Computer Viruses Are "Rampant" on Medical Devices in Hospitals

Jim Reisert AD1C <jjreisert@alum.mit.edu>

Wed, 17 Oct 2012 22:45:32 -0600

David Talbot, *Technology Review*, 17 Oct 2012

A meeting of government officials reveals that medical equipment is becoming
riddled with malware.

Computerized hospital equipment is increasingly vulnerable to malware
infections, according to participants in a recent government panel.  These
infections can clog patient-monitoring equipment and other software systems,
at times rendering the devices temporarily inoperable.

While no injuries have been reported, the malware problem at hospitals is
clearly rising nationwide, says Kevin Fu, a leading expert on medical-device
security and a computer scientist at the University of Michigan and the
University of Massachusetts, Amherst, who took part in the panel discussion.

Software-controlled medical equipment has become increasingly interconnected
in recent years, and many systems run on variants of Windows, a common
target for hackers elsewhere. The devices are usually connected to an
internal network that is itself connected to the Internet, and they are also
vulnerable to infections from laptops or other device brought into
hospitals. The problem is exacerbated by the fact that manufacturers often
will not allow their equipment to be modified, even to add security
features.

In a typical example, at Beth Israel Deaconess Medical Center in Boston, 664
pieces of medical equipment are running on older Windows operating systems
that manufactures will not modify or allow the hospital to change—even to
add antivirus software—because of disagreements over whether
modifications could run afoul of U.S. Food and Drug Administration
regulatory reviews, Fu says.

As a result, these computers are frequently infected with malware, and one
or two have to be taken offline each week for cleaning, says Mark Olson,
chief information security officer at Beth Israel.

http://www.technologyreview.com/news/429616/computer-viruses-are-rampant-on-medical-devices/

Jim Reisert AD1C, <jjreisert@alum.mit.edu>, http://www.ad1c.us