Patient Monitor Contec CMS8000 Contains a Backdoor | Hacker News Reader

Patient Monitor Contec CMS8000 Contains a Backdoor

cisa.gov

59 pointsdoener12 comments

Notably, the backdoor uploads data to an NFS share hosted on a university IP (the exact university has not been made clear). Data includes patient names, doctor names, date of birth, and the specific hospital department the patient is at.

Someone is going to be going out of business soon and someone at a university is going to get very fired.

> Contec Medical Systems Co., Ltd. (hereinafter referred to as CONTEC) focusing on research, manufacture and distribution of medical instruments, was founded in 1996 as a high-tech company. CONTEC locates in Economic & Technical Development Zone in Qinhuangdao covered an area of 125 acres and building area of over 100000 square meter, which is one of the largest bases for R & D and production of medical devices in China.

https://contechealth.com/pages/company-introduction

I doubt it.

I work in medical software.

If you think the FDA or other regulating bodies wouldn't immediately tell care providers to yank these devices, you might be in for a surprise.

What's more mysterious to me is why there's a back door in a device like this. Seems like a bizarre way to attack your enemy.

Why attack people when you can exploit their data to make money. This is some growth "hacking" to make a list of sales leads.

Because there are far, far simpler ways to figure out what a hospital wants, or what a patient needs to deal with their health needs. I'm going to bet that the completely legal practice of building a profile off of what a person has installed on their phone and their web searches is more effective than collecting their vitals and turning that into sales leads. You could just ask the health system what they need. That's what leads to a lot of our product initiatives.

It almost makes me wonder if there's a component in the hardware or software that's shared with other devices manufactured in China that are better attack vectors and they just tossed it into this one because, hey, it works.

The inverse of “defense in depth” is “flooding the zone”.

Can't gather data new data from the phone if that person is in a coma. But, hey, now the relatives can get coffin adverts before the doctor brings the bad news! /s

That backdoor, if it reports to a university, is probably put there to facilitate a study/diploma/phd or something like that.

I doubt anyone at the university was involved, or is in trouble. I rather suspect that the university was told "put this on your network and don't ask too many questions".

It also contains a out of bounds write, which could lead to RCE. https://www.cve.org/CVERecord?id=CVE-2024-12248

1. Why wouldn’t CISA release the IP address? Blocking a specific IP is much easier for a hospital than patching or replacing every affected device. Some might argue that hospitals should just remove the device altogether, but CISA has stated that keeping the device and disabling its network capability is an acceptable solution. It seems very odd not to disclose the IP address. The only plausible explanation is that they want to monitor U.S.-based egress traffic to that IP.

2. The backdoor transmits data in plain text to a static IP address—something a competent hospital network administrator would have inevitably discovered.

The weird thing about this advisory is that the hardcoded IP addresses (202.114.4[.]119) are the same ones found in the online installation manuals for Contec and affiliated brands ( https://help.xchart.com/en/articles/7943824-configuring-edan... ).

This was confirmed through firmware analysis: https://x.com/craiu/status/1885341007576801338 and in the manuals: https://infosec.exchange/@decio/113928319441297901

Reply on news.ycombinator.com