The pneumatic tube systems (PTS) used by hospitals to deliver vital medications, blood samples, and lab products to multiple departments have a security problem.
At Black Hat, Ben Seri and Barak Hadad from security firm Armis revealed critical vulnerabilities in a system used by thousands of hospitals in North America, and detailed why it's important to keep a close eye on operating systems that may look unimportant but power critical infrastructure like healthcare facilities.
What Are Pneumatic Tubes?
Pressurized tube networks have been used for decades. Before we all started using the internet, PTS were used by workers in various industries to transport mail and other documents.
Hospitals still use pneumatic tubes on a regular basis to send medicine, samples, and files from one part of the hospital to another. It all sounds very low-tech, but it’s a pretty advanced system with remote system monitoring using internet connectivity.
“It’s critical infrastructure, but it isn’t being researched,” Seri said.
Can It Play Doom?
Swisslog TransLogic Devices provides the TransLogic Pneumatic Tube System that's used by more than 2,300 hospitals in North America and 3,000 hospitals worldwide. It's managed over Ethernet by a central server. But that central server is a Windows device connected to the internet, which is where attackers are most likely to strike.
During their Black Hat presentation today, Seri and Hadad showed how they hacked into the TransLogic system with just a few keystrokes and even installed the game Doom on the medical console. Ultimately, the pair found nine vulnerabilities in the TransLogic system and informed Swisslog about them in May 2021. Going forward, they're working with Swisslog to patch and test for new vulnerabilities.
It turns out there are plenty of exploits for a determined malicious hacker to use against a hospital system. Seri and Hadad, for example, uncovered hardcoded passwords, privilege escalation, and non-secure firmware, all of which could be exploited without any user interaction via unauthenticated network packets.
What's the Worst That Could Happen?
There are a lot of things that can go wrong if bad actors target vulnerable hospital systems. Attackers could carry out denial-of-service attacks on the PTS network, and they could access and leak staff and patient information. In extreme cases, bad actors could use ransomware to paralyze the hospital system.
Seri concluded the presentation by reiterating his point that more research needs to be done on these hybrid systems that mix old tech like pneumatic tubes with new upgrades like internet access. PTS are critical infrastructure, as are elevators and the electric grid, and should be researched and secured before malicious attackers strike.
Keep reading PCMag for more Black Hat coverage.Black Hat coverage.