Customer Support
Publication Date: September 11, 2017
Update Date: September 11, 2017
Philips is releasing this advisory, confirming the findings of a customer submitted report that identified two vulnerabilities in the Philips’ IntelliVue MX40 Patient Worn Monitor for use with wireless local area networks (WLAN). Philips has produced a software update that fixes one of the identified vulnerabilities and provides mitigations for the other vulnerability. Philips is planning to release an additional software update in 2017 to address the remaining vulnerability.
Philips has received no reports of incidents from clinical use that we have been able to associate with this problem.
Partial Re-Association to Central Monitor [Improper Cleanup on Thrown Exception]:
Under specific 802.11 network conditions, a partial re-association of the MX40 Patient Worn Monitor (WLAN) to a compatible central monitoring system (Information Center”) is possible. In this state, although the Information Center provides a visible and audible “No Data Tele” INOP alert, the MX40 WLAN itself enters telemetry mode, i.e., its screen turns off in one minute and local alarming is disabled.
This potential issue was addressed with an IntelliVue MX40 software update (version B.06.18) issued in March 2017, which has been verified in mitigating the impact of network conditions on the device, and to ensure correct operation, messaging and alarm functions.
Wi-Fi Access Point (AP) “Blacklisting” [Improper Handling of Exceptional Conditions]:
Several specific 802.11 Wi-Fi network management instructions might not de-authenticate (disconnect) the MX40 from the access point (AP) without also placing the AP on a security AP blacklist to block or prevent further use of the AP without intervention by staff. While AP blacklisting from the MX40 is an intended security feature of MX40 in response to certain Wi-Fi management messages, several Wi-Fi messages have been identified to invoke AP blacklisting when not required and could be invoked either by environmental Wi-Fi network conditions or a crafted script.
This issue is mitigated by MX40 design and software update B.06.18 whereby MX40 switches into local mode with messaging and alarming on the local device and at the Central Station, thus alerting hospital staff when MX40 disconnects from the AP and disassociates from central. While mitigated, Philips recognizes the potential gap and concern and will release an MX40 software update targeted within 2017 to correct the intended alignment between Wi-Fi management messages and security blacklisting of the AP.
To date, the necessary network conditions for both issues (partial re-association, AP blacklisting) have only been found during system testing by a customer and Philips. Nonetheless, if either of the issues occurred while monitoring a patient, it could result to a delay in treatment. Philips therefore recommends customers update to MX40 software version B.06.18.
Under the terms of Philips’ Responsible Disclosure Policy, Philips worked with the customer and global and U.S. government agencies and related organizations to draft and distribute an advisory concerning this potential issue.
Publication Date: August 17, 2017
Update Date: August 17, 2017
Philips has confirmed the findings of a customer submitted complaint and vulnerability report that the Philips DoseWise Portal (DWP) application (version 1.1.7.333 and 2.1.1.3069) contains security vulnerabilities of hard-coded database credentials stored in clear text (unencrypted) within backend system files behind current production security defenses.
Philips has received no reports of exploitation of these vulnerabilities or incidents from clinical use that we have been able to associate with this problem.
For an attacker to use or exploit these vulnerabilities to access the underlying DWP database, elevated privileges are first required in order for an attacker to access the web application backend system files that contain the hard-coded credentials. Successful exploitation may allow a remote attacker to gain access to the database of the DoseWise Portal application which contains patient health information (PHI). Potential impact could include compromise of patient confidentiality, system integrity, and/or system availability.
The Philips DoseWise Portal (DWP) is a radiation dose management solution which simplifies the collection, analysis and interpretation of patient radiation dose metrics and acquisition parameters across x-ray medical imaging devices. DoseWise Portal captures, tracks, alerts and reports on patient radiation dose to support users to perform statistical analysis of imaging equipment radiation output. This to provide quantitative trends and statistics that users may use as input in planning and tracking dose management improvement activities. DWP is a standalone Class A software in accordance with IEC 62304, classified as a low-safety-risk medical device.
Philips is scheduled to release a new product version and supporting product documentation in August 2017.
- Ensure network security best practices are implemented and
- Block Port 1433, except where a separate SQL server is used.
Philips has notified all customers of the identified vulnerabilities and will coordinate with customers to schedule updates. Philips encourages users to only use Philips-validated and authorized changes for the DoseWise Portal system supported by Philips’ authorized personnel or under Philips’ explicit published directions for product patches, updates, or releases.
