Incident: Vulnerabilities in Siemens Nucleus Software Impacting Medical Devices

Published Date: 2021-11-09

Postmortem Analysis
Timeline 1. The software failure incident happened in November 2021. Therefore, the estimated timeline for the software failure incident is November 2021.
System 1. Nucleus Real-time Operating System owned by Siemens [121108]
Responsible Organization 1. Researchers from cybersecurity firms Forescout Technologies and Medigate discovered the vulnerabilities in the software used in medical devices and machinery [121108]. 2. Siemens, the industrial firm that owns the software, was responsible for the software failure incident as they were the ones who issued updates fixing the vulnerabilities [121108]. 3. The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) played a role in addressing the vulnerabilities by expectedly issuing an advisory encouraging users to update their systems in response to the report [121108].
Impacted Organization 1. Hospitals and other facilities in the health care sector [121108] 2. Government and retail sectors [121108]
Software Causes 1. Vulnerabilities in the Nucleus Real-time Operating System software owned by Siemens were the software causes of the failure incident [121108].
Non-software Causes 1. Lack of timely software updates due to resource constraints during the ongoing coronavirus pandemic [121108] 2. Aging software in critical infrastructure sectors like healthcare that is harder to maintain and secure [121108]
Impacts 1. The vulnerabilities in the software used in medical devices and machinery could cause critical equipment such as patient monitors to crash, potentially jeopardizing patient safety [121108]. 2. Nearly 4,000 devices in various sectors are running the vulnerable software, posing a widespread risk of exploitation [121108]. 3. The vulnerabilities could affect a range of medical devices, including anesthesia, ultrasound, and x-ray machines, depending on the software version and internet connectivity [121108]. 4. Researchers were able to demonstrate the impact of the vulnerabilities by taking a building automation system offline in a mock hospital room, affecting the lights and HVAC system [121108].
Preventions 1. Regular software updates and patch management: Implementing a robust system for regularly updating and patching software could have prevented the vulnerabilities in the Nucleus Real-time Operating System from being exploited [121108]. 2. Enhanced network security measures: Strengthening network security measures to prevent unauthorized access could have mitigated the risk of hackers exploiting the software flaws in critical equipment like patient monitors [121108]. 3. Conducting thorough security assessments: Performing comprehensive security assessments on software used in critical infrastructure, such as medical devices, could help identify and address vulnerabilities before they can be exploited by malicious actors [121108].
Fixes 1. Updating the systems with the software vulnerabilities by applying the issued software updates by Siemens [121108]. 2. Following the advisory expected to be issued by the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) to encourage users to update their systems in response to the report [121108].
References 1. Cybersecurity firms Forescout Technologies and Medigate [Article 121108] 2. Siemens, the industrial firm that owns the software [Article 121108] 3. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) [Article 121108] 4. Dr. Kevin Fu, acting director of medical device cybersecurity at the FDA’s Center for Devices and Radiological Health [Article 121108] 5. CISA Deputy Executive Assistant Director for Cybersecurity Matt Hartman [Article 121108] 6. Elisa Costante, vice president of research at Forescout Technologies [Article 121108]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - The vulnerabilities were found in software used in medical devices and machinery across various sectors, including health care, government, and retail, owned by Siemens [121108]. - Siemens, the industrial firm that owns the software with vulnerabilities, issued updates to fix the vulnerabilities after working with federal officials and researchers [121108]. (b) The software failure incident having happened again at multiple_organization: - The vulnerabilities were found in nearly 4,000 devices made by various vendors in the health care, government, and retail sectors, all running the vulnerable software [121108]. - The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) is expected to issue an advisory encouraging users to update their systems in response to the vulnerabilities discovered in the software used across different industries [121108].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident in the vulnerabilities found in the Nucleus Real-time Operating System software used in medical devices and machinery across various industries. The vulnerabilities, if exploited by hackers, could lead to critical equipment such as patient monitors crashing [121108]. (b) The software failure incident related to the operation phase is highlighted by the potential impact on medical devices like patient monitors, anesthesia machines, ultrasound machines, and x-ray machines if the software flaws are exploited. The vulnerabilities could affect these devices depending on the software version running and whether the device is connected to the internet [121108].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident in the article is primarily due to vulnerabilities found within the Nucleus Real-time Operating System software owned by Siemens. These vulnerabilities could cause critical equipment such as patient monitors to crash if exploited by a hacker [121108]. (b) outside_system: The article mentions that exploiting the software flaws would require prior access to networks in some cases, indicating that the contributing factors originating from outside the system (such as hackers gaining access to networks) could also lead to the failure incident [121108].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the articles is primarily due to non-human actions, specifically vulnerabilities found in the software used in medical devices and machinery. Researchers discovered more than a dozen vulnerabilities in the Nucleus Real-time Operating System, owned by Siemens, which could cause critical equipment like patient monitors to crash if exploited by a hacker [121108]. (b) Human actions also play a role in addressing the software vulnerabilities. Siemens, the industrial firm that owns the software, issued updates to fix the vulnerabilities after working with federal officials and researchers to verify and address the issues through software updates. The Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) is expected to issue an advisory encouraging users to update their systems in response to the report [121108].