DHS issues hacking warning for Medtronic implantable devices and monitors

1. EXECUTIVE SUMMARY

• CVSS v9.3 
• ATTENTION: Exploitable with adjacent access/low skill level to exploit
• Vendor: Medtronic
• Equipment: MyCareLink Monitor, CareLink Monitor, CareLink 2090 Programmer, specific Medtronic implanted cardiac devices listed below
• Vulnerabilities: Improper Access Control, Cleartext Transmission of Sensitive Information

2. RISK EVALUATION

Successful exploitation of these vulnerabilities may allow an attacker with adjacent short-range access to one of the affected products to interfere with, generate, modify, or intercept the radio frequency (RF) communication of the Medtronic proprietary Conexus telemetry system, potentially impacting product functionality and/or allowing access to transmitted sensitive data. Successful exploitation requires: (1) an RF device capable of transmitting or receiving Conexus telemetry communication, such as a monitor, programmer, or software-defined radio (SDR); (2) to have adjacent short-range access to the affected products; and (3) for the products to be in states where the RF functionality is active. Before the device implant procedure and during follow-up clinic visits, the Conexus telemetry sessions require initiation by an inductive protocol. Outside of these use environments, the RF radio in the affected implanted device is enabled for brief periods of time to support scheduled follow-up transmissions and other operational and safety notifications. The result of successful exploitation of these vulnerabilities may include the ability to read and write any valid memory location on the affected implanted device and therefore impact the intended function of the device.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following products and versions of Medtronic devices utilizing the Conexus telemetry protocol are affected:

• MyCareLink Monitor, Versions 24950 and 24952,
• CareLink Monitor, Version 2490C,
• CareLink 2090 Programmer,
• Amplia CRT-D (all models),
• Claria CRT-D (all models),
• Compia CRT-D (all models),
• Concerto CRT-D (all models),
• Concerto II CRT-D (all models),
• Consulta CRT-D (all models),
• Evera ICD (all models),
• Maximo II CRT-D and ICD (all models),
• Mirro ICD (all models),
• Nayamed ND ICD (all models),
• Primo ICD (all models),
• Protecta ICD and CRT-D (all models),
• Secura ICD (all models),
• Virtuoso ICD (all models),
• Virtuoso II ICD (all models),
• Visia AF ICD (all models), and
• Viva CRT-D (all models).

3.2 VULNERABILITY OVERVIEW

3.2.1    IMPROPER ACCESS CONTROL CWE-284

The Conexus telemetry protocol utilized within this ecosystem does not implement authentication or authorization. An attacker with adjacent short-range access to an affected product, in situations where the product’s radio is turned on, can inject, replay, modify, and/or intercept data within the telemetry communication. This communication protocol provides the ability to read and write memory values to affected implanted cardiac devices; therefore, an attacker could exploit this communication protocol to change memory in the implanted cardiac device.

CVE-2019-6538 has been assigned to this vulnerability. A CVSS v3 base score of 9.3 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H).

3.2.2    CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319

The Conexus telemetry protocol utilized within this ecosystem does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.

CVE-2019-6540 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Ireland

3.4 RESEARCHER

Peter Morgan of Clever Security; Dave Singelée and Bart Preneel of KU Leuven; Eduard Marin formerly of KU Leuven, currently with University of Birmingham; Flavio D. Garcia; Tom Chothia of the University of Birmingham; and Rik Willems of University Hospital Gasthuisberg Leuven reported these vulnerabilities to NCCIC.

4. MITIGATIONS

Medtronic has applied additional controls for monitoring and responding to improper use of the Conexus telemetry protocol by the affected implanted cardiac devices. Additional mitigations are being developed and will be deployed through future updates, assuming regulatory approval.
Medtronic recommends that users take additional defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:

• Maintain good physical control over home monitors and programmers.
• Use only home monitors, programmers, and implantable devices obtained directly from your healthcare provider or a Medtronic representative to ensure integrity of the system.
• Do not connect unapproved devices to home monitors and programmers through USB ports or other physical connections.
• Only use programmers to connect and interact with implanted devices in physically controlled hospital and clinical environments.
• Only use home monitors in private environments such as a home, apartment, or otherwise physically controlled environment.
• Report any concerning behavior regarding these products to your healthcare provider or a Medtronic representative.

Medtronic has released additional patient-focused information at the following location:

https://www.medtronic.com/security

NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

• Restrict system access to authorized personnel only and follow a least privilege approach.
• Apply defense-in-depth strategies.
• Disable unnecessary accounts and services.
• Where additional information is needed,  refer to existing cybersecurity in medical device guidance issued by the FDA that can be found at the following location:

https://www.fda.gov/MedicalDevices/DigitalHealth/ucm373213.htm

NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.

No known public exploits specifically target these vulnerabilities. These vulnerabilities require adjacent short-range access to the affected devices to be exploited.