Customers with questions regarding their specific DoseWise Portal installations should contact their local Philips service support team or their regional service support.
Publication Date: August 17, 2017
Update Date: August 17, 2017
Philips has confirmed the findings of a customer submitted complaint and vulnerability report that the Philips DoseWise Portal (DWP) application (version 1.1.7.333 and 2.1.1.3069) contains security vulnerabilities of hard-coded database credentials stored in clear text (unencrypted) within backend system files behind current production security defenses.
Philips has received no reports of exploitation of these vulnerabilities or incidents from clinical use that we have been able to associate with this problem.
For an attacker to use or exploit these vulnerabilities to access the underlying DWP database, elevated privileges are first required in order for an attacker to access the web application backend system files that contain the hard-coded credentials. Successful exploitation may allow a remote attacker to gain access to the database of the DoseWise Portal application which contains patient health information (PHI). Potential impact could include compromise of patient confidentiality, system integrity, and/or system availability.
The Philips DoseWise Portal (DWP) is a radiation dose management solution which simplifies the collection, analysis and interpretation of patient radiation dose metrics and acquisition parameters across x-ray medical imaging devices. DoseWise Portal captures, tracks, alerts and reports on patient radiation dose to support users to perform statistical analysis of imaging equipment radiation output. This to provide quantitative trends and statistics that users may use as input in planning and tracking dose management improvement activities. DWP is a standalone Class A software in accordance with IEC 62304, classified as a low-safety-risk medical device.
Philips is scheduled to release a new product version and supporting product documentation in August 2017.
- Ensure network security best practices are implemented and
- Block Port 1433, except where a separate SQL server is used.
Philips has notified all customers of the identified vulnerabilities and will coordinate with customers to schedule updates. Philips encourages users to only use Philips-validated and authorized changes for the DoseWise Portal system supported by Philips’ authorized personnel or under Philips’ explicit published directions for product patches, updates, or releases.
Customers with questions regarding their specific DoseWise Portal installations should contact their local Philips service support team or their regional service support.
Publication Date: July 5, 2017
Update Date: July 5, 2017
ADVISORY / GENERAL GUIDANCE
Philips is aware the current malware campaign known as Petya (also known as NotPetya,
The vulnerability to this ransomware was identified and a patch was released by Microsoft on March 14, 2017 (MS17-010) for Microsoft supported versions of Windows (including WinVista, WinServer 2008, Win7, WinServer 2008 R2, Win 8.1, WinServer 2012, Win10, WinServer 2012 R2, and WinServer 2016). In further response specific to this ransomware outbreak, Microsoft also took extra steps to release updates for versions of Windows not under Microsoft mainstream support (including WinXP, Win8, and WinServer 2003).
Consistent with Philips Product Security Policy, our global network of product security officers and technical support teams are closely monitoring the situation and continue to take appropriate preventative measures. Philips will continue to work with our customer base to address this malware event and drive any product-specific or customer installation-specific preventative measures such as installation of the latest Microsoft Security Patches, Windows vulnerability containment steps, or other Philips-approved countermeasures as required on Philips products.
AFFECTED PRODUCTS
Select Philips products may be affected by the Microsoft vulnerability being exploited by the Petya malware. The potential for exploitability of any such vulnerability depends on the specific configuration and deployment environment of each product as well as adherence to the intended use of the product.
To date, Philips has not received any reports of Philips products or business operations being directly affected by this reported malware.
Preventative measures on Philips products should be implemented in accordance with Philips authorized steps or countermeasures defined and approved by Philips.
Customers entitled by
Philips highly recommends all customers with and without service contracts contact their local service support team or regional product service support to discuss any needed guidance, services, or questions regarding their specific products or installations. Customers who require general information on Philips Product Security may contact Philips Product Security at productsecurity@philips.com.
PRS/RSN Note:
For customers who utilize the Remote Services Network (RSN, PRS), all Philips RSN systems are fully protected against this vulnerability and customers are advised not to disconnect the PRS as it may impact Philips service teams from providing any required immediate and proactive support such as remote patching.
GENERAL GUIDANCE
The items below are offered as general guidance, are for general consideration only, and must be reviewed in alignment with any posted Philips Service Bulletin with Philips service support to ensure all defined testing and verification processes are followed within product specification and regulatory requirements.
Work with Philips services support to identify and review:
-Arrange for Philips service teams to apply any available Philips-approved patches or updates to your system per standard procedures.
