Client Success Showcase

Securing Smart Beds for Redefining Patient Wellbeing

THE CUSTOMER AND THE INDUSTRY

The customer is a world leader in medical technology, touching lives across continents. Its wide range of medical equipment play a critical role in pre and post operative patient care. Quality, reliability, and uninterrupted functioning of their devices is essential for the wellbeing of the end customer.

One of their fast-moving products, the Smart Bed is an essential and widely used device for bedridden patients. The client was keen to ensure smooth functioning of the device and partnered with LTTS for in depth testing.

THE CHALLENGES

Smart Beds are specialized alternating pressure beds that systematically increase and reduce pressure on key points. This gives comfort to the bedridden patients and keeps them away from painful bedsores. On testing the device some vulnerabilities were identified, including:

Absence of Network Protocol Security: The device used insecure network services such as SSH, and FTP, compromising on security when communicating with other end points

Complicated User Access Protocols: Low privilege users could override therapy and functionality. The hard coded password system exposed a weak password policy

Vulnerable Alert System: Data/Triggers from the device to alert a nurse were vulnerable to manipulation, triggering false alarms

OUR SOLUTION

The experienced LTTS testing team performed Vulnerability Assessment and Penetration Testing on the components associated with the device
Tested the device’s micro-USB communication channel and Firmware in compliance with OWASP IoT Top 10 2017 and SANS Top 25 standards
Simulated attacks, including, Rubber Ducky, HID Injection, Port Fuzzing, USB Sniffing, Functionality Check, Communication Security etc, were performed to check for vulnerabilities
Low Entropy Distribution was identified as key vulnerability
Detailed reports with proof of all the identified issues were documented for further action

THE BENEFITS

Ensured greater patient comfort due to the reliable functioning of the Smart Bed
Enabled better utilization of nursing resources with minimized false alarms
Eliminated the cost and risk of product recalls
Enhanced the client’s brand reputation, as well as those of the hospitals it serves

Enhancing Critical Device Performance with Penetration Testing

THE CUSTOMER AND THE INDUSTRY

The customer is a world leader in medical technology with a global presence. In an industry marked by mission-critical, life-saving devices, product quality, performance, and reliability are non-negotiable. The client was committed to maintaining the highest standards in their products and was looking for a mature and experienced partner for the evaluation and remediation of devices. As a trusted partner for years, LTTS was the first choice to deliver the solution.

THE CHALLENGES

The product, Airway Clearance device requires constant monitoring by the caregivers
Any break or anomaly in communications can be life-threatening
The Bluetooth low energy link connecting the device and the monitoring app required testing for reliable connectivity and intrusion-proofing

OUR SOLUTION

LTTS used its expertise in testing as well as its knowledge of connected technology to conduct Product and Penetration Testing on the device
Threats from the Bluetooth communication interface were assessed and remedial measures for security enhancement were provided

Bluetooth testing was compliant with global benchmarks - OWASP IoT TOP 20 2017 and SANS TOP 25 standards
Protocol fuzzing, attack vector based on STRIDE threat models were carried out to uncover vulnerabilities in the system

THE BENEFITS

Reduced the risk of product recalls for software upgrades
Enhanced in hospital confidence recommending the device with its enhanced security posture
Improved brand reputation with better performance of the device

Addressing Vulnerabilities In A Wearable Medical Device

THE CUSTOMER AND THE INDUSTRY

The customer is a global leader in wearable medical devices. It had launched a proprietary wearable platform and needed a partner with strong domain expertise and experience to perform usability testing, performance testing, security testing, and functional testing on it. LTTS, with its extensive accumulated knowledge in the field, was onboarded to address the emerging requirements

THE CHALLENGES

The customer's new platform was a wearable watch on Tizen OS, and recorded the patient’s vital parameters and periodically uploaded them to a remote server at the healthcare provider’s end. On examining the device, LTTS found that it had several vulnerabilities
Insecure logging in and communicating with the server left the device open to malicious manipulation of user health parameters. This risks user's safety, as well as poses the threat of a leak of Protected Health Information, which could attract regulatory penalties
Several high severity web application security risks were identified. These could potentially lead to doctor/caregiver user account takeover, resulting in patient health information leaks, fake alarms, and Denial of Service attacks
Multiple security flaws were identified such as Cross-Site Scripting, weak password policy, weak server-side validation, DoS attacks, and Cross-Site request forgery

OUR SOLUTION

The LTTS team performed a battery of tests on the device. These included:

Performance Testing of the server, portal and mobile applications
Load Testing of the server
Usability Testing, Usability Assessment and User Sampling of the entire platform including Tizen, iOS, Android and the web portal.
Functional Security and Vulnerability Testing of Cloud services, web portal, Tizen, Android and iOS apps

