Brain monitor had remote code execution and DoS flaw

I told you I was sick

Cisco’s Talos security limb has warned that specialist medical hardware has remote code execution and denial of service bugs.

Talos researchers say Natus Xltek EEG medical products are susceptible to “A specially crafted network packet” that “can cause a stack buffer overflow resulting in code execution.”

Which is rather scary because the Xltek EEG range includes the Xltek EEG32U Electroencephalography (EEG) recorder and the Xltek Brain Monitor.

As Talos explains, the vulnerabilities create two risks. One is that bad code running on the devices could see someone mess with the data they produce, which is heavily sub-optimal as they’re designed as diagnostic tools. The other is that hacking a brain monitor or EEG device offers a route into other parts of a healthcare facility. Which is also bad because they’re chock full of confidential records.

The good news is that Talos diagnosed the problems and Natus inoculated its kit against the threats. So if Natus users have done their patching, this should be no more serious than a dose of man-flu.

As messes like the Equifax horror demonstrate, it’s best not to assume patches have been done properly. So if your next brain scan produces some bad vibrations, please tell your doctor it's not a sign of a sick mind, you’re just worried about proper patching! ®