-Consider implementing anti-virus access protection rules (Example: Per McAfee Guidance https://kc.mcafee.com/corporate/index?page=content&id=KB89540&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_US).
-Consider blocking SMB and RDP ports per Microsoft guidance.
-Consider disabling SMBv1 on our devices if authorized by Philips for your product.
Other General Points for Customer Awareness:
-Data, if and when available, should be backed up to a safe location with appropriate restoration procedures.
-Reinstall the system applications with at least one of the recommended actions to prevent re-infection to the device.
-Network segmentation will help prevent harm to the device as long as the SMB and RDP are not utilized and blocked.
SUPPORT OF MICROSOFT GENERAL RECOMMENDATIONS
On June 28th Microsoft posted their “Update on Petya malware attacks” which included Microsoft recommendations for Windows users to consider toward the identification, prevention, and mitigation of the risk of compromise from reported Windows vulnerabilities being exploited by Petya. The advisory included options for users to consider for deployment of Windows security updates and other changes to system configuration as potential countermeasures.
Philips is committed to ensuring the safety, security, integrity, and regulatory compliance of our products to be deployed and to operate within Philips approved product specifications. Therefore, in accordance with Philips policy and regulatory requirements, all changes of configuration or software to Philips products (including Windows security updates and patches) are implemented only in accordance with Philips product-specific, verified & validated, authorized, and communicated customer procedures or field actions.
Philips policy, the U.S. FDA post-market guidance, and other regulatory jurisdiction requirements state that all critical vulnerabilities must be assessed and mitigated. In the case of WannaCry and Petya, a number of Philips products are deployed with default security hardening that securely mitigates the risk of WannaCry and Petya vulnerabilities due to firewall configuration, closed ports, anti-virus/whitelisting, or other security features designed into the product architectures. In those specific cases, Philips will not require Windows security patching to mitigate against WannaCry or Petya threats since those products are not assessed to be vulnerable to exploit from WannaCry or Petya when deployed and operated within specification. Likewise, the same product-by-product assessment is made by Philips relative to other countermeasures like network port blocking that may be recommended by Microsoft but might not be applicable to all Philips products or product versions. Philips product teams therefore assess all published Windows critical vulnerabilities on a product-by-product basis routinely and document product vulnerability status into product MDS2 forms and vulnerability tables. If a product does require Microsoft security updates, configuration changes, or other actions to be taken by our customer or by Philips Customer Services, product-specific service documentation is produced by Philips product teams and made available to Philips service delivery platforms such as the Philips InCenter Customer Portal. Once posted by Philips product teams, all of these materials are accessible to contract-entitled customers, licensed representatives, and Philips Customer Service teams.
Customers entitled by service-contract to use Philips InCenter are encouraged to request and attain InCenter access and reference product-specific information posted on Philips InCenter. All customers with and without service contracts are encouraged to contact their local service support team or regional product service support as needed for current information specific to their products or Philips deployed installations as information becomes available.
Website Advisory on Worldwide Ransomware Outbreak (WannaCry, et. al.)
Publication Date: May 26, 2017
Update Date: May 26, 2017
ADVISORY / GENERAL GUIDANCE
Philips is aware of the current ransomware campaign known as WannaCry (also known as Ransom-WannaCry, WCry, WanaCrypt, and WanaCrypt0r) which has attacked a large number of organizations and over 300,000 victims around the world in approximately 150 countries. The malware encrypts (locks) computers and demands a payment in Bitcoins, according to information shared online by affected institutions. According to Microsoft, ransomware attacks have been observed to use common email phishing tactics with malicious attachments to infect devices. Once launched, the malware can further spread to adjacent systems on a network by exploiting a Windows vulnerability (in SMBv1). Further information on this Windows vulnerability can be found on the Microsoft website at Microsoft (MS) Customer Guidance for WannaCry Attacks.
The vulnerability to this ransomware was identified and a patch was released by Microsoft on March 14, 2017 (MS17-010) for Microsoft supported versions of Windows (including WinVista, WinServer 2008, Win7, WinServer 2008 R2, Win 8.1, WinServer 2012, Win10, WinServer 2012 R2, and WinServer 2016). In further response specific to this ransomware outbreak, Microsoft also has taken extra steps to release updates for versions of Windows not under Microsoft mainstream support (including WinXP, Win8, and WinServer 2003).
