Hospital hallway robots get patches for potentially serious bugs

Rolling robots used at hospitals for a variety of tasks — including transporting medication — have been patched for five vulnerabilities that could have allowed attackers to potentially disrupt patient care or capture sensitive information, researchers said Tuesday.

Health care cybersecurity company Cynerio said it found the bugs in Aethon’s TUG robots in December, and then “worked closely” from January onward with the manufacturer through the federal Cybersecurity and Infrastructure Security Agency’s process for disclosing critical vulnerabilities. Aethon said it took “immediate action” after receiving the information from CISA.

“We are pleased that the notification process worked as intended and helped to discover, report, and rectify system vulnerabilities in a collaborative effort so that we can continue to stay a step ahead of bad actors and provide the efficiency systems like ours are made to deliver,” Aethon said.

The most serious of the bugs, which scored 9.8 out of 10 on the open source Common Vulnerability Scoring System, could have allowed an unauthenticated user to connect to the TUG Home Base Server that controls the robots, Cynerio said. Attackers could potentially cancel existing tasks, use a TUG to meddle with elevators and even open and close its drawers.

The vulnerabilities were all zero-days, meaning they were previously unreported by researchers and had no fixes until Cynerio and Aethon produced some. All five bugs “could be exploited both over the network and the internet, and required a very low skill set for exploitation, no special privileges, and no user interaction to be successfully leveraged in an attack,” Cynerio’s researchers wrote.

There is no evidence the vulnerabilities were ever exploited by attackers, Cynerio and Aethon said. But the case is the latest to highlight how internet of things (IoT) devices at medical facilities can present new security challenges as sensors, scanners, robots and other technologies are increasingly connected wirelessly.

Aethon has sold the boxy, versatile TUG robots to dozens of hospital customers nationwide, including 35 at the Department of Veterans Affairs medical system.

“Most hospitals maintain a fleet size of 2-3 dozen” of the machines, said Daniel Brodie, co-founder and chief technology officer at Cynerio, meaning there are thousands in service overall.

Aethon markets TUGs as an alternative to the pneumatic tube or human courier systems that hospitals use to move things like test samples and pharmacy orders. They’re also effective for more mundane housekeeping tasks. The UCSF Medical Center at Mission Bay says that it uses TUGs primarily for “shuttling food trays, trash and supplies down back hallways.”

Given how TUGs semi-autonomously navigate hospitals using cameras, sensors and other technologies, there are multiple hypothetical scenarios where an attack could disrupt care: A robot could tie up an elevator at a critical moment, for example, or be used to gather information about patients, Cynerio said.

Aethon said that there are limits, however, on the system’s connections to hospital networks: “[I]t is important to note our system does not interact with any sensitive data and the vulnerability identified would not have inadvertently exposed patient, staff or financial data.”

Cynerio said it discovered the bugs when it was working on a security audit at an unnamed customer hospital. A researcher “detected anomalous network traffic that seemed to be related to the elevator and door sensors,” the company said, and further investigation led to an open port that “gave the researcher access to a company web portal with information about the Aethon TUG robots’ current status, hospital layout maps, and pictures and video of what the robots were seeing.”

TUG systems do not have to be connected to the open internet, but some hospitals do configure them that way, Cynerio said.

Cynerio labeled the group of bugs as “JekyllBot:5.” In addition to the Home Base Server vulnerability, the other four could allow attackers to add and modify user accounts; access hashed user credentials; and disrupt two specific areas of the TUG system’s Fleet Management Console.

Brodie and the lead researcher on the project, Asher Brass, are both veterans of the Israeli military intelligence’s Unit 8200, which has produced numerous cybersecurity executives and researchers.