By Vincentas Baubonis, Head of Security Research at Cybernews
The recent discovery of a backdoor in the Contec CMS8000 patient monitor – revealed by CISA – should be a wake-up call for anyone in the cybersecurity or healthcare sectors. This is not a rare, isolated issue.
A report by the US Government Accountability Office (GAO) highlighted that, as of January 2022, 53% of connected medical devices and other Internet of Things devices in hospitals had known critical vulnerabilities, emphasizing the widespread nature of this problem.
These findings indicate that many of the devices we rely on in healthcare are very vulnerable. Specifically, the CMS8000 backdoor allows remote access, potentially enabling attackers to manipulate vital signs monitoring or leak sensitive patient data without detection. And as terrifying as this case is, it’s just one example of a much broader, deeply ingrained problem.
Let’s talk numbers. According to the Cybernews Business Digital Index, the healthcare industry is performing terribly when it comes to cybersecurity. A full 22% of analyzed healthcare companies scored a D in security, and nearly half – 48% – earned an F. Only 5% of the sector’s organizations reached an A. With an average security score of just 69, healthcare comes in dead last when it comes to cybersecurity. That should make everyone in this field sit up and take notice.
The reality is, medical devices like the Contec CMS8000 aren’t being designed with the security they require. With more and more devices connecting to the internet and sharing sensitive data, this is a ticking time bomb. Healthcare organizations are failing to enforce the most basic security measures. In the worst cases, manufacturers are shipping devices with poorly coded firmware that’s vulnerable to remote manipulation – leaving hospitals, doctors, and patients exposed. Devices bought by critical sectors should be evaluated technically before acquisition and potential risks associated with them must be managed and mitigated by the buyer.
Medical devices like the Contec CMS8000 often lack essential security features, making them vulnerable to cyber threats. As more devices connect to the internet and handle sensitive patient data, the risks increase significantly. Reports from regulatory agencies, including the FDA and CISA, have repeatedly highlighted security flaws in medical devices, including vulnerabilities that allow remote access and data exposure.
In some cases, manufacturers ship devices with outdated or insecure firmware, exposing healthcare providers and patients to potential cyberattacks. To mitigate these risks, healthcare organizations must enforce stricter security evaluations before procurement, ensuring that all devices meet established cybersecurity standards and that identified vulnerabilities are promptly addressed.
Medical devices need to be treated with the same rigor as any other critical infrastructure. But far too often, the focus is on getting the device to market quickly, not securing it properly. This oversight has immediate consequences: data breaches, privacy violations, and, in the worst cases, loss of life.
So, what needs to happen now? First and foremost, cybersecurity must be baked into the design and testing of every medical device. Manufacturers must adopt a security-first mindset, regularly updating their devices and using secure coding practices to eliminate these vulnerabilities before they hit the market. Healthcare providers, too, must take ownership by ensuring their networks are secure and implementing strong access controls on all connected devices.
This is not a problem that can be solved with band-aid fixes. It’s time for a fundamental shift. If the healthcare industry doesn’t start prioritizing cybersecurity across the board, incidents like the CMS8000 backdoor will continue to be just the tip of the iceberg, especially against the backdrop of rising state-backed cyberattacks.
ABOUT THE EXPERT
Vincentas Baubonis is an expert in Full-Stack Software Development and Web App Security, with a specialized focus on identifying and mitigating critical vulnerabilities in IoT, hardware hacking, and organizational penetration testing. As Head of Security Research at Cybernews, he leads a team that has uncovered significant privacy and security issues affecting high-profile organizations and platforms such as NASA, Google Play, and PayPal. Under his leadership, the Cybernews team conducts over 7,000 pieces of research annually, publishing more than 600 studies each year that provide consumers and businesses with actionable insights on data security risks.
Bell and Virgin Plus are offering new limited-time roaming deals
Posted in Commentary with tags Bell on February 21, 2025 by itnerdBell and Virgin Plus both have a new limited-time roaming deals which are perfect for families heading off on March Break and spring getaways. These discounted rates on Roam Better (Bell) and Roam Sweet Roam (Virgin Plus) with Home Data offer significant savings for families travelling together.
From now until May 29th, 2025, the first account member roaming on any given day pays the standard rate ($13/day US, $16/day international). Additional members on the same account roaming that same day receive a 50% discount, paying only $6.50/day in the US and $8/day internationally.
Members can be in different Roam Better/Roam Sweet Roam international destinations and still get the discount if it is the same day. However, the offer does not apply if a member is in the U.S. and the other member is in an international destination.
Leave a comment »