Consistent with Philips Product Security Policy, our global network of product security officers and technical support teams are closely monitoring the situation and continue to take appropriate preventative measures. Philips will continue to work with our customer base to address this malware event and drive any product-specific or customer installation-specific preventative measures such as installation of the latest Microsoft Security Patches, Windows vulnerability containment steps, or other Philips-approved countermeasures as required on Philips products.
INTENDED USE ADVISORY
Philips would like to advise our customers that neither use of an email client nor browsing the Internet is part of the intended use of any Philips product covered by this advisory. Philips products that are not listening on SMB ports (137, 138, 139, 445) or RDP port (3389) are not exposed to this Windows vulnerability provided the product is deployed within Philips product specifications and used in accordance with intended use of the product.
AFFECTED PRODUCTS
Select Philips products may be affected by the Microsoft vulnerability being exploited by the WannaCry ransomware. The potential for exploitability of any such vulnerability depends on the specific configuration and deployment environment of each product as well as adherence to the intended use of the product.
Preventative measures on Philips products currently affected by this MS Windows vulnerability (listed in the table below) should be implemented in accordance with Philips authorized steps or countermeasures defined and approved by Philips.
Customers entitled by service-contract to use the Philips InCenter Customer Portal are encouraged to request and attain InCenter access and reference product-specific information posted on Philips InCenter.
Philips highly recommends all customers with and without service contracts contact their local service support team or regional product service support to discuss any needed guidance, services, or questions regarding their specific product installations. Customers who require further general information on Philips Product Security may contact Philips Product Security at productsecurity@philips.com.
Philips Products |
Services Reference |
|
IS PACS (IntelliSpace Picture Archiving and Communication System):
|
Philips Managed Services
|
|
ISP IX (IntelliSpace Portal Workstation IX): Version: 6.0.2
|
ICAP0034
|
|
PIIC iX (IntelliVue Information Center): Version: PIIC iX A/B and PIIC Classic N.01
Version: PIIC Classic – L, M and N.0 (Out-of-Service, End-of-Support)
|
SB86202583A
SB86201939A |
|
IEM (IntelliSpace Event Management):
|
SB86202577A
|
Philips highly recommends all customers with and without service contracts contact their local service support team or regional product service support to discuss any needed guidance, services, or questions regarding their specific product installations. Supporting documentation is posted on the Philips InCenter Customer Portal. Customers who require further general information on Philips Product Security may contact Philips Product Security at productsecurity@philips.com.
Note:
For customers who utilize the Remote Services Network (RSN, PRS), all Philips RSN systems are fully protected against this vulnerability and customers are advised not to disconnect the PRS as it may impact Philips service teams from providing any required immediate and proactive support such as remote patching.
GENERAL GUIDANCE
The items below are offered as general guidance, are for general consideration only, and must be reviewed in alignment with any posted Philips Service Bulletin with Philips service support to ensure all defined testing and verification processes are followed within product specification and regulatory requirements.
Work with Philips services support to identify and review:
-Consider blocking SMB and RDP ports per Microsoft guidance.
-Consider disabling SMBv1 on our devices if unable to patch the systems.
-Arrange for Philips service teams to apply any available Philips-approved patches or updates to your system per standard procedures.
-Consider implementing anti-virus access protection rules (Example: Per McAfee Guidancehttps://kc.mcafee.com/corporate/index?page=content&id=KB89335&elqTrackId=080d6d6426f34a2fb9b7fae0ca16d59a&elq=ab2a4141be0344bb8dfd6f18c91a9f26&elqaid=7257&elqat=1&elqCampaignId=4054).
Other General Points for Customer Awareness:
-Data, if and when available, should be backed up to a safe location with appropriate restoration procedures.
-Reinstall the system applications with at least one of the recommended actions to prevent re-infection to the device.
-Network segmentation will help prevent harm to the device as long as the SMB and RDP are not utilized and blocked.
References Resources:
Philips is committed to ensuring robust product security resources and support for our healthcare customers, and their patients who rely on them. We continue to engage with the medical device industry, security research community, and government agencies to monitor the situation, respond accordingly, and meet ongoing healthcare cybersecurity challenges.
Philips Xper-IM vulnerability information (14 Jul 2016)
In the second quarter of 2016, Philips was contacted by security researchers regarding potential security vulnerabilities with the Philips Xper-IM Connect system. As part of our Responsible Disclosure policy and processes, Philips has been in collaboration with the security researchers investigating this issue to promptly and transparently address the identified vulnerabilities in the Xper-IM Connect system.
