Published:
03 February 2020
Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.0950.2
Medtronic Conexus Radio Frequency Telemetry Protocol
3 February 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Medtronic Conexus telemetry
Publisher: ICS-CERT
Impact/Access: Execute Arbitrary Code/Commands -- Console/Physical
Access Confidential Data -- Console/Physical
Unauthorised Access -- Console/Physical
Resolution: Patch/Upgrade
CVE Names: CVE-2019-6540 CVE-2019-6538
Reference: ESB-2019.0950
Original Bulletin:
https://ics-cert.us-cert.gov/advisories/ICSMA-19-080-01
Comment: This bulletin contains two (2) ICS-CERT security advisories.
Revision History: February 3 2020: Mitigating patches have been released for a
variety of models and additional defensive measures detailed.
March 22 2019: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
ICS Medical Advisory (ICSMA-19-080-01)
Medtronic Conexus Radio Frequency Telemetry Protocol (Update A)
Original release date: January 30, 2020
Legal Notice
All information products included in https://us-cert.gov/ics are provided"as
is" for informational purposes only. The Department of Homeland Security (DHS)
does not provide any warranties of any kind regarding any information contained
within. DHS does not endorse any commercial product or service, referenced in
this product or otherwise. Further dissemination of this product is governed by
the Traffic Light Protocol (TLP) marking in the header. For more information
about TLP, see https://www.us-cert.gov/tlp/ .
1. EXECUTIVE SUMMARY
o CVSS v3 9.3
o ATTENTION: Exploitable with adjacent access/low skill level to exploit
o Vendor: Medtronic
o Equipment: MyCareLink Monitor, CareLink Monitor, CareLink 2090 Programmer,
specific Medtronic implanted cardiac devices listed below
o Vulnerabilities: Improper Access Control, Cleartext Transmission of
Sensitive Information
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled
ICSMA-19-080-01 Medtronic Conexus Radio Frequency Telemetry Protocol that was
published March 21, 2019, on the ICS webpage on us-cert.gov.
3. RISK EVALUATION
Successful exploitation of these vulnerabilities may allow an attacker with
adjacent short-range access to one of the affected products to interfere with,
generate, modify, or intercept the radio frequency (RF) communication of the
Medtronic proprietary Conexus telemetry system, potentially impacting product
functionality and/or allowing access to transmitted sensitive data. Successful
exploitation requires: (1) an RF device capable of transmitting or receiving
Conexus telemetry communication, such as a monitor, programmer, or
software-defined radio (SDR); (2) to have adjacent short-range access to the
affected products; and (3) for the products to be in states where the RF
functionality is active. Before the device implant procedure and during
follow-up clinic visits, the Conexus telemetry sessions require initiation by
an inductive protocol. Outside of these use environments, the RF radio in the
affected implanted device is enabled for brief periods of time to support
scheduled follow-up transmissions and other operational and safety
notifications. The result of successful exploitation of these vulnerabilities
may include the ability to read and write any valid memory location on the
affected implanted device and therefore impact the intended function of the
device.
4. TECHNICAL DETAILS
4.1 AFFECTED PRODUCTS
The following products and versions of Medtronic devices utilizing the Conexus
telemetry protocol are affected:
o MyCareLink Monitor, Versions 24950 and 24952
o CareLink Monitor, Version 2490C
o CareLink 2090 Programmer
o Amplia CRT-D (all models)
o Claria CRT-D (all models)
o Compia CRT-D (all models)
o Concerto CRT-D (all models)
o Concerto II CRT-D (all models)
o Consulta CRT-D (all models)
o Evera ICD (all models)
o Maximo II CRT-D and ICD (all models)
o Mirro ICD (all models)
o Nayamed ND ICD (all models)
o Primo ICD (all models)
o Protecta ICD and CRT-D (all models)
o Secura ICD (all models)
o Virtuoso ICD (all models)
o Virtuoso II ICD (all models)
o Visia AF ICD (all models)
- --------- Begin Update A Part 1 of 2 --------
o Viva CRT-D (all models)
o Brava CRT-D (all models)
o Mirro MRI ICD (all models)
Not all devices may be available in in all geographical locations.
