Chinese-Made Patient Monitor Contains a Secret Backdoor


A medical device used in hospitals has been found hosting a backdoor, paving the way for an unauthorized user to remotely control and tamper with the equipment.
The threat was discovered in three firmware versions for a patient monitor called the Contec CMS8000 (also sold as the Epsimed MN-120), which can display a user’s vitals, including heart rate, according to an advisory from the Cybersecurity and Infrastructure Security Agency (CISA).
The equipment, from China-based Contec Medical Systems, was mysteriously configured to connect to an IP address for a third-party university with no connection to the manufacturer.
The backdoor enables the IP address at the unnamed university to remotely download and execute unverified files on the patient monitor, CISA’s report says. In addition, the same backdoor automatically sends patient data to the IP address.
“Once the patient monitor is connected to the internet, it begins gathering patient data, including personally identifiable information (PII) and protected health information (PHI), and exfiltrating (withdrawing) the data outside of the health care delivery environment,” an advisory from the Food and Drug Administration adds.
It's unclear why the third-party university wasn't named. But CISA learned of the backdoor from an unnamed security researcher. The agency then tested the three firmware versions and noticed the “anomalous network traffic,” which the security researcher had flagged, and concluded the backdoor wasn’t a legitimate way to update the patient monitor.
“When the function is executed, files on the device are forcibly overwritten, preventing the end customer—such as a hospital—from maintaining awareness of what software is running on the device,” CISA says.
Contec didn’t immediately respond to a request for comment. But according to CISA, Contec itself supplied the firmware versions that the agency reviewed after it spotted the backdoor.
In the meantime, the federal agencies are advising health care providers to prevent the patient monitors from connecting to the internet. “This means unplugging the device’s Ethernet cable and disabling wireless (that is, Wi-Fi or cellular) capabilities, so that patient vital signs are only observed by a caregiver or health care provider in the physical presence of a patient,” CISA says. Otherwise, health care providers should stop using the patient monitors entirely.
The FDA says it's “not aware of any cybersecurity incidents, injuries, or deaths related to these cybersecurity vulnerabilities at this time.”
This is just a tiny part of the massive industrial espionage war China wages on Americans.
A nice little tool to sow chaos.
This is scary.