Default credentials, weak passwords, IT misconfigurations and a variety of other security shortcomings are exposing millions of medical devices and their data on the internet, said Soufian El Yadmani, CEO and co-founder of Modat, who shared recent research findings.
In some cases, the devices are set with “easy” passwords to streamline access for busy doctors, nurses and other clinicians who must move from patient to patient or task to task very quickly and very often, he said.
But with these kinds of security inadequacies, “that’s where the problem becomes bigger and bigger, because any attackers or hackers can actually get into these systems without even spending too much time trying to exploit vulnerabilities,” he said.
“That’s where the damage could be very, very big,” he said in an interview with Information Security Media Group.
The variety of medical devices and IT systems Modat found exposed was wide, he said. “That includes MRI scans, X-ray systems, systems used by opticians, systems used by dentists, all kinds of systems,” he said.
Modat’s research examined a set of about 70 of products, but looking ahead, will extend the list of IT systems and gear that company will study, which will undoubtedly result in discovering many more exposed devices and IT systems, he said.
“We believe that there are more and more systems that are being used within the healthcare industry that actually need to be monitored and more and more devices that are actually also exposed to the internet.”
In this audio interview with Information Security Media Group (see audio link below photo), El Yadmani also discussed:
- The kinds of data these improperly secured medical devices are exposing;
- The types of data compromises and other risks posed by medical devices that are exposed on the internet;
- Critical steps healthcare security and biomedical teams should take to avoid these types of medical device exposures on the web.
El Yadmani is a researcher, ethical hacker and entrepreneur. In 2024, he co-founded cybersecurity company Modat, where he now serves as CEO. Soufian is also the head of research at CSIRT.global, and a Ph.D. researcher at Leiden University, where he focuses on threat actor attribution and hacking automation. He is a frequent speaker at international conferences.