IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

PwnedPiper flaws threaten infrastructure of 80% of US hospitals

Pneumatic tube systems could be hacked, putting patients at risk

female nurse looking after a male patient in bed

Nine critical vulnerabilities in a popular hospital pneumatic tube software could enable hackers to take control of systems and launch a range of attacks.

Researchers at security platform provider Armis unearthed the flaws and dubbed them PwnedPiper. They found the vulnerabilities in the Nexus Control Panel, which powers all current models of Translogic’s pneumatic tube system (PTS) stations by Swisslog Healthcare. 

This technology is a critical piece of health care infrastructure used in more than 3,000 hospitals worldwide. The tubes deliver medication, blood, and lab samples across multiple departments of a hospital. 

Researchers noted the tube systems are connected to the internet but "despite the prevalence of these systems, and the reliance of hospitals on their availability to deliver care, the security of these systems has never been thoroughly analyzed or researched." 

According to researchers, these flaws could let hackers take over PTS stations and gain full control over the target hospital’s tube network. In turn, an attacker could launch a denial-of-service on critical infrastructure or man-in-the-middle attacks, resulting in deliberate sabotage of the hospital’s workings.

"Understanding that patient care depends not only on medical devices, but also on the operational infrastructure of a hospital is an important milestone to securing healthcare environments," said Nadir Izrael, co-founder and CTO at Armis.

Five of the vulnerabilities in PwnedPiper allow remote code execution, which hackers could use to access a hospital network and then take over Nexus stations. 

Related Resource

X-Force Threat Intelligence Index

Top security threats and recommendations for resilience

Transparent cube against a black background - whitepaper from IBMFree download

By compromising a Nexus station, an attacker can carry out reconnaissance, including harvesting data from the station, such as RFID credentials of any employee who uses the PTS system, details about each station’s functions or location, and the physical layout of the PTS network.

From there, hackers can take over all Nexus stations in the tube network and possibly launch a ransomware attack.

Armis said it disclosed the vulnerabilities to Swisslog in early May and has been working with the manufacturer to test the available patch and ensure proper security measures will be provided to customers. Swisslog Healthcare has released a security advisory today.

Researchers said while such an attack may ultimately be remediated with manual firmware upgrades of all compromised stations, such a process will take considerable time and effort. 

“Hospitals don’t necessarily have any contingency in place to handle a prolonged shutdown of the PTS system, which ultimately may translate to harm to patient care,” said researchers.

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

Best free malware removal tools 2022
Security

Best free malware removal tools 2022

22 Jun 2022
A guide to cyber security certification and training
Careers & training

A guide to cyber security certification and training

16 Jun 2022
What is shoulder surfing?
social engineering

What is shoulder surfing?

10 Jun 2022
CIAM buyer’s guide
Whitepaper

CIAM buyer’s guide

6 Jun 2022

Most Popular

Actively exploited server backdoor remains undetected in most organisations' networks
cyber attacks

Actively exploited server backdoor remains undetected in most organisations' networks

1 Jul 2022
Macmillan Publishers hit by apparent cyber attack as systems are forced offline
Security

Macmillan Publishers hit by apparent cyber attack as systems are forced offline

30 Jun 2022
Former Uber security chief to face fraud charges over hack coverup
data breaches

Former Uber security chief to face fraud charges over hack coverup

29 Jun 2022