Vulnerability

Beckman Coulter publishes WannaCry guidance for lab instruments missing MS17-010

MedDevice Cyber Staff · May 19 · 2 min read · Via Beckman Coulter Petya and WannaCry security information

Beckman Coulter posted a WannaCry ransomware update on May 19, 2017. WannaCry spread across networks worldwide by exploiting Windows systems lacking the MS17-010 patch, encrypting data and demanding ransom.

The affected list spans Access 2, UniCel DxI 600 and 800, the AU analyzers, PK7300, DxH 600 and 800, iQ200, AutoMate and Power Express automation, REMISOL, LabPro Information Manager and CellaVision DM systems, among others. Guidance sits on a combined Petya and WannaCry page, last updated July 13, 2023. Instruments that cannot take the Microsoft patch on the hospital's schedule need SMB blocked at the segment edge instead.

Are you a representative of Beckman Coulter? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

WannaCry hits Windows systems missing MS17-010. Apply the patch through Beckman Coulter's per-product guidance on its combined Petya and WannaCry page. Where an instrument cannot take it yet, block SMB to it.

Apply MS17-010 where validated. Install the Microsoft patch on each instrument as Beckman Coulter's per-product guidance allows.
Block SMB to the rest. Deny SMB traffic to instruments still waiting on a validated patch.
Review the combined page. Use Beckman Coulter's Petya and WannaCry page as the single reference for both threats.
Check backups of result data. Confirm instrument result data is backed up off the instrument in case encryption hits.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Contributing

Wired network Hospital network

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Which Beckman Coulter instruments are affected by WannaCry?

Beckman Coulter's May 19, 2017 update lists instruments including Access 2, UniCel DxI 600/800, AU analyzers, PK7300, DxH 600/800, iQ200, AutoMate, Power Express, REMISOL, LabPro Information Manager and CellaVision DM systems.

Why were lab instruments vulnerable to WannaCry in 2017?

WannaCry exploited Windows systems lacking the MS17-010 patch, as Beckman Coulter's May 19, 2017 update explains, and instrument computers that had not received that patch were exposed.

← Back to Vulnerabilities