In our previous installments of the Leaking Beeps research series, we have discussed that both healthcare and industrial control systems have been sending clear text messages via the pager communications protocols POCSAG and FLEX. We were surprised to see pages containing sensitive patient information when we looked into the use of pagers in the healthcare sector. We were just as alarmed to see the number of automation systems in industrial environments that were utilizing POCSAG and FLEX as wireless communications paths. This gave a lot of information away to a potential attacker who could use them in a future attack.
Industrial Control Systems (ICS) are a hot topic in the security industry today, thanks to the prevalence of software that is often riddled with security flaws and legacy protocols that were designed without any type of security. Many of these systems were designed in a different time, when the world was quite different. ICS systems used to be isolated, Internet access was rare and expensive, and hacking knowledge was not as widespread as it is today. It would be very difficult for a programmer to have foreseen some of the security issues that have now come about. As a result, however, this often translates to cases where solutions are developed to get the most out of the system while maintaining a cost-conscious mindset. As a result, there are cases where software and protocols that were never meant to be part of an ICS system end up as part of such a system. Continue reading
5 attack scenarios and 3 tips how to avoid them
Article written by specialists at the Trend Micro Foward-Looking Threat Research Lab
Over sixty years ago, healthcare professionals were among the first to adopt a new communication tool: the pager. This little instrument combined technology from walkie-talkies and automobile radios, resulting in a handy little tool that allowed the transmission of messages (or ‘pages’) to other pagers up to 25 miles away. And although smartphones have taken over communication in the outside world, the healthcare industry has never really said goodbye to pagers. They offer a few crucial advantages to healthcare professionals: they don’t suffer from the often weak cellular coverage in hospitals nor do they interfere with medical equipment. Continue reading