- --------- End Update A Part 1 of 2 --------
4.2 VULNERABILITY OVERVIEW
4.2.1 IMPROPER ACCESS CONTROL CWE-284
The Conexus telemetry protocol utilized within this ecosystem does not
implement authentication or authorization. An attacker with adjacent
short-range access to an affected product, in situations where the product's
radio is turned on, can inject, replay, modify, and/or intercept data within
the telemetry communication. This communication protocol provides the ability
to read and write memory values to affected implanted cardiac devices;
therefore, an attacker could exploit this communication protocol to change
memory in the implanted cardiac device.
CVE-2019-6538 has been assigned to this vulnerability. A CVSS v3 base score of
9.3 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:C/
C:N/I:H/A:H ).
4.2.2 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319
The Conexus telemetry protocol utilized within this ecosystem does not
implement encryption. An attacker with adjacent short-range access to a target
product can listen to communications, including the transmission of sensitive
data.
CVE-2019-6540 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:U/
C:H/I:N/A:N ).
4.3 BACKGROUND
o CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health
o COUNTRIES/AREAS DEPLOYED: Worldwide
o COMPANY HEADQUARTERS LOCATION: Ireland
4.4 RESEARCHER
Peter Morgan of Clever Security; Dave Singelee and Bart Preneel of KU Leuven;
Eduard Marin formerly of KU Leuven, currently with University of Birmingham;
Flavio D. Garcia; Tom Chothia of the University of Birmingham; and Rik Willems
of University Hospital Gasthuisberg Leuven reported these vulnerabilities to
CISA.
5. MITIGATIONS
Medtronic has applied additional controls for monitoring and responding to
improper use of the Conexus telemetry protocol by the affected implanted
cardiac devices. Additional mitigations are being developed and will be
deployed through future updates, assuming regulatory approval.
- --------- Begin Update A Part 2 of 2 --------
Metronic has developed mitigating patches for a subset of the affected
implanted cardiac device models. These patches are installed during regular
office visits. Medtronic has stated that patches for additional impacted models
are being developed by Medtronic and will be deployed through future updates.
Patches are currently available for the following affected models:
o Brava CRT-D, all models
o Evera MRI ICD, all models
o Evera ICD, all models
o Mirro MRI ICD, all models
o Primo MRI ICD, all models
o Viva CRT-D, all models
- --------- End Update A Part 2 of 2 --------
Medtronic recommends that users take additional defensive measures to minimize
the risk of exploitation of these vulnerabilities. Specifically, users should:
o Maintain good physical control over home monitors and programmers.
o Use only home monitors, programmers, and implantable devices obtained
directly from your healthcare provider or a Medtronic representative to
ensure integrity of the system.
o Do not connect unapproved devices to home monitors and programmers through
USB ports or other physical connections.
o Only use programmers to connect and interact with implanted devices in
physically controlled hospital and clinical environments.
o Only use home monitors in private environments such as a home, apartment,
or otherwise physically controlled environment.
o Report any concerning behavior regarding these products to your healthcare
provider or a Medtronic representative.
Medtronic has released additional patient focused information .
CISA recommends users take defensive measures to minimize the risk of
exploitation of this vulnerability. Specifically, users should:
o Restrict system access to authorized personnel only and follow a least
privilege approach.
o Apply defense-in-depth strategies.
o Disable unnecessary accounts and services.
o Where additional information is needed, refer to existing cybersecurity in
medical device guidance issued by the FDA.
CISA reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices
on the ICS webpage on us-cert.gov . Several recommended practices are available
for reading and download, including Improving Industrial Control Systems
Cybersecurity with Defense-in-Depth Strategies .
Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage on us-cert.gov in the Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies .
Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to CISA for tracking
and correlation against other incidents.
These vulnerabilities are not exploitable remotely.
For any questions related to this report, please contact the CISA at:
Email: CISAservicedesk@cisa.dhs.gov
Toll Free: 1-888-282-0870
CISA continuously strives to improve its products and services. You can help by
choosing one of the links below to provide feedback about this product.
- --------------------------------------------------------------------------------
Medical Advisory (ICSMA-19-080-01)
Medtronic Conexus Radio Frequency Telemetry Protocol
Original release date: March 21, 2019
Legal Notice
All information products included in http://ics-cert.us-cert.gov are
provided"as is" for informational purposes only. The Department of Homeland
Security (DHS) does not provide any warranties of any kind regarding any
information contained within. DHS does not endorse any commercial product or
service, referenced in this product or otherwise. Further dissemination of this
product is governed by the Traffic Light Protocol (TLP) marking in the header.
For more information about TLP, see http://www.us-cert.gov/tlp/ .
1. EXECUTIVE SUMMARY
o CVSS v9.3
o ATTENTION: Exploitable with adjacent access/low skill level to exploit
o Vendor: Medtronic
o Equipment: MyCareLink Monitor, CareLink Monitor, CareLink 2090 Programmer,
specific Medtronic implanted cardiac devices listed below
o Vulnerabilities: Improper Access Control, Cleartext Transmission of
Sensitive Information
2. RISK EVALUATION
Successful exploitation of these vulnerabilities may allow an attacker with
adjacent short-range access to one of the affected products to interfere with,
generate, modify, or intercept the radio frequency (RF) communication of the
Medtronic proprietary Conexus telemetry system, potentially impacting product
functionality and/or allowing access to transmitted sensitive data. Successful
exploitation requires: (1) an RF device capable of transmitting or receiving
Conexus telemetry communication, such as a monitor, programmer, or
software-defined radio (SDR); (2) to have adjacent short-range access to the
affected products; and (3) for the products to be in states where the RF
functionality is active. Before the device implant procedure and during
follow-up clinic visits, the Conexus telemetry sessions require initiation by
an inductive protocol. Outside of these use environments, the RF radio in the
affected implanted device is enabled for brief periods of time to support
scheduled follow-up transmissions and other operational and safety
notifications. The result of successful exploitation of these vulnerabilities
may include the ability to read and write any valid memory location on the
affected implanted device and therefore impact the intended function of the
device.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following products and versions of Medtronic devices utilizing the Conexus
telemetry protocol are affected:
o MyCareLink Monitor, Versions 24950 and 24952,
o CareLink Monitor, Version 2490C,
o CareLink 2090 Programmer,
o Amplia CRT-D (all models),
o Claria CRT-D (all models),
o Compia CRT-D (all models),
o Concerto CRT-D (all models),
o Concerto II CRT-D (all models),
o Consulta CRT-D (all models),
o Evera ICD (all models),
o Maximo II CRT-D and ICD (all models),
o Mirro ICD (all models),
o Nayamed ND ICD (all models),
o Primo ICD (all models),
o Protecta ICD and CRT-D (all models),
o Secura ICD (all models),
o Virtuoso ICD (all models),
o Virtuoso II ICD (all models),
o Visia AF ICD (all models), and
o Viva CRT-D (all models).
3.2 VULNERABILITY OVERVIEW
3.2.1 IMPROPER ACCESS CONTROL CWE-284
The Conexus telemetry protocol utilized within this ecosystem does not
implement authentication or authorization. An attacker with adjacent
short-range access to an affected product, in situations where the product's
radio is turned on, can inject, replay, modify, and/or intercept data within
the telemetry communication. This communication protocol provides the ability
to read and write memory values to affected implanted cardiac devices;
therefore, an attacker could exploit this communication protocol to change
memory in the implanted cardiac device.
CVE-2019-6538 has been assigned to this vulnerability. A CVSS v3 base score of
9.3 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:C/
C:N/I:H/A:H ).
3.2.2 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319
The Conexus telemetry protocol utilized within this ecosystem does not
implement encryption. An attacker with adjacent short-range access to a target
product can listen to communications, including the transmission of sensitive
data.
CVE-2019-6540 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is ( AV:A/AC:L/PR:N/UI:N/S:U/
C:H/I:N/A:N ).
3.3 BACKGROUND
o CRITICAL INFRASTRUCTURE SECTORS : Healthcare and Public Health
o COUNTRIES/AREAS DEPLOYED: Worldwide
o COMPANY HEADQUARTERS LOCATION: Ireland
3.4 RESEARCHER
Peter Morgan of Clever Security; Dave Singelee and Bart Preneel of KU Leuven;
Eduard Marin formerly of KU Leuven, currently with University of Birmingham;
Flavio D. Garcia; Tom Chothia of the University of Birmingham; and Rik Willems
of University Hospital Gasthuisberg Leuven reported these vulnerabilities to
NCCIC.
4. MITIGATIONS
Medtronic has applied additional controls for monitoring and responding to
improper use of the Conexus telemetry protocol by the affected implanted
cardiac devices. Additional mitigations are being developed and will be
deployed through future updates, assuming regulatory approval.
Medtronic recommends that users take additional defensive measures to minimize
the risk of exploitation of these vulnerabilities. Specifically, users should:
o Maintain good physical control over home monitors and programmers.
o Use only home monitors, programmers, and implantable devices obtained
directly from your healthcare provider or a Medtronic representative to
ensure integrity of the system.
o Do not connect unapproved devices to home monitors and programmers through
USB ports or other physical connections.
o Only use programmers to connect and interact with implanted devices in
physically controlled hospital and clinical environments.
o Only use home monitors in private environments such as a home, apartment,
or otherwise physically controlled environment.
o Report any concerning behavior regarding these products to your healthcare
provider or a Medtronic representative.
Medtronic has released additional patient-focused information at the following
location:
https://www.medtronic.com/security
NCCIC recommends users take defensive measures to minimize the risk of
exploitation of this vulnerability. Specifically, users should:
o Restrict system access to authorized personnel only and follow a least
privilege approach.
o Apply defense-in-depth strategies.
o Disable unnecessary accounts and services.
o Where additional information is needed, refer to existing cybersecurity in
medical device guidance issued by the FDA that can be found at the
following location:
https://www.fda.gov/MedicalDevices/DigitalHealth/ucm373213.htm
NCCIC reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended
practices on the ICS-CERT web page. Several recommended practices are available
for reading and download, including Improving Industrial Control Systems
Cybersecurity with Defense-in-Depth Strategies .
Additional mitigation guidance and recommended practices are publicly available
on the ICS-CERT website in the Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies .
Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to NCCIC for tracking
and correlation against other incidents.
No known public exploits specifically target these vulnerabilities. These
vulnerabilities require adjacent short-range access to the affected devices to
be exploited.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXjdmGGaOgq3Tt24GAQh/HxAAiO/27BgAUDpjUBtsWU79ar6mpHHQGf+S
/L5IOPr8kavbw26K5yaGH4Bskn83CqqG9X2APLvUPjfU8n8cBnO7WquwzLo74LY4
L3QfRzYmsHx8bzYdY4/V4cW56IaoccYGFBsTh1V4aTjnxXW7zkHdYthYryUemPuc
Ufxi6uTcTxnZ2o41SOv6DdlJ2d2zd9XnD6N9O+H+dHYLe7KzuroDmDNa5CJAUmye
enuOdWDylD752RwTXJIWofIrcRgOhbaGIOUPhHowH0p5APj8IjgHETFWxwqr9hFC
Vz9fZPwpoVwQC9B3uCc8BDEOl7nFdZsd0yYqV9gdrUycrgqtkWJAgBNIajWDvw/q
gNAb6NY6dOEqwhwRvzN0KqSLnXmzmlcxHT2lk7TRtfCslPMlqfdz/iJfBL+MVHHM
wYK+j4JuHpGqutXraqL85JGLJuc906atN2UCbzoqTSyroQLVIYE0727CFPPBYTFP
jZq75O/jDGxnXBXhkEPSHefprh83bbZO3VfLYhv8aZ71Ih+o4g5viWwSDb9iDYSk
szRSPAG8pfJtzmyEToBl4sbUsBHbufY51A0SuAP5Yk7Km0+jNq9DarfE1q9y8/it
IrS4dQdxYrsisfM4FdNnVeWfIVAAIiocvUkhiK2ksju+JyihtpREXb4ecvDXK8bJ
VTAekvHvPyM=
=++HL
-----END PGP SIGNATURE-----