[{"innerBlocks":[],"name":"core\/freeform","postId":721,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"Two types of hospital anesthesia devices manufactured by GE Healthcare contain significant cyber vulnerabilities, a federal agency contends.

Cybersecurity vendor CyberMDX, based in New York, discovered the medical device vulnerabilities in GE Healthcare anesthesia and respiratory devices, reports the Department of Homeland Security\u2019s Industrial Control Systems-Cyber Emergency Response Team.

The vulnerabilities relate to the GE Aestiva and GE Aespire devices, which are models 7100 and 7900.

\u201cIf an attacker gains access to a hospital\u2019s network and if the GE Aestiva or GE Aespire devices are connected via terminal servers, the attacker can force the devices to revert to an earlier, less secure version of the communication protocol and remotely modify parameters without authorization,\u201d says Elad Luz, head of research at CyberMDX.

Also See:<\/b> Dashboard helps monitor patients under anesthesia during surgery<\/a>

When deployed using terminal servers, these manipulations can be performed with no prior knowledge of IP addresses or location of the anesthesia machine.

Consequently, concentration of inspired\/expired oxygen, CO2, N20 and anesthetic agents can be altered. Other manipulations can include barometric pressure settings and anesthetic agent type selection, CyberMDX warns. Remote silencing of alarms and alteration of date and time settings also are at risk.

CyberMDX cautions that it conducted several field tests with the machines and confirmed the vulnerability.

\u201cIt should, however, be noted that the team only attempted the command to silence the device\u2019s alarm, as adjustments to settings for chemical constitution and time can have complicated and potentially long-lasting consequences that were best to avoid in a real hospital environment.\u201d

GE Healthcare will provide updates and additional security information via its website on the vulnerability for affected users.
","saveContent":"Two types of hospital anesthesia devices manufactured by GE Healthcare contain significant cyber vulnerabilities, a federal agency contends.

Cybersecurity vendor CyberMDX, based in New York, discovered the medical device vulnerabilities in GE Healthcare anesthesia and respiratory devices, reports the Department of Homeland Security\u2019s Industrial Control Systems-Cyber Emergency Response Team.

The vulnerabilities relate to the GE Aestiva and GE Aespire devices, which are models 7100 and 7900.

\u201cIf an attacker gains access to a hospital\u2019s network and if the GE Aestiva or GE Aespire devices are connected via terminal servers, the attacker can force the devices to revert to an earlier, less secure version of the communication protocol and remotely modify parameters without authorization,\u201d says Elad Luz, head of research at CyberMDX.

Also See:<\/b> Dashboard helps monitor patients under anesthesia during surgery<\/a>

When deployed using terminal servers, these manipulations can be performed with no prior knowledge of IP addresses or location of the anesthesia machine.

Consequently, concentration of inspired\/expired oxygen, CO2, N20 and anesthetic agents can be altered. Other manipulations can include barometric pressure settings and anesthetic agent type selection, CyberMDX warns. Remote silencing of alarms and alteration of date and time settings also are at risk.

CyberMDX cautions that it conducted several field tests with the machines and confirmed the vulnerability.

\u201cIt should, however, be noted that the team only attempted the command to silence the device\u2019s alarm, as adjustments to settings for chemical constitution and time can have complicated and potentially long-lasting consequences that were best to avoid in a real hospital environment.\u201d

GE Healthcare will provide updates and additional security information via its website on the vulnerability for affected users.
","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

GE anesthesia/respiratory devices have cyber vulnerabilities

More for you