Committed to proactively addressing the security concerns of our customers

Publication Date:  December 5, 2018

Update Date:  December 5, 2018

Philips is a committed leader in medical device cybersecurity. As part of our global Product Security Policy, the company conducts extensive ongoing analysis of our products, often in collaboration with customers and researchers, to identify and address potential vulnerabilities.

In accordance with Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of possible system security vulnerabilities, the company is proactively issuing an advisory concerning an identified inadequate encryption strength vulnerability affecting the Philips HealthSuite Health Android application.

Unless addressed, this issue may allow an attacker with physical access to potentially impact confidentiality and integrity of the product.

At this time, Philips has received no reports of exploitation of this vulnerability or incidents from clinical use that we have been able to associate with this vulnerability, Philips analysis indicates that there is no expectation of patient hazard due to this issue.

This vulnerability will be addressed by a new software release scheduled for Q1 2019.

Philips advises users against jail-breaking or rooting their mobile device. A jail broken or rooted device means one that is modified outside the mobile device or operating system vendor supported or warranted configurations. Such devices have been freed from the limitations imposed on it by mobile service providers and the phone manufacturers without their approval. This may affect the performance of the App, weaken the security of devices and expose users to additional risks.

Philips has reported this potential vulnerability and its resolution to customers and the appropriate government agencies, including US DHS ICS-CERT, which is issuing an advisory.

Users with questions regarding their specific Philips HealthSuite Health Android app are advised by Philips to contact their Customer Success Manager (CSM), local Philips service support team, or regional service support. Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions 

Publication Date:  November 8, 2018

Update Date:  November 8, 2018

Philips is a committed leader in medical device cybersecurity. Governed by our global Product Security Policy, the company conducts extensive ongoing analysis of our products, often in collaboration with customers and researchers, to identify and address potential vulnerabilities.

As part of Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of potential system security vulnerabilities, Philips is proactively issuing an advisory concerning potential vulnerabilities that may affect Philips iSite and IntelliSpace PACS (Picture Archiving and Communications Systems). 

Philips has confirmed that Philips iSite and IntelliSpace PACS contain security vulnerabilities that under certain specific conditions could impact or potentially compromise patient confidentiality, system integrity, and/or system availability.  These vulnerabilities are not exploitable over the Internet.

As an interim mitigation for this potential issue, Philips recommends that users:

•        Ensure only customer-authorized personnel can connect to the customer controlled network environment.

•        Review Instructions for Use guidelines available with the application interface and follow the security best practices.

Philips can work with customers to provide assistance with resetting system passwords, or customers may request a Compute Environment (CE) release to address this issue.

At this time, Philips has received no reports of patient harm. Philips analysis has shown that it is unlikely that this vulnerability would impact clinical use, due to mitigating controls currently in place. To date, Philips has received no complaints involving clinical use that we have been able to associate with this problem.

Philips IntelliSpace PACS runs in a managed service environment which adheres to ICS-CERT recommendations to minimize the risk of exploitation (Virtual Private Network, Firewall isolation from other networks, no internet access). In addition, Philips employs an automated Antivirus solution that continuously monitors and remediates threats across all systems in the managed service environment. Philips has a monthly recurring patch program which all IntelliSpace PACS users are encouraged to participate. Customers who participate in this program receive all Philips approved operating system and application patches in a timely fashion.

Philips will continue to add cybersecurity vulnerability remediation improvements through our Secure Development Lifecycle (SDL) as threats continue.

Philips has reported these potential vulnerabilities and its resolution to customers and the appropriate government agencies, including US DHS ICS-CERT, which is issuing an advisory.

Users with questions regarding their specific IntelliSpace PACS solutions are advised by Philips to contact their Customer Success Manager (CSM), Market Success Leader (MSL), local Philips service support team, or regional service support. Philips contact information is available at the following location: Customer Service Solutions

Publication Date:  May 17, 2018

Update Date: October 8, 2018

Philips is a committed leader in medical device cybersecurity. As part of our global Product Security Policy, the company conducts extensive ongoing analysis of our products, often in collaboration with customers and researchers, to identify and address potential vulnerabilities.

As part of Philips’ Responsible Disclosure Policy for the awareness and remediation of identified product security vulnerabilities, the company is proactively issuing an advisory concerning a potential, low-risk security vulnerability that may affect the EncoreAnywhere hosted web application deployed for use with certain Philips Respironics products and limited to the Asia/Pacific region. This potential issue only affects EncoreAnywhere APAC 2.36.3.3 and earlier software versions.

Philips has confirmed that the potential security vulnerability, if successfully exploited, may result in unencrypted communication and improper disclosure of sensitive data. This vulnerability could be exploited remotely by an unauthorized user. However, an attacker would require a high level of skill in order to successfully exploit this vulnerability. Vulnerability remediation is planned by September 2018 and was completed at that time.

At this time, Philips has received no reports of exploitation of this vulnerability or incidents from clinical use that have been associated with the vulnerability.

Philips has reported this potential vulnerability and its resolution to customers and the appropriate government agencies, including ICS-CERT, which is issuing an advisory.