The joint analysis by Philips and the researchers determined that Xper-IM Connect systems running on unsupported Windows XP operating systems and outdated product software were vulnerable to a number of potential exploits, which if implemented, could result in a remote attacker gaining access to an affected system.
The Philips product security team was able to confirm that all of the reported vulnerabilities in the Xper-IM Connect system are remediated by upgrading to the minimum specification of Windows 2008 Server or the recommended specification of Windows 2008 Server R2 and then applying a new product software version (Xper-IM Connect Version 1.5 Service Pack 13). We are providing recommendations and contact information in order to help any affected customers using a potentially affected Xper-IM Connect System address the issue and correct any affected systems as rapidly as possible.
Both Philips and the security researchers contributed to a joint disclosure to the U.S. Department of Homeland Security’s NCCIC/ICS-CERT organization, and was the source for that body’s Medical Device Advisory concerning this issue.
Philips is committed to ensuring the security and integrity of our products. Philips takes this matter very seriously. While any potential or identified security vulnerabilities are a concern, at this time we are not aware of any customers or patients that have been directly affected by this issue.
Philips Healthcare Product Security Update – Shellshock (Unix Bash shell) Vulnerability
Philips Healthcare is aware of the Unix “Shellshock” security vulnerability. The effect of this vulnerability on Philips healthcare products and services is being investigated by the Philips engineering and product security teams. This site will be updated once a solution is available for any affected product(s).
Philips Healthcare Product Security Update – SSLv3 POODLE Vulnerability
Philips Healthcare is aware of the SSLv3 POODLE security vulnerability. The effect of this vulnerability on Philips healthcare products and services is being investigated by the Philips engineering and product security teams. This site will be updated once a solution is available for any affected product(s).
Philips manufactures, and helps customers maintain, highly complex medical devices and systems. Per policy, only Philips-authorized changes are allowed to be made to these systems, either by Philips personnel or under Philips’ explicit published direction.
Philips Healthcare Product Security Update – Heartbleed Vulnerability
Philips Healthcare is aware of the OpenSSL ‘heartbleed’ security vulnerability. The vulnerability (assigned CVE-2014-0160) impacts OpenSSL versions 1.0.1 – 1.0.1f. The effect of this vulnerability on Philips healthcare products and services is being investigated by the Philips engineering and product security teams. Customers will be notified once a solution is available for any affected product(s).
For our Remote Service solution (PRS) we have reviewed all of our customer facing interfaces and VPN connections to our customer facilities, and can confirm that these are not affected by the Heartbleed issue.
Philips Healthcare and Windows XP End of Support
As part of our continued attention to your security needs, Philips Healthcare wishes to bring to your attention that Microsoft has discontinued support for the Microsoft Windows XP Operating System, following
April 8, 2014.
Where feasible, Philips Healthcare has been developing solutions for products running Windows XP to address continuity of protection against known and emerging security threats and vulnerabilities.
To this end, Philips Healthcare will provide product-specific Statements to assist customers. Where applicable, these Product Statements may provide upgrade or field change order information.
Philips Xper-IM vulnerability information (21 Feb 2013)
Philips Healthcare is aware that researchers at a recent cyber-security conference in Florida presented on a security vulnerability in a system component of the Philips Xper Information Management System. This has been investigated by the responsible Philips engineering and product security experts and we expect to provide a software update within a short period of time once the software validation has been completed. Affected customers will be notified directly once this software update is available.
A related concern regarding the disclosure during the conference of service passwords used on Xper IM systems is already being addressed by a Philips Field Change Order (FCO 83000171) which is currently being distributed to all affected customers. The information provided by this FCO also contains instructions to mitigate the above network-based heap overflow vulnerability in the interim.
Customers with specific questions regarding any security advisory and their Philips Healthcare products are asked to may send an e-mail to productsecurity@philips.com, contact their Philips Service Representative or contact their regional Philips Service Support.
Any media inquiries should be directed to:
Mario Fante, mario.fante@philips.com
or (outside N. America):
Steve Klink, steve.klink@philips.com
Philips manufactures, sells and helps you maintain highly complex medical devices and systems. Per policy, only Philips authorized changes are allowed to be made to these systems, either by Philips personnel or under Philips explicit published direction.
Please contact your Philips service representative for specific information about potential vulnerabilities and the availability of patches for your equipment configuration.