researchers say that 715 are considered to have a high severity score (CVSS between 7 and 10) while 606 are labeled with medium severity (CVSS between 4 and 6.9). Researchers and ICS-CERT specialists claim that, despite the fact that these devices are located in hospitals, attacking and exploiting Pyxis supply stations won't lead to the loss of human life.
 
Full Article

The problem the hospitals don't want to bother upgrading or paying the
cost of upgrading they feel their safe enough. Now it has bit them were
it hurts and they still don't do anything about it.

You are right Anthony...I don't understand how the hospital can think they can get by with outdated systems especially with lack of security which is beyond belief in this day and age.

Well, in a sense that is on the one hand almost criminal...but there after the cost of replacing these specialised systems can be quite extortionate...so these institutions are left with a difficult decision. :(