43 vulnerabilities were found out of which 21 were high impact, 13 were medium impact and 9 were low impact.
Detailed reports with proofs for all the issues identified were shared to the client.
LTTS was able to go beyond its mandate and deliver solutions to fix the identified security vulnerabilities

THE BENEFITS

Fixing the vulnerabilities in the device saved the client potential cost and time in rolling out the device without any recalls or software upgrades
Patient satisfaction led to word-of-mouth popularity both among user and healthcare providers, leading to higher demand for the device
The client’s brand image got a positive boost due to the product’s popularity, leading to it gaining market share across the categories it operated in

Amplifying Data Security for Ultrasound Scanners

THE CUSTOMER AND THE INDUSTRY

The customer is a global leader in critical care equipment manufacturing. Their equipment and devices support critical and post-surgical patients in return to well-being in several hospitals and healthcare facilities across the world.

The customer partnered with LTTS to perform intensive testing on its Ultrasound Scanner to meet UL2900 requirements, one of the most stringent security and safety regulations in the USA.

THE CHALLENGES

The customers Ultrasound Scanner came with advanced features but had security challenges. The device could potentially expose confidential patient data to random users, posing a threat to the compliance process. In order to meet the required guidelines, the equipment had to get over the following vulnerabilities, as established by LTTS testing experts:

A defective access control mechanism left sensitive patient health information visible across the system, even to users with a low access privilege

Insecure logging, with sensitive information like passwords and patient data being disclosed in log files
Insecure device settings – the team identified a shortcut combination that rebooted the device from console mode to service mode without any authentication
The lack of encryption for communication over the device’s ethernet interface made and confidential information such as vital patient data visible in plain text
The absence of access protocol as the device’s RDP connection allowed random users to connect remotely both in console and service mode

OUR SOLUTION

The LTTS team, over 8 weeks conducted a static analysis of the ultrasound scanner’s binaries, application and OS. It also conducted an extensive security assessment of the device, covering Wi-Fi, USB and ethernet interfaces and thick client applications
Attack simulations were conducted to bypass user authentication and authorization, data input validation and DLL Hijacking. LTTS also simulated bypassing the control between the console model of operation to service mode
Reverse engineering and binary source code analysis identified multiple vulnerabilities at the source code level, which could lead to complete device takeover through malicious code injection
Multiple methods to bypass authentication to switch between the two modes of operation of the application were identified
The team discovered vulnerabilities leading to denial of service on the device through network-based attack from its wireless and ethernet ports
By mapping UL2900 standard requirements to the features of the product, we identified gaps in compliance with the standard. Proofs of the same and steps required to mitigate them were presented to the client

BENEFITS

Ensuring UL2900 compliance standard for the device
Making the device 100% secure against malicious attacks and user malpractice
Enabled better patient care and greater confidence within device

Safeguarding Every Breathe for Homecare Patients

THE CUSTOMER AND THE INDUSTRY

Respiratory devices are a critical component of post-surgical care and home treatment of respiratory diseases. Besides their main function of easing the patient’s breathing, they also enable care-givers to monitor the patient’s vital parameters in real-time. Given the critical nature of their functioning, it is essential that they are 100% reliable.

The customer engaged with LTTS o test a home-based Respiratory Therapy device that helps patients recover at home. As this is a life-support device, its connectivity needed to be absolutely secure and available to medical support teams 24/7.

THE CHALLENGES

The device had multiple communication interfaces, consisting of Bluetooth Classic v4, Wi-Fi, and USB. It also had two Firmwares – binary and C files. Each had its own linkages, for which different testing protocols had to be followed. Finally, all had to work in tandem to provide an ideal patient experience. Testing revealed the following weaknesses:

Lack of Firmware security due to the use of insecure functions and hard coded sensitive information. There were no Stack Canaries, Full Relocation Read-Only or NX enablement
Device functionality: An Insecure service enabled (FTP, TFTP), Wi-Fi network allowed access to insecure networks, leaving it vulnerable to WiFi network attacks
The use of hardware components with known high severity vulnerabilities compromised patient statistics by being open to Spoof peripheral devices

OUR SOLUTION

LTTS a performed a Vulnerability Assessment and Penetration Testing of the device. This was a medium-level test process, which we turned around in three weeks
OWASP IoT Top 10 2017 and SANS Top 25 standards were followed for the Bluetooth, Wi-Fi, USB and Firmware modules
Attack simulations included DoS, Spoofing, Fuzzing, Network Assessment, Rubber Ducky, Functionality Check, Firmware Analysis and Console Access
LTTS identified 6 vulnerabilities – 2 medium, 3 low and 1 of informational severity. In this case, too, we not only identified and reported the issues, but were able to deliver solutions that remedied them to the client’s entire satisfaction

BENEFITS

Improved device security
Enabled the client to avoid penalties in case for device failure
Eliminated recall cost associated with software upgrades and device replacement
Ensured consistent device performance without malfunction