Backdoor found in two healthcare patient monitors, linked to IP in China

The US Cybersecurity and Infrastructure Security Agency (CISA) is warning that Contec CMS8000 devices, a widely used healthcare patient monitoring device, include a backdoor that quietly sends patient data to a remote IP address and downloads and executes files on the device.

Contec is a China-based company that specializes in healthcare technology, offering a range of medical devices including patient monitoring systems, diagnostic equipment, and laboratory instruments.

CISA learned of the malicious behavior from an external researcher who disclosed the vulnerability to the agency. When CISA tested three Contec CMS8000 firmware packages, the researchers discovered anomalous network traffic to a hard-coded external IP address, which is not associated with the company but rather a university.

This led to the discovery of a backdoor in the company's firmware that would quietly download and execute files on the device, allowing for remote execution and the complete takeover of the patient monitors. It was also discovered that the device would quietly send patient data to the same hard-coded address when devices were started.

None of this activity was logged, causing the malicious activity to be conducted secretly without alerting administrators of the devices.

While CISA did not name the university and redacted the IP address, BleepingComputer has learned that it is associated with a Chinese university. The IP address is also hard-coded in software for other medical equipment, including a pregnancy patient monitor from another Chinese healthcare manufacturer.

An FDA advisory about the backdoor also confirmed that it was also found in Epsimed MN-120 patient monitors, which are re-labeled Contec CMS8000 devices.

The backdoor

On analyzing the firmware, CISA found that one of the device's executables, 'monitor,' contains a backdoor that issues a series of Linux commands that enable the device's network adapter (eth0) and then attempts to mount a remote NFS share at the hard-coded IP address belonging to the university.

The NFS share is mounted at /mnt/ and the backdoor recursively copies the files from the /mnt/ folder to the /opt/bin folder.

The backdoor will continue to copy files from /opt/bin to the /opt folder and, when done, unmount the remote NFS share.

"Though the /opt/bin directory is not part of default Linux installations, it is nonetheless a common Linux directory structure," explains CISA's advisory.

"Generally, Linux stores third-party software installations in the /opt directory and thirdparty binaries in the /opt/bin directory. The ability to overwrite files within the /opt/bin directory provides a powerful primitive for remotely taking over the device and remotely altering the device configuration."

"Additionally, the use of symbolic links could provide a primitive to overwrite files anywhere on the device filesystem. When executed, this function offers a formidable primitive allowing for a third-party operating at the hard-coded IP address to potentially take full control of the device remotely."

While CISA has not shared what these files perform on the device, they said they detected no communication between devices and the hard-coded IP address, only the attempts to connect to it.

CISA says that after reviewing the firmware, they do not believe this is an automatic update feature, but rather than a backdoor planted in the device's firmware.

Further lending to this being a backdoor by design, CISA found that the devices also began sending patient data to the remote IP address when the devices started.

CISA says that patient data is typically transmitted across a network using the Health Level 7 (HL7) protocol. However, these devices sent the data to the remote IP over port 515, which is usually associated with the Line Printer Daemon (LPD) protocol.

The transmitted data includes the doctor's name, patient ID, patient's name, patient's date of birth, and other information.

After contacting Contec about the backdoor, CISA was sent multiple firmware images that were supposed to have mitigated the backdoor.

However, each one continued to contain the malicious code, with the company simply disabling the 'eth0' network adapter to mitigate the backdoor. However, this mitigation does not help as the script specifically enables it using the ifconfig eth0 up command before mounting the remote NFS share or sending patient data.

Currently, there is no available patch for devices that removes the backdoor, and CISA recommends that all healthcare organizations disconnect these devices from the network if possible.

Furthermore, the cybersecurity agency recommends organizations check their Contec CMS8000 patient monitors for any signs of tampering, such as displaying information different from a patient's physical state.

BleepingComputer contacted Contec with questions about the firmware and will update the story if we receive a response.