‘PwnedPiper’: Devastating Bugs in >80% of Hospital Pneumatics

[silversurfer]

Researchers have discovered nine vulnerabilities – collectively dubbed PwnedPiper – in the pneumatic tube systems (PTS) used in more than 80 percent of major hospitals in North America.
 
The bugs, in Swisslog Healthcare’s Translogic PTS, include hard-coded passwords, unencrypted connections and unauthenticated firmware updates that could lead to remote code execution (RCE). The flaws could give an unauthenticated attacker root control and could let bad actors take over Nexus stations.
 
The nine critical vulnerabilities are in the Nexus Control Panel, which powers all current models of Translogic pneumatic tube system (PTS) stations sold by Swisslog Healthcare. “All current firmware versions of this device are susceptible to these vulnerabilities,” Armis researchers said.
 
After an attacker hijacks a Nexus station, it’s all downhill from there, as Armis reported on Monday, with potential ransomware attacks in the mix. “By compromising a Nexus station, an attacker can leverage it for reconnaissance purposes, including harvesting data from the station, such as RFID credentials of any employee that uses the PTS system, details about each station’s functions or location, as well as gain an understanding of the physical layout of the PTS network,” Armis said in a release. “From there, an attacker can take over all Nexus stations in the tube network, and hold them hostage in a sophisticated ransomware attack.”

Read more: ‘PwnedPiper’: Devastating Bugs in >80% of Hospital Pneumatics | Threatpost