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - The vulnerabilities found in the software used in medical devices and machinery could cause critical equipment like patient monitors to crash if exploited by a hacker [121108]. - Researchers sent malicious commands to a building automation system in a lab test, taking it offline and cutting off lights and HVAC systems in a mock hospital room, demonstrating the potential impact on hardware systems [121108]. (b) The software failure incident occurring due to software: - The vulnerabilities were found in the Nucleus Real-time Operating System software owned by Siemens, which manages data across critical networks [121108]. - Siemens issued updates to fix the vulnerabilities in the software [121108]. - The vulnerabilities could affect a range of medical devices depending on the software version and internet connectivity, including patient monitors, anesthesia, ultrasound, and x-ray machines [121108]. - The incident highlights the importance of examining aging software for security flaws, especially in key industries where legacy software is prevalent [121108].
Objective (Malicious/Non-malicious) malicious, non-malicious (a) The software failure incident mentioned in the article is related to malicious intent by hackers. Researchers found vulnerabilities in software used in medical devices and other industries that, if exploited by a hacker, could cause critical equipment such as patient monitors to crash. The vulnerabilities were discovered by cybersecurity firms Forescout Technologies and Medigate, and Siemens issued updates to fix the vulnerabilities. There is no evidence that malicious hackers have taken advantage of the software flaws, but the potential for harm was present if exploited [121108]. (b) The incident also highlights non-malicious factors contributing to the software failure, such as challenges hospitals and facilities face in keeping sensitive software updated, especially during resource-absorbing situations like the coronavirus pandemic. The vulnerabilities in the Nucleus Real-time Operating System, owned by Siemens, could affect a range of medical devices depending on the software version and internet connectivity. The incident underscores the importance of closely examining aging software for security flaws in critical industries like healthcare [121108].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident related to poor_decisions: - The software failure incident involving vulnerabilities in the Nucleus Real-time Operating System, owned by Siemens, was due to poor decisions related to the management and maintenance of aging software used in critical industries like healthcare [121108]. - The challenges faced by hospitals and other facilities in keeping sensitive software updated during the resource-absorbing coronavirus pandemic contributed to the existence of vulnerabilities that could potentially be exploited by hackers, leading to critical equipment crashes [121108]. (b) The intent of the software failure incident related to accidental_decisions: - The vulnerabilities in the software were not intentionally introduced but were accidental due to the lack of proper maintenance and updates, as highlighted by the need for quick mechanisms to ascertain if devices are affected and the importance of addressing security flaws in aging software [121108]. - There is no evidence that malicious hackers have exploited the software flaws, indicating that the vulnerabilities were not intentionally introduced but were accidental in nature [121108].
Capability (Incompetence/Accidental) unknown (a) The software failure incident in the article is not attributed to development incompetence. The vulnerabilities in the software used in medical devices and machinery were discovered by cybersecurity firms Forescout Technologies and Medigate, and Siemens, the industrial firm that owns the software, issued updates fixing the vulnerabilities after working with federal officials and researchers [121108]. (b) The software failure incident in the article is not accidental. The vulnerabilities in the software were identified by researchers and cybersecurity firms, and there is no evidence that malicious hackers have exploited these flaws. Siemens issued updates to address the vulnerabilities, and federal agencies like the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) are expected to issue advisories encouraging users to update their systems in response to the report [121108].
Duration temporary The software failure incident described in the article is more aligned with a temporary failure rather than a permanent one. The vulnerabilities found in the software used in medical devices and machinery were identified by researchers, and the software owner, Siemens, issued updates to fix the vulnerabilities. The Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) is expected to issue an advisory encouraging users to update their systems in response to the report. This proactive response to address the vulnerabilities indicates that the software failure incident is temporary and can be mitigated through software updates and security measures [121108].
Behaviour crash, value, other (a) crash: The software failure incident mentioned in the article involves vulnerabilities in software used in medical devices and machinery that, if exploited by a hacker, could cause critical equipment such as patient monitors to crash. The vulnerabilities in the Nucleus Real-time Operating System, owned by Siemens, could potentially lead to crashes in various medical devices [121108]. (b) omission: The article does not specifically mention any instances of the software omitting to perform its intended functions at an instance(s). (c) timing: The article does not mention any failures related to the timing of the system performing its intended functions. (d) value: The vulnerabilities in the software could potentially lead to the system performing its intended functions incorrectly if exploited by a hacker [121108]. (e) byzantine: The article does not mention any failures related to the system behaving erroneously with inconsistent responses and interactions. (f) other: The vulnerabilities in the software could potentially lead to various unexpected behaviors beyond just crashing or performing incorrectly, depending on how a hacker might exploit the flaws. This could include unauthorized access, data manipulation, or disruption of critical functions in medical devices and machinery [121108].