Philips recognizes that the security of our healthcare, personal health, and home consumer products and services are business critical for our customers. Philips has taken the lead in creating a Responsible Disclosure Policy, to collaborate with customers, security researchers, regulators and other agencies to help proactively identify, address and disclose potential vulnerabilities in a safe and effective manner.

Customers with questions regarding their specific Philips installations are advised by Philips to contact their local Philips service support team or their regional service support.
Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

Publication Date:  August 30, 2018

Update Date:  August 30, 2018

Philips is a committed leader in medical device cybersecurity. As part of our global Product Security Policy, the company conducts extensive ongoing analysis of our products, often in collaboration with customers and researchers, to identify and address potential vulnerabilities.

In accordance with Philips’ Coordinated Vulnerability Disclosure Policy for the awareness and remediation of possible system security vulnerabilities, the company is proactively issuing an advisory concerning potential unencrypted communication vulnerabilities in versions of Philips e-Alert service units up to and including R2.1.

If successfully exploited, this potential vulnerability may allow an attacker within the same subnet to impact or compromise customer contact details, system integrity, and/or system availability. The vulnerabilities may allow attackers of low skill to provide unexpected input into the application, execute arbitrary code, display system information, or potentially cause a system crash. Philips e-Alert is not a medical device, therefore there is no risk to patient safety.

In June 2018, Philips released a new software version to mitigate this potential issue. This update addressed the vulnerability and enhanced the security capabilities of the e-Alert unit.

Philips has reached out to affected users to schedule updates. Philips encourages users to use Philips-validated and authorized changes only for the e-Alert unit supported by Philips ’authorized personnel or under Philips’ explicit published directions for patches, updates, or releases. Philips always requires that the device never be Internet-facing.

Philips has reported these potential vulnerabilities and its resolution to customers and the appropriate government agencies, including US DHS ICS-CERT, which is issuing an advisory.

Users with questions regarding their specific E-Alert solutions are advised by Philips to contact their local Philips service support team or regional service support. Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

Publication Date:  August 21, 2018

Update Date: August 21, 2018

Philips is a committed leader in medical device cybersecurity. As part of our global Product Security Policy, the company conducts extensive ongoing analysis of our products, often in collaboration with customers and researchers, to identify and address potential vulnerabilities.

As part of Philips’ Coordinated Vulnerability Disclosure Policy and aligned with U.S. FDA Post-Market Guidance requirements for the awareness and remediation of potential system security vulnerabilities, the company proactively issued an advisory concerning potential security vulnerabilities that may affect Philips IntelliVue Information Center (PiiC iX) B.02 system.

Philips has confirmed that for the B.02 version of the system, Simple TCP Services is enabled, which if successfully exploited, may potentially result in a Denial of Service where the Operating System will become unresponsive during a network attack, which will affect the application’s ability to meet the intended use.

This vulnerability is exploitable remotely. However, a high skill level by an attacker is required for successful exploitation. At this time, Philips has received no reports of exploitation of this vulnerability that impacts clinical use that we have been able to associate with this problem.

Philips has identified and put in place mitigations to reduce the risk of exploitation of this vulnerability. In order for users of affected devices to mitigate exposure to these vulnerabilities, Philips recommends following the device’s labeling, including Instructions for Use and Service Guide(s), which provide compensating controls to mitigate these vulnerabilities.

To mitigate these vulnerabilities; Philips recommends users follow the labeling for the medical device (Security for Clinical Networks Guide) which provides physical and logical security instructions. Philips will be providing the remediation in the form of a patch in Q3 2018 for all PIIC iX B.02 customers.

Philips has reported this potential vulnerability and its resolution to customers and the appropriate government agencies, including ICS-CERT, which is issuing an advisory.

Philips recognizes that the security of our healthcare, personal health, and home consumer products and services are business critical for our customers. Philips has taken the lead in creating a Responsible Disclosure Policy, to collaborate with customers, security researchers, regulators and other agencies to help proactively identify, address and disclose potential vulnerabilities in a safe and effective manner.

Customers with questions regarding their specific Philips IntelliVue Information Center (PiiC iX) installations are advised by Philips to contact their local Philips service support team or their regional service support. Philips contact information is available at the following location:

https://www.usa.philips.com/healthcare/solutions/customer-service-solutions

Please see the Philips product security web site for the latest security information for Philips products:

https://www.philips.com/productsecurity

Publication Date:  April 24, 2018

Update Date: April 24, 2018

Overview

A known cyber-attacker group known as Orangeworm is reportedly targeting US, Europe and Asia healthcare organizations with malware known as Kwampirs.  The group was identified in 2015 when it was reported to have conducted targeted attacks against organizations in related industries, such as healthcare providers, pharmaceutical, IT solutions providers for healthcare and equipment manufacturers. At the time of this advisory, 40 percent of Orangeworm's confirmed target organizations operate within the healthcare sector and 17 percent of the healthcare organizations were located in the US.

Technical details

Once Orangeworm has infiltrated a victim's network, they deploy Trojan.Kwampirs, a backdoor malware program that provides attackers with remote access to a compromised computer. When executed, Kwampirs decrypts and extracts a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle to the decrypted payload in an attempt to evade hash-based detections. To ensure persistence, Kwampirs creates a service with the following configuration to ensure that the main payload is loaded into memory upon system reboot: