I'm Marianne Kolbacek-McGee, Executive Editor at Information Security Media Group. Today I'm speaking with Douglas McKee, who is a Principal Engineer and Senior Security Researcher at McAfee Enterprise. Douglas will be speaking about recent findings by McAfee Enterprise's advanced threat research team about vulnerabilities in an IV infusion pump product from B. Braun.
So, Douglas, please briefly describe how commonly used these B. Braun products are in the healthcare sector worldwide, and what did your research team find in terms of the vulnerabilities? So I unfortunately don't have exact numbers, you know, about the usage of the B. Braun pumps, but I can tell you is that market research shows that B.
Braun is the second largest infusion pump provider in the world and their pumps are used all over the place in Europe and in the American markets. We do know from statistically speaking that there's over 200 million IVs provided or infusions, I'm sorry, provided a year. It's a very large growing market, something like $54 billion in revenue a year. So we are talking about a very big market and B.
Braun does hold the second largest market share of that. And as far as what my team discovered, we worked on this for quite a long time and we discovered five vulnerabilities in the infusion map pump. And this actually applies to both the pump and something that they call the space station. And their space station is really just like a docking station, if you will.
And then that allows you to house multiple pumps. And so the vulnerabilities exist in both the wireless connected pumps and the space station, which is also connected to the network. And the crux of those vulnerabilities, really what's important is what can be done when those are combined, right? Each individual vulnerability by itself is not super, super interesting, but when you combine those four vulnerabilities, what we're able to do is a remote, unauthenticated attack.
So that means over the network, we're able to access the device in an unintended manner and then we're able to leverage the software on the device to let it do things it's not intended to do. So in this case, what we can do is we can manipulate values in memory and that manipulation results in the pump distributing either more or less drug than it's intended to do. And this is all done without alerting the medical staff or the IT staff. And so the pump actually believes it has administered the proper dose of medication, but we are able to actually have it administer either too much or too little.
So Douglas, this sounds like it's a potential safety concern for patients. Any other concerns for patients? And how about the security risks to healthcare organizations that use these devices if these vulnerabilities are exploited? The healthcare market is a very interesting attack vector right now.
Everything is very financially motivated. And so most of these attackers right now are still on the ransomware aspect of attacking medical facilities. And so a lot of these vulnerabilities aren't super likely to be exploited today because there's a lot of what we call low hanging fruits all out there. That's a lot easier to do.
And so attackers are more likely to use one of these vulnerabilities per se, for example, to either access the pump and install ransomware more likely than they are to do some of the other more in-depth attacks. And the attacks on these pumps specifically require network access. So in a properly configured medical network, these pumps would never be directly connected to the internet. And what that means is an attacker can't use this to get access to the network.
They would actually already have to have access. Now that may sound like a high bar or a big if, if you will. But believe it or not, hospitals have kind of become public places. You know, not a lot of people are asking me, well, why am I walking down the hospital hall?
Well, you know, I'm there to visit a relative and that's generally enough. And sometimes the Wi-Fi is not properly segregated and the wireless networks allow access to medical devices as well. Also, you have scenarios where the Ethernet ports open on in a hospital that you can just go plug into. Obviously these are not proper configurations, but the reality of it is this is the state we see a lot of the IT in the medical industry.
So it's not a super high bar for an attacker to get access to a hospital network, but it is a precursor for the attack. So they're not going to use this attack to gain access in the hospital network. They could leverage this attack once they have access to the hospital network to potentially do some pretty crazy stuff that could harm patients for sure. So Douglas, with that said, how can these issues be mitigated?
For instance, has B. Braun offered any updates to address the problems? Are there certain suggestions that you offer to customers of these products? So obviously the biggest thing that we like to see when we come out with security research is the vendor getting on board and fully patching these issues.
And B. Braun has in their latest update been able to, we've been told, I have not tested it personally, that we have been told that they've mitigated one of the five vulnerabilities to ensure that what we call the initial entry point, which is a network vector that we leverage, has been covered in the latest update. I haven't received communication whether the other four vulnerabilities have been patched or not. And so an attacker would have to just find a different entry point or network attack vector to leverage those other four.
So it's always good. It's great to see that B. Braun is taking initiative on the first vulnerability there from a network entry perspective. And from a medical facility perspective or a hospital perspective, you know, one of the reasons that ATR goes through and thoroughly publishes these findings is we hope to provide security teams of, you know, in this case, the medical facilities enough what we call like indicators of compromisers or IOCs so that they know what to look for for attacks like this.
And that's one of the big reasons why we publicize this. So we encourage that security teams of critical networks, including medical infrastructure, make sure they're staying on top of the latest security research being released from companies like McAfee Enterprise's ATR team so that they're aware of these types of attacks and therefore can look for this activity on their network. So as a security researcher, in addition to these latest infusion pump vulnerabilities that your team identified, what other medical device security concerns should be top of mind for the healthcare sector right now or other connected devices, even if they're not medical devices, for that matter? It's not completely unique, but somewhat unique to the medical industry is we have this state where we're still using really old technology.
And when I say really old, I mean things as far back as, you know, 2005, 2008. That era of technology is still being used today in hospitals. And what's unfortunate about that is we haven't always been a security mindset as we have today. And also some of the technology wasn't there.
So it's just some of the things that we consider standard on our personal PCs, for example, just what we considered default to be encrypted when we're using the internet is not always the case in the medical field. In fact, you know, looking back at the research we just did on the B-Brom pump, one of our findings was that the traffic is not being encrypted, right? And these are things that we're used to just now being a standard in our everyday computing. And one of the reasons why we're finding these is because these hospitals are using older technology.
In fact, the pump that we did research on is from 2017. And so again, that's still very, very relevant because they're very much still in use today. And that's part of the problem. And that also plagues some of the other industries as well.
ICS is plagued from that same thing. And part of that issue is, and I don't want to put it all on the vendors, right? Because some of it is it's hard to patch these devices. And we have to figure out a solution to the costly thing to do.
It can cost these hospitals sometimes literally upwards of $20 plus million just to fix one of these issues. And so it has to be a balance between cost, what the vendor can provide, older technology can't always do the things that new technology can, and then obviously security. So I would say the use of old technology is something that is still being plagued across the medical industry and several others as well. Well, thank you, Douglas.
I've been speaking to Douglas McKee. I'm Marianne Kolbacek-McGee of Information Security Media Group. Thanks for joining us.