Flaw in Medical Devices Vulnerable to KRACK Bug, May Expose Patients’ Records

Medical devices distributed worldwide by medical technology company Becton, Dickinson and Company (BD) were found vulnerable to Key Reinstallation AttaCKs (KRACK) that can expose patients’ records when exploited. While no confirmed attacks have been reported, KRACK can make the network traffic vulnerable to Man-in-The-Middle (MiTM) attacks. Such attacks can also be used to send out malicious network packets or disrupt regular medical IT-related operations through the Wi-Fi Protected Access II (WPA2) protocol.

BD posted an advisory that they are monitoring the situation regarding the disclosed set of vulnerabilities found in identified medical equipment that use the WPA2 protocol.Once exploited, threat actors will have the necessary credentials to access the wireless networks and decrypt the information exchanged by not only the medical equipment concerned, but also all other devices connected — such as smartphones and computers — to the wireless network. BD also noted that a successful exploit could allow an attacker to change patient records or cause major disruptions to everyday IT operations.

[Infosec Guide: Protecting networks against man-in-the-middle attacks]

While BD has deployed the necessary vendor patches through routine deployment, they also noted that the intrusion would require a high level of technical skill and would have to be within the proximity of the targeted wireless network. According to its website, BD has collaborations and technologies distributed in 50 countries involved in infectious diseases, cancer, medication management, and diabetes intervention and management.

WPA2 is a common protocol used to secure most modern wireless networks, with a weakness found in the four-way handshake, a process wherein new devices interact with a shared password to join a network. KRACK, which was discovered and confirmed in October 2017, may affect both personal and enterprise networks and systems, and gives an attacker a virtual skeleton key that allows access to any WPA2 network even without a password.

[Read: Wi-Fi on the go: How safe is it?]

Security researches have summarized and discussed WPA2 design vulnerabilities and the affected systems that can affect the network and endpoint users. Intrusions and threats can easily be mitigated by having a strategic security system in place:

• Regularly update and scan your endpoint and network security
• Check and apply patches from your vendors regularly
• Avoid connecting your mobile devices to public Wi-Fi connections