Vulnerability

BD maps its product line against the vulnerabilities Ryuk ransomware exploits

MedDevice Cyber Staff · Oct 30 · 3 min read · Via BD bulletin: Ryuk Ransomware

BD published a bulletin on October 30, 2020 on Ryuk ransomware attacks targeting healthcare facilities. Vulnerabilities dating to 2017 were being exploited to infect systems, and BD lists the products in scope.

The CVEs named are CVE-2018-12808, CVE-2017-0144, CVE-2018-8389, CVE-2018-20685, CVE-2019-6109 and, from a November 6, 2020 update, Zerologon CVE-2020-1472. The same update added BD Intelliport to the list.

Products in scope include Alaris Guardrails Suite MX and Alaris Systems Manager v4.x, v12.0.x and v12.1.x, Assurity Linc, BACTEC BOW, FX and FX40, DataLink, EpiCenter, FocalPoint servers and workstations, HealthSight, Kiestra, BD MAX, Phoenix M50, a long run of Pyxis products, Synapsys, Totalys, Veritor Connect NUC and Viper LT.

Ransomware crews did not need new bugs to hit hospitals in 2020. Three-year-old flaws on unpatched clinical workstations were enough, and that gap is the manufacturer's patch validation backlog as much as the hospital's.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

The Ryuk bulletin maps known, already-patched CVEs to BD products. Customers should confirm every listed BD system carries the vendor fixes for those CVEs under BD's validated guidance. Segment clinical systems so a ransomware foothold on the business network cannot reach them.

Close the listed CVEs. Verify each BD system has the fixes for CVE-2017-0144, CVE-2018-8389, CVE-2020-1472 and the other listed CVEs.
Segment clinical systems. Separate BD device networks from general IT so ransomware cannot spread laterally over SMB.
Keep offline backups. Back up BD server configurations and databases to storage ransomware cannot reach.
Shorten patch validation. Manufacturers should validate OS security updates on a fixed, short cycle.

For Device ManufacturersFix the class in the product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which BD products did the Ryuk ransomware bulletin cover?

BD's October 30, 2020 Ryuk ransomware bulletin lists Alaris Guardrails Suite MX, Alaris Systems Manager, Assurity Linc, BACTEC, DataLink, EpiCenter, FocalPoint, HealthSight, Kiestra, BD MAX, Phoenix M50, Pyxis products, Synapsys, Totalys, Veritor Connect NUC, Viper LT and, from November 6, 2020, Intelliport.

What vulnerabilities did BD list for Ryuk ransomware?

BD's October 30, 2020 Ryuk bulletin names CVE-2018-12808, CVE-2017-0144, CVE-2018-8389, CVE-2018-20685 and CVE-2019-6109, and a November 6, 2020 update added Zerologon CVE-2020-1472.

Why did BD publish a Ryuk ransomware bulletin in 2020?

BD published the bulletin on October 30, 2020 because Ryuk ransomware attacks were targeting healthcare facilities by exploiting vulnerabilities dating to 2017, and BD products ran software affected by those flaws.

← Back to Vulnerabilities