Vulnerability

Philips issues WannaCry guidance naming IntelliSpace Portal Workstation IX and Event Management

MedDevice Cyber Staff · May 15 · 2 min read · Via Philips security disclosure

Philips published advisory guidance on May 15, 2017 on the WannaCry ransomware campaign, naming IntelliSpace Portal Workstation IX (ISP IX) and IntelliSpace Event Management (IEM) in the notice. The company said the campaign, also tracked as Ransom-WannaCry, WCry, WanaCrypt and WanaCrypt0r, had hit more than 300,000 victims in roughly 150 countries.

WannaCry encrypts the computers it reaches and demands payment in Bitcoin. An imaging workstation and an event management server are networked computers on the clinical side of the hospital, so a campaign moving across whole organizations reaches them like any other host. The week of an outbreak is a bad time to start building the inventory of which clinical workstations are patched.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Locate every ISP IX and IEM host on the network and confirm it carries the protections Philips specifies for the WannaCry campaign. Keep these systems segmented from general office traffic so a ransomware outbreak elsewhere in the hospital cannot reach them directly.

Inventory the named hosts. Find every IntelliSpace Portal Workstation IX and IntelliSpace Event Management system and record its patch state.
Apply the Philips guidance. Follow the product-specific instructions in the Philips advisory before applying generic operating system fixes.
Segment clinical workstations. Restrict which networks can reach imaging and event management hosts so a worm on the office side stays there.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Contributing

Hospital network

IntelliSpace Portal Workstation IX

Hospital network

IntelliSpace Event Management

Hospital network

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
AutoSeg	Fujifilm Healthcare	Same FDA device type	No feedback feed from manufacturer
ViewPoint 6	GE HealthCare	Same FDA device type	No feedback feed from manufacturer
CUPTIMIZE Advanced	Johnson & Johnson MedTech	Same FDA device type	No feedback feed from manufacturer
MIM - Additional Tracers	MIM Software	Same FDA device type	No feedback feed from manufacturer
syngo Application Software	Siemens Healthineers	Same FDA device type	No feedback feed from manufacturer
syngo Application Software	Siemens Healthineers	Same FDA device type	No feedback feed from manufacturer
syngo.via View&GO	Siemens Healthineers	Same FDA device type	No feedback feed from manufacturer
Assert-IQ Insertable Cardiac Monitor	Abbott	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
FreeStyle Libre 3 Continuous Glucose Monitoring System	Abbott	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
SafeOp 2: Neural Informatix System	Alphatec Spine	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
LabPro Data Management System	Beckman Coulter	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
iLab Polaris Multi-Modality Guidance System	Boston Scientific	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
DRX - Compass	Carestream Health	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Xpert C. difficile/Epi	Cepheid	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Stelo Glucose Biosensor System	DexCom	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer

16 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

Which Philips products were named in the May 2017 WannaCry advisory?

Philips named IntelliSpace Portal Workstation IX (ISP IX) and IntelliSpace Event Management (IEM) in its WannaCry guidance published on May 15, 2017.

What did Philips say about the WannaCry ransomware campaign in 2017?

In its May 15, 2017 guidance, Philips said WannaCry had attacked more than 300,000 victims in about 150 countries, encrypting computers and demanding payment in Bitcoin.

← Back to Vulnerabilities