For Industrial, Medical Systems: Bugs Run In The Family

Researchers Billy Rios and Terry McCorkle presented findings that many medical devices from major manufacturers (including Philips, GE, Siemens, Honeywell) share critical software security flaws similar to industrial control systems—examples include heap overflows triggered by network services, documented backdoor administrator accounts with weak PINs, and insecure credential storage allowing remote RDP-based access; these issues could enable remote unauthenticated compromise of patient monitoring systems and pose direct risks to patient safety. The researchers reported the findings to DHS ICS-CERT, while vendors such as Philips stated they have product security programs, prompting questions about why such obvious flaws were missed.