FDA informs patients, providers and manufacturers about potential cybersecurity vulnerabilities for connected medical devices and health care networks that use certain communication software

 

Silver Spring, MD, USA (October 1, 2019) — Today, the U.S. Food and Drug Administration is informing patients, health care professionals, IT staff in health care facilities and manufacturers of a set of cybersecurity vulnerabilities, referred to as “URGENT/11,” that—if exploited by a remote attacker—may introduce risks for medical devices and hospital networks. URGENT/11 affects several operating systems that may then impact certain medical devices connected to a communications network, such as wi-fi and public or home Internet, as well as other connected equipment such as routers, connected phones and other critical infrastructure equipment. These cybersecurity vulnerabilities may allow a remote user to take control of a medical device and change its function, cause denial of service, or cause information leaks or logical flaws, which may prevent a device from functioning properly or at all.

To date, the FDA has not received any adverse event reports associated with these vulnerabilities. The public was first informed of these vulnerabilities in a July 2019 advisory sent by the Department of Homeland Security. Today, the FDA is providing additional information regarding the source of these vulnerabilities and recommendations for reducing or avoiding risks the vulnerabilities may pose to certain medical devices.

“While advanced devices can offer safer, more convenient and timely health care delivery, a medical device connected to a communications network could have cybersecurity vulnerabilities that could be exploited resulting in patient harm,” said Amy Abernethy, M.D., Ph.D., FDA’s principal deputy commissioner. “The FDA urges manufacturers everywhere to remain vigilant about their medical products—to monitor and assess cybersecurity vulnerability risks, and to be proactive about disclosing vulnerabilities and mitigations to address them. This is a cornerstone of the FDA’s efforts to work with manufacturers, health care delivery organizations, security researchers, other government agencies and patients to develop and implement solutions to address cybersecurity issues that affect medical devices in order to keep patients safe.”

The URGENT/11 vulnerabilities exist in a third-party software, called IPnet, that computers use to communicate with each other over a network. This software is part of several operating systems and may be incorporated into other software applications, equipment and systems. The software may be used in a wide range of medical and industrial devices. Though the IPnet software may no longer be supported by the original software vendor, some manufacturers have a license that allows them to continue to use it without support. Therefore, the software may be incorporated into a variety of medical and industrial devices that are still in use today.

Security researchers, manufacturers and the FDA are aware that the following operating systems are affected, but the vulnerability may not be included in all versions of these operating systems:

  • VxWorks (by Wind River)
  • Operating System Embedded (OSE) (by ENEA)
  • INTEGRITY (by GreenHills)
  • ThreadX (by Microsoft)
  • ITRON (by TRON)
  • ZebOS (by IP Infusion)

 

The agency is asking manufacturers to work with health care providers to determine which medical devices, either in their health care facility or used by their patients, could be affected by URGENT/11 and develop risk mitigation plans. Patients should talk to their health care providers to determine if their medical device could be affected and to seek help right away if they notice the functionality of their device has changed.

The FDA takes reports of vulnerabilities in medical devices very seriously and today’s safety communication includes recommendations to manufacturers for continued monitoring, reporting and remediation of medical device cybersecurity vulnerabilities. The FDA is recommending that manufacturers conduct a risk assessment, as described in the FDA’s cybersecurity postmarket guidance, to evaluate the impact of these vulnerabilities on medical devices they manufacture and develop risk mitigation plans. Medical device manufacturers should work with operating system vendors to identify available patches and other recommended mitigation methods, work with health care providers to determine any medical devices that could potentially be affected, and discuss ways to reduce associated risks.

Some medical device manufacturers are already actively assessing which devices may be affected by URGENT/11 and are identifying risk and remediation actions. In addition, several manufacturers have already proactively notified customers of affected products, which include medical devices such as an imaging system, an infusion pump and an anesthesia machine. The FDA expects that additional medical devices with one or more of the cybersecurity vulnerabilities will be identified.