IoT System Layer

Layer Option Rationale
Perception embedded_software (a) sensor: The vulnerabilities in the software used in medical devices and machinery could potentially cause critical equipment like patient monitors to crash if exploited by a hacker. This indicates a potential failure related to the sensor layer of the cyber physical system [121108]. (b) actuator: The vulnerabilities in the software could also affect certain anesthesia, ultrasound, and x-ray machines, indicating a potential impact on the actuator layer of the cyber physical system [121108]. (c) processing_unit: The vulnerabilities in the Nucleus Real-time Operating System, owned by Siemens, could affect a range of medical devices depending on the software version and internet connectivity. This points to a potential failure related to the processing unit layer of the cyber physical system [121108]. (d) network_communication: The vulnerabilities would require prior access to networks in some cases for malicious hackers to exploit them. This suggests a potential failure related to the network communication layer of the cyber physical system [121108]. (e) embedded_software: The vulnerabilities found in the Nucleus Real-time Operating System, which manages data across critical networks, highlight potential flaws in the embedded software used in medical devices and machinery, indicating a failure related to the embedded software layer of the cyber physical system [121108].
Communication connectivity_level The software failure incident reported in Article 121108 was related to vulnerabilities found in the Nucleus Real-time Operating System, which is a suite of software owned by Siemens that manages data across critical networks. The vulnerabilities discovered in this software could potentially affect a range of medical devices, including patient monitors, anesthesia machines, ultrasound machines, and x-ray machines. The vulnerabilities could be exploited by sending malicious commands to the affected devices, potentially causing critical equipment to crash or malfunction. This incident does not specifically mention whether the failure was related to the communication layer of the cyber physical system at the link_level or connectivity_level. However, the vulnerabilities found in the Nucleus Real-time Operating System could potentially impact the communication layer of the cyber physical system, especially if the devices are connected to networks or the internet. The exploitation of these vulnerabilities could lead to disruptions in the communication and operation of the affected medical devices and machinery.
Application TRUE [121108] The software failure incident reported in the article is related to vulnerabilities found in the Nucleus Real-time Operating System, which is a suite of software owned by Siemens that manages data across critical networks. These vulnerabilities, if exploited by a hacker, could cause critical equipment such as patient monitors to crash. The vulnerabilities were discovered by cybersecurity firms Forescout Technologies and Medigate, and Siemens issued updates to fix the vulnerabilities. The vulnerabilities in the Nucleus Real-time Operating System could affect a range of medical devices, including patient monitors, anesthesia machines, ultrasound machines, and x-ray machines.

Other Details

Category Option Rationale
Consequence harm, property, non-human, theoretical_consequence (a) death: There is no mention of people losing their lives due to the software failure incident in the provided article [121108]. (b) harm: The article mentions that if the vulnerabilities in the software used in medical devices were exploited by a hacker, critical equipment such as patient monitors could crash, potentially causing harm to patients [121108]. (c) basic: There is no mention of people's access to food or shelter being impacted due to the software failure incident in the provided article [121108]. (d) property: The vulnerabilities in the software could impact critical infrastructure sectors, including the healthcare sector, potentially affecting medical devices like patient monitors, anesthesia machines, ultrasound machines, and x-ray machines [121108]. (e) delay: The article does not mention any delays caused by the software failure incident [121108]. (f) non-human: Non-human entities, such as medical devices and machinery in various industries, were impacted by the software vulnerabilities discovered in the Nucleus Real-time Operating System owned by Siemens [121108]. (g) no_consequence: The vulnerabilities in the software were discovered before any malicious hackers could exploit them, and Siemens issued updates to fix the vulnerabilities, indicating that there were no observed real consequences of the software failure incident at the time of reporting [121108]. (h) theoretical_consequence: There were potential consequences discussed in the article, such as the vulnerabilities affecting a range of medical devices and critical infrastructure sectors, but there was no evidence of these vulnerabilities being exploited by hackers in the wild at the time of reporting [121108]. (i) other: The article discusses the importance of quickly addressing vulnerabilities in medical devices to ensure patient safety and highlights the need for awareness and proactive measures to address security flaws in aging software used in key industries [121108].
Domain health (a) The software failure incident mentioned in the article is related to the health industry. The vulnerable software is used in medical devices such as patient monitors, anesthesia machines, ultrasound machines, and x-ray machines [121108].

Sources

Back to List