Cybercriminals often target healthcare organizations because of the sensitive data they store, and medical devices can be especially vulnerable to malicious actors. With a complex IT environment of old and new technology, healthcare organizations should pay close attention to specialized attacks that could disrupt operations or make patient care challenging.
The use of medjacks allows for a deep-rooted attack that can cripple the core functioning of healthcare organizations, big and small. By understanding the fundamental principles around protecting against these attacks organizations can guard against this ever-evolving attack.
Medjacks, short for "medical device hijacks," are a type of cyberattack focusing on medical devices within healthcare organizations. Hackers target these devices because they often run on outdated software and lack strong security measures. Once inside, attackers can manipulate the devices, disrupt their functions, and use them as entry points to access the broader hospital network. Medical devices like insulin pumps, pacemakers, and MRI machines are necessary for patient care, making these attacks particularly dangerous.
"Medjack” was first coined in 2015 when Trap X, a security organization, identified healthcare device hijacking. Hackers use medjacks to infiltrate computers or network servers via backdoor entries. Once inside, they can steal data, demand ransom, or disable systems and devices. Between 2015 and 2018, four variations of MEDJACK were developed, making detection increasingly challenging. By 2019, specific devices like Medtronic's insulin pumps and cardiac devices were targeted, demonstrating an evolving and persistent rise in these attacks.
In 2011, researchers exposed vulnerabilities in insulin pumps, showing that off-the-shelf hardware could launch active and passive attacks. These attacks allowed unauthorized parties to gain full control over the pumps, potentially starting, stopping, or even administering an overdose of insulin, actions that could be deadly to patients. A novel security mechanism called an RF (radio frequency) shield was introduced to counter the attacks. Acting as a proxy server, an RF shield prevents unknown devices from communicating with implantable medical devices, ultimately blocking unauthorized access attempts.
Encryption is the most effective tool against medjacks, as it turns sensitive data into unreadable codes for unauthorized actors. Encrypting data stored on medical devices and network servers prevents unauthorized access to sensitive information, even if attackers manage to breach the network or hijack a device.
Secure devices
Apply the right security principles and techniques
See also: HIPAA Compliant Email: The Definitive Guide
Checksums are numerical values used to verify data integrity by detecting errors or changes in the data.
Practical examples of VLANs include segmenting office networks into separate departments such as HR, finance, and IT to improve security and manageability.
Devices may be vulnerable to a medjack because of outdated software, lack of strong security measures, and insufficient network segmentation in medical devices.