Vulnerability

Beckman Coulter issues per-instrument guidance as Petya ransomware spreads through EternalBlue

MedDevice Cyber Staff · Jun 28 · 3 min read · Via Beckman Coulter Petya and WannaCry security information

Beckman Coulter published a Petya ransomware update on June 28, 2017, a day after the malware appeared on June 27. Petya spreads through the EternalBlue SMBv1 exploit, encrypts NTFS file tables and overwrites the boot record.

The update covers a long instrument list, including Access 2, UniCel DxI 600 and 800, the AU480, AU640, AU680, AU2700, AU5400 and AU5800, DxH 600 and 800 with DxH SMS, the AutoMate lines, REMISOL, DxONE Command Central, LabPro Information Manager, the WalkAway-40/96 SI and plus, and CellaVision DM1200, DM96 and DM9600. For each, Beckman Coulter gives firewall, isolation, patch or contact-service guidance. The page was last updated on July 13, 2023.

Restoring an instrument whose boot record was overwritten means a full reimage, so isolation is the guidance to act on first.

Are you a representative of Beckman Coulter? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Petya reaches Windows-based instruments through EternalBlue over SMBv1. Follow Beckman Coulter's per-instrument guidance: firewall, isolate, patch or call service. Isolation is the fastest control while patches are validated.

Isolate exposed instruments. Block SMB to listed Beckman Coulter instruments at the lab segment edge right away.
Apply per-product guidance. Match each instrument to its Petya entry and apply the stated firewall, patch or service action.
Keep reimage media ready. Confirm Beckman Coulter can restore an instrument whose boot record is overwritten, and how long that takes.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Contributing

Wired network Hospital network

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

How does Petya ransomware spread to Beckman Coulter instruments?

Beckman Coulter's June 28, 2017 update says Petya spreads via the EternalBlue SMBv1 exploit, encrypting NTFS file tables and overwriting the boot record of Windows systems.

What does Beckman Coulter recommend against Petya?

In its June 28, 2017 update, Beckman Coulter gives per-product firewall, isolation, patch or contact-service guidance for instruments including Access 2, UniCel DxI, AU analyzers, DxH, AutoMate and CellaVision DM systems.

← Back to Vulnerabilities