Ripple20 Threatens Increasingly Connected Medical Devices

A series of IoT vulnerabilities could put hospital networks, medical data, and patient safety at risk.

Earlier this month, JSOF security researchers disclosed the Ripple20 vulnerabilities, a series of flaws affecting connected devices in the enterprise, industrial, and healthcare industries. Experts worry about the implications for connected medical devices, which could provide attackers with a gateway into a hospital network or enable them to affect patient care.
Ripple20 exists in a low-level TCP/IP software library built by software company Treck. Many IoT device manufacturers build the library directly into their devices or integrate it through embedded third-party components. As a result, organizations may not know theyre exposed.
These vulnerabilities range in severity from small bugs with subtle effects to major flaws that could enable denial of service or information disclosure. Two of them could lead to remote code execution and allow a successful attacker to assume control over a target device. While an attacker would need to be on the network to exploit most of the Ripple20 vulnerabilities, this usually isnt difficult because many connected devices are often connected to the Internet by mistake.
Healthcare is particularly susceptible to
Ripple20
, report researchers with CyberMDX who aided JSOF in the investigation by helping to profile devices and identify exposure. Among the devices confirmed vulnerable are Baxter infusion pumps in the Sigma series, some B. Braun infusion pumps, a variety of Carestream products, some Schneider/APC UPS devices; some Digi network tools, some HP printers, and some Ricoh printers, all of which may put hospitals at risk.
Inside hospitals we saw all kinds of affected devices, says Elad Luz, head of research with CyberMDX. Nonmedical devices such as network switches and printers, while not directly connected to patient health, are still critical to the workflow of providing medical care.
The Ripple20 vulnerabilities potential for manipulating the software of the device they run on, Luz explains. Most hospitals have a fleet of connected infusion pumps, for example, all of which have a user interface that lets care providers configure when functionality starts and stops. In a worst-case scenario, an attacker could interfere with the pumps capabilities and interrupt patient care; however, Luz points out that most attacks arent meant to cause physical harm.
People who target medical devices, like most cybercriminals, are usually motivated by money. Its more likely theyre planning to launch a ransomware attack or find medical records to sell on the black market. There, health data can fetch a higher price than credit card numbers because it cant be changed, Luz continues. Attackers may also seek to cause market manipulation by targeting a major healthcare organization with a cyberattack, he adds.
Vulnerabilities Plague Medical Devices
The security of connected
medical devices
is a growing concern as more of these products go online. Healthcare providers
are driven by
a need to treat a growing patient population, provide more telemedicine, and attempt to stem rising healthcare costs. Technology can help them do this; however, the integration of connected devices may also put patients and data at risk.
The reality we face is that medical devices can be in a hospital setting for 15 to 20 years, but new cybersecurity threats are emerging daily, said Rob Suárez, CISO at medical technology firm Becton, Dickinson and Company, in a panel held today on secured connected health. As cyberattacks continue to increase, many hospitals still lack a dedicated security expert, he said.
Medical devices are especially vulnerable compared with other IoT devices, PCs, and smartphones, Luz explains. Most of the connected medical products his team sees have a cybersecurity standard from 10 to 20 years ago, and they typically have different kinds of vulnerabilities. Many of these are design flaws, he adds. Medical devices may have poor means of authentication, connections for receiving telemetry, or managing and configuring the device.
The Ripple20 flaws are coding bugs and point to a problem in the software supply chain. In many cases, both inside and outside the healthcare field, companies receive a piece of software but dont know much about it. If you dont know what the product is built out of, when those components end up having vulnerabilities, you dont know where to look, Suárez said.
What Hospitals Can Do
Treck released a new version of its software library (6.0.1.67) to address the Ripple20 flaws; however, the company cant update devices directly. The company offers vendors a development kit for when they package network stacks for their products. Until they use it to develop product firmware updates, the devices cannot be updated.
For hospitals, the challenging part is finding those affected devices, says Luz. If youre responsible for security at a hospital with 10,000 connected products of different models and vendors, locating the vulnerable ones will be difficult.
Some medical devices require in-person updates, meaning the hospital would need a contract with the vendor to bring someone on-site to apply updates. This could prove tricky, he notes, as medical devices are critical and may not be available for updates at any time. Some vendors have a connection to the hospital and can automatically update affected machines remotely. Some may require a user to install an update.
Related Content:
Profile of the Post-Pandemic CISO
7 Must-Haves for a Rockin Red Team
How Enterprises Are Developing and Maintaining Secure Applications
University of California SF Pays Ransom After Medical Servers Hit

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that really bad day in cybersecurity. Click for
more information and to register
for this On-Demand event.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Ripple20 Threatens Increasingly Connected Medical Devices