News

Security Researchers Find Nearly Dozen Holes in GE Ultrasound Machines

• By Gladys Rama
• 05/28/2024

A line of ultrasound machines produced by GE HealthCare, the leading ultrasound OEM by market share, has been found to be susceptible to ransomware attacks and patient data compromise.

Researchers at IoT security firm Nozomi recently published a report identifying 11 vulnerabilities in GE's Vivid Ultrasound family of devices. "The impacts enabled by these flaws are manifold: from the implant of ransomware on the ultrasound machine to the access and manipulation of patient data stored on the vulnerable devices," the researchers wrote.

Nozomi focused its report on the Vivid T9 ultrasound device, which is designed primarily for cardiac ultrasound imaging. Each Vivid T9 device comprises a desktop running Windows 10 IoT; a native keyboard and trackpad; Common Service Desktop, a Web interface for performing administrative tasks; and EchoPac, the software used by clinicians to review ultrasound images.

The flaws Nozomi found leverage all of these components, resulting in multiple avenues for attackers to perform arbitrary code execution with administrative privileges. Bad actors with physical access to a Vivid T9 device can execute attacks, either by directly interacting with it or by attaching a thumb drive that emulates the keyboard, but they can also execute attacks over the local network.

The attacks, Nozomi argued, can result in either ransomware or harm to patient data. In terms of ransomware, the researchers wrote:

[W]e successfully verified the ability to lock the Vivid T9 by means of a proof-of-concept ransomware. After physically accessing the device and removing all Windows security protections (which was possible due to the full privileges obtained), we were able to disrupt the device logic while simultaneously showing a picture on the screen asking for the payment of a ransom. ... A similar payload may also be executed against a doctor’s workstation running Echopac.

Regarding harm to patient data, Nozomi explained the attack method this way:

[H]aving achieved code execution with full privileges on a target system, nothing can stop an attacker from accessing and even manipulating all patient data stored on it. For instance, when considering Echopac, all patient data is stored in the companion SQL Anywhere. These databases can be easily accessed after exfiltrating and loading the file in a compatible client...or, even more simply, by sending SQL commands to the exposed network port.

The following are the 11 vulnerabilities identified by Nozomi:

GE has updated its product security portal with guidance for many of the above vulnerabilities, as well as a comprehensive lists of affected machines.

To prevent the attacks described, Nozomi encouraged organizations to avoid leaving Vivid ultrasound machines unattended "even for a short period of time," and to practice good network security hygiene -- for instance, by limiting network activity to only what's essential.

Specifically for machines with EchoPac installed, the researchers suggested "[blocking] incoming connections via firewall to SMB and 2638/tcp (SQL Anywhere DB server port) when the workstation is connected to an unprotected network."