Vulnerability

BD Kiestra service credential surfaced in a public file-analysis report

MedDevice Cyber Staff · Apr 24 · 2 min read · Via BD bulletin: BD Kiestra - Temporary Exposure of a Service Credential Not Used by Customers

BD disclosed on April 24, 2023 that a service credential for BD Kiestra TLA, WCA and ReadA systems with SCU was temporarily public. The credential is used only by BD personnel and surfaced in a report generated by a publicly available file-analysis service.

BD had the report removed and found no evidence that the credential was viewed or accessed. Public analysis services keep what gets submitted, so a file uploaded for a quick malware check can publish the secrets inside it. Scrub files before they leave the building, and rotate any credential that ever touched one of those services.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD had the exposing report removed and found no evidence of access, per its April 24, 2023 bulletin. The credential is not used by customers, so there is no customer patch step in the bulletin. Labs should confirm with BD that the service credential on their Kiestra systems has been changed and keep remote service paths restricted.

Ask BD about rotation. Confirm with BD service that the exposed credential no longer works on your Kiestra TLA, WCA or ReadA with SCU.
Restrict service access. Allow BD service connections to Kiestra systems only through a controlled, logged remote access path.
Scrub before you submit. Strip credentials and configuration from files before sending them to any public analysis service.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Contributing

User accounts

BD Kiestra TLA, WCA and ReadA with SCU

User accounts

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

What happened with the BD Kiestra service credential in 2023?

On April 24, 2023 BD disclosed that a BD Kiestra service credential, used only by BD personnel on Kiestra TLA, WCA and ReadA with SCU, was temporarily public through a report from a publicly available file-analysis service. BD had the report removed.

Was the exposed BD Kiestra credential used by attackers?

BD's April 24, 2023 bulletin says it found no evidence that the exposed BD Kiestra service credential was viewed or accessed.

← Back to Vulnerabilities