0HGLFDOVWD̆WKHVHGD\VXVHFOLQLFDOSURGXFWLYLW\VRIWZDUH'RFWRUV¶QRWHVJR
into it, as do insurance coding data, patient instructions, and more. Foglie
IRXQGDEDFNGRRUWKDWJDYHDFFHVVWRPRUHWKDQSDWLHQWUHFRUGV
'UXJGLVSHQVLQJDQGPRQLWRULQJPXVWVXUHO\EHWKHPRVWVHFXUHULJKW":HOO
no. Foglie found an easy way in. “We could dump usernames and passwords,”
he explained, “and gain access to the drug distribution system. We could add
ourselves as a user at any level. What a headache! We could even steal some
acetaminophen.”
)RJOLHQRWHGWKDWWKHYHQGRU¿[HGWKLVRQHULJKWDZD\DQGWKDWWKH\GLGQ¶W
really steal any headache pills.
7KHOLWDQ\ZHQWRQ)RJOLHIRXQGÀDZVLQWKHWHPSHUDWXUHPRQLWRULQJV\VWHP
WKDWFRXOGOHWDPDOHIDFWRUWDNHFRQWUROUHVXOWLQJLQLQH̆HFWLYHPHGVRUHYHQ
SRLVRQLQJ7KDW1XUVH&DOOV\VWHP",W¶VQRWMXVWDEX]]HULW¶VDIXOOVFDOHDSS
and it has a hard-coded backdoor password. As for the imaging system, they got
access easily by tweaking the code to accept only the wrong password. Finally,
Foglie and his team gained full access to the “Downtime Device” that provides
local information to a clinic when its datacenter is unavailable.
Photo^ Credit:^ Ariel^ Witthaya^Prasongsin/Getty