“While we are not aware of patients who may have been harmed by this particular cybersecurity vulnerability, the risk of patient harm if such a vulnerability were left unaddressed could be significant,” said Suzanne Schwartz, M.D., MBA, deputy director of the Office of Strategic Partnerships and Technology Innovation in the FDA’s Center for Devices and Radiological Health. “The safety communication issued today contains recommendations for what actions patients, health care providers and manufacturers should take to reduce the risk this vulnerability could pose. It’s important for manufacturers to be aware that the nature of these vulnerabilities allows the attack to occur undetected and without user interaction. Because an attack may be interpreted by the device as a normal network communication, it may remain invisible to security measures.”

The FDA will continue its work with manufacturers and health care delivery organizations—as well as security researchers and other government agencies—to help develop and implement solutions to address cybersecurity issues throughout a device’s total product lifecycle.

The FDA will continue to assess new information concerning the URGENT/11 vulnerabilities and will keep the public informed if significant new information becomes available.

The FDA, an agency within the U.S. Department of Health and Human Services, protects the public health by assuring the safety, effectiveness, and security of human and veterinary drugs, vaccines and other biological products for human use, and medical devices. The agency also is responsible for the safety and security of our nation’s food supply, cosmetics, dietary supplements, products that give off electronic radiation, and for regulating tobacco products.

 


U.S. Food and Drug Administration, 01.10.2019 (tB).

Schlagwörter: ,

MEDICAL NEWS

IU School of Medicine researchers develop blood test for anxiety
COVID-19 pandemic increased rates and severity of depression, whether people…
COVID-19: Bacterial co-infection is a major risk factor for death,…
Regenstrief-led study shows enhanced spiritual care improves well-being of ICU…
Hidden bacteria presents a substantial risk of antimicrobial resistance in…

SCHMERZ PAINCARE

Hydromorphon Aristo® long ist das führende Präferenzpräparat bei Tumorschmerz
Sorgen und Versorgen – Schmerzmedizin konkret: „Sorge als identitätsstiftendes Element…
Problem Schmerzmittelkonsum
Post-Covid und Muskelschmerz
Kopfschmerz bei Übergebrauch von Schmerz- oder Migränemitteln

DIABETES

Wie das Dexom G7 abstrakte Zahlen mit Farben greifbar macht…
Diabetes mellitus: eine der großen Volkskrankheiten im Blickpunkt der Schmerzmedizin
Suliqua®: Einfacher hin zu einer guten glykämischen Kontrolle
Menschen mit Diabetes während der Corona-Pandemie unterversorgt? Studie zeigt auffällige…
Suliqua® zur Therapieoptimierung bei unzureichender BOT

ERNÄHRUNG

Positiver Effekt der grünen Mittelmeerdiät auf die Aorta
Natriumaufnahme und Herz-Kreislaufrisiko
Tierwohl-Fleisch aus Deutschland nur mäßig attraktiv in anderen Ländern
Diät: Gehirn verstärkt Signal an Hungersynapsen
Süßigkeiten verändern unser Gehirn

ONKOLOGIE

Strahlentherapie ist oft ebenso effizient wie die OP: Neues vom…
Zanubrutinib bei chronischer lymphatischer Leukämie: Zusatznutzen für bestimmte Betroffene
Eileiter-Entfernung als Vorbeugung gegen Eierstockkrebs akzeptiert
Antibiotika als Störfaktor bei CAR-T-Zell-Therapie
Bauchspeicheldrüsenkrebs: Spezielle Diät kann Erfolg der Chemotherapie beeinflussen

MULTIPLE SKLEROSE

Multiple Sklerose: Aktuelle Immunmodulatoren im Vergleich
Neuer Biomarker für Verlauf von Multipler Sklerose
Multiple Sklerose: Analysen aus Münster erhärten Verdacht gegen das Epstein-Barr-Virus
Aktuelle Daten zu Novartis Ofatumumab und Siponimod bestätigen Vorteil des…
Multiple Sklerose durch das Epstein-Barr-Virus – kommt die MS-Impfung?

PARKINSON

Meilenstein in der Parkinson-Forschung: Neuer Alpha-Synuclein-Test entdeckt die Nervenerkrankung vor…
Neue Erkenntnisse für die Parkinson-Therapie
Cochrane Review: Bewegung hilft, die Schwere von Bewegungssymptomen bei Parkinson…
Technische Innovationen für eine maßgeschneiderte Parkinson-Diagnostik und Therapie
Biomarker und Gene: neue Chancen und Herausforderungen für die Parkinson-Diagnose…