Vulnerability

BD Kiestra TLA, WCA and InoqulA+ database open through SMB1 and default credentials

MedDevice Cyber Staff · May 16 · 3 min read · Via BD bulletin: Potential Database Access for BD Kiestra TLA, BD Kiestra WCA, BD Kiestra InoqulA+

BD published a bulletin on May 16, 2017 for BD Kiestra TLA, WCA and InoqulA+. Affected versions are BD Kiestra database 3.0.61 and previous, PerformA 2.0.14.0 and previous, and KLA Journal Service 1.0.51 and previous.

The vulnerability could let an attacker access the Kiestra database and limited PHI and PII. BD names three causes: SMB1, default third-party database credentials and hardcoded application passwords. SMB1, a legacy Windows file-sharing protocol, was one of the three causes.

Default and hardcoded secrets are the same on every installed system, so one disclosure opens all of them. Lab automation that holds patient identifiers needs per-site credentials from day one.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

The May 16, 2017 bulletin covers Kiestra database 3.0.61, PerformA 2.0.14.0 and KLA Journal Service 1.0.51 and earlier. Labs should move to versions later than those and confirm with BD that default database credentials and hardcoded passwords are replaced. SMB1 should be off on every Kiestra host.

Upgrade past the listed versions. Move Kiestra database, PerformA and KLA Journal Service beyond 3.0.61, 2.0.14.0 and 1.0.51 respectively, through BD service.
Disable SMB1. Turn off SMB1 on all Kiestra workstations and servers and confirm nothing in the lab still depends on it.
Replace default database credentials. Have BD set site-unique credentials on the third-party database.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Patient or study database

Contributing

Handles patient data Off-the-shelf software

BD Kiestra TLA, WCA and InoqulA+

PID-3321 PID-41 Patient or study database Handles patient data Off-the-shelf software

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

What versions of BD Kiestra are affected by the 2017 database access vulnerability?

BD's May 16, 2017 bulletin lists BD Kiestra database 3.0.61 and previous, PerformA 2.0.14.0 and previous, and KLA Journal Service 1.0.51 and previous, used in BD Kiestra TLA, WCA and InoqulA+.

What caused the BD Kiestra database access vulnerability?

BD's May 16, 2017 bulletin attributes the BD Kiestra TLA, WCA and InoqulA+ database access issue to SMB1, default third-party database credentials and hardcoded application passwords, which could expose limited PHI and PII.

← Back to Vulnerabilities