Automated drug cabinets have 1400+ critical vulns that will never be patched

It’s not just the hardware. The darn things were running on WIn XP. You get a lot of issues from hardware vendors not updating OS’s until past the point the OS vendor doesn’t even support them. (I’m sure you’re aware, but just to point it out.)

2 Likes

XP got 10 years and then some if you are willing to pay microsoft for it. The thing that should be designed into big bits of hardware like this is the ability to update the computing component without replacing everything else. Of course that doesn’t help with the company goes away as in this case. There isn’t anyone to go to other than spend a metric ton of dollars on replacing the whole thing.

2 Likes

I’m sure that the selling point of the (probably very expensive by the looks of it) machine is, indeed, to eliminate as many logistics-related people as possible.

My point was just that this sort of sales pitch is only possible at all in environments where theft and diversion are considered enough of a concern that inventory management is highly labor intensive. If the stuff you are dealing with isn’t legally controlled and is relatively cheap and/or not worth pawning/fencing, the main competition for logistics workers isn’t fancy hardware, it’s just not caring very much. In your basic cube farm type environment, somebody has to steal a lot of pens before they erode the savings of the “Eh, the box is in the supply cabinet, just remember to send an email if you see it getting low so we can re-order.” method.

Sometimes, those “most people are reasonably honest and/or too lazy to steal much” schemes do break down; and you end up with a hunt for the paper-clip-pilferer or some poor secretary getting stuck playing gatekeeper; but you can’t really sell an expensive, complex, ‘solution’ unless the inventory being controlled is serious enough that controlling it is an expensive, complex, problem.

(There are some edge cases, like the napkin dispensers used in fast-food places, where a hybrid approach is used; there are no formal accounting and control measures in place; but the dispenser is specifically designed to provide napkins one at a time and make you pull each one in turn, unlike a box of them, where you can just grab a small stack without difficulty. Apparently people overestimate how many they’ll need if grabbing anything between one and a handful is equally easy; but take significantly fewer if they have to actually take them one by one.)

Totally agree, and the ability to upgrade software for hardware systems is going to be even more of an issue with embedded as well. (I think you and I bantered briefly about it in another thread.)

As far as being discontinued, isn’t it just the software support in this case and not the company going away?

The cabinets are based on Microsoft’s discontinued Windows XP/Server 2000 products. Carefusion will not issue patches for the old systems, but they have provided some advice to help customers mitigate the risk from these bugs.

Maybe I read over the article carelessly. I’ll go back and double check…

Perhaps you were referring to the acquisition of the company as I now see happened as well. Maybe we can swap acquisition stories sometime, though it will have to be in person over a beer. :slight_smile:

1 Like

I need to read it again. Not sure where I got the idea Carefusion was gone. But yeah they should be able to gank the computing guts and update that for a lot less than replacing the whole thing.
But then the software itself may not run on a current OS too. It is a mess.
We are looking at having to go to win10 for the enterprise early next year and the software I support at least for the version of it isn’t supported by the vendor for win10, and we just had a hell of a time getting to that version as it is at least supported.
On the plus side it looks like it does work… but we will probably have to scramble to to from current.0.x to current.1.x hopefully with a lot less pain.

1 Like

CareFusion as a company is virtually gone. Becton Dickinson bought them out in 2015. Thus helping BD become an overly large player in the niche area of infusion products … :worried:

2 Likes

Still, does the pharm parm kid need OpenBSD, or just freebsd or a core linux to get cracking with? That’s assuming ScriptPro doesn’t have a refit division themselves?

Also, how’s that thing where patients who can’t walk go from practice to practice (St. Beiderbaum’s Ayurvedic Consult, I Choose You!) (UrbanBurger Chi Worker, Go!) and the practitioners deal out of pocket computers until the patient leaves, going?

1 Like

Minecraft Clinical Loops Edition, v0.13; better med builds, better patient data, replayable as not previously replayable.

It’s a mess. Any ideas on how to fix, or just going to spout off like a smartass?

2 Likes

Who needs earthquake satellites when you have crap like this lying around?

“Should I release the swarm of assassin-bots, director?”

“No, wait, he’s scheduled for a tonsillectomy next Thursday. Mwuahahahaha!”

1 Like

Send like that “cancer” Linux would have been a really good idea to demand of their supplier…

I used to work at a company that manufactured monitors used in ORs. We developed several devices with the capability to be connected to the Internet with the intent of being able to view error logs remotely. I believe that the number of instances where we were actually able to connect one of these devices to the Interwebs was NEVER. Most hospitals are very careful with their IT systems and will not allow any of their internal networks to connect to the Internet. So, just because it has the capability to connect doesn’t mean any of them ever are.

6 Likes

this changed in the last few years to the worse. many manufacturers don’t sell devices without a service agreement and use printer-like DRM (the reagent had to be changed? bad luck if the inet is down, the new cartridge needs to be accepted by the mothership).

1 Like

Wow, that is a bad idea.

Not our device, but once we had a teleconferencing system camera we’d installed hacked because - yeah, it’s true - the hospitals virtually never change the default passwords on the darn things. Good thing there was no Internet connection. There’s all kinds of weak protection on hospital devices that make Internet connections such a bad idea.

4 Likes

In 7 of 10 cases the user and password for the HIS is in the ward’s office*, second drawer from the top (honestly, I saw it myself in 3 hospitals and asked everyone I know working in hospitals).

* is this a valid English term?

1 Like

Maybe head nurse is the term you are looking for?

Password protection is a total joke and I would like to see it destroyed. Many years ago I had a secure login via Internet to a company VPN. They gave us a card which updated every 30 seconds with a long code we had to use when we logged in. I thought it was brilliant. The code generator feature on Facebook is similar. I do not understand why every secure system doesn’t use some kind of code generating system.

1 Like

I don’t mean a person but the room in a hospital ward that functions as office and staff room.

And yes, multifactor authorisation is the way to go. We’re using such a token system (PIN+code) whenever possible, but sometimes the supplier is not able (willing?) to cooperate.

1 Like

Please do at least a tiny amount of research on the Pyxis SuplyStation product before you post an article such as this.

The SupplyStation has NEVER contains meds, nor will it, as it is only for patient supplies such as tape, bandages, etc.

The Pyxis MedStation is the product that contains medications for the patients, and once you research it, you will see that it is a valuable product, not only to the hospital, but to the patients, for with the system, a Dr. can enter an order for a medication for a patient into the HIS, be it Epic, or HL7, or whatever the hospital uses, and that order will be passed over to the Pyxis system within a couple of minutes, and forwarded to the Medstation, and the nurse will be able in most cases to go to the Medstation, and dispense the med that was ordered by the Dr. within minutes, instead of hours.

Yes, i am a field tech that works on all of the Pyxis products offered, i have been a CardinalHealth, Carefusion, and now a BD employee during my tenure, and have been doing this for 16 years, and i firmly believe in the products, not only as an employee, but as an open heart patient that was in a facility that incorporated the Medstation system, and know first hand the speed that the nursing staff was able to get me any newly ordered, or regularly scheduled meds, was invaluable to me as i lay there with a chest that had just been sawed thru and put back together with wire ties and stitches.

Please do your research before you write an article such as this, so you do not come off looking like a fool in the eyes of those that know the product to which you refer.

thanks.

and what does this have to do with a device that has security holes in that if found could open the entire hospital up to well gee we had 4 reports of hospitals being near shutdown from ransomware… gee i wonder how that could happen with an OS that is a security nightmare and not getting patched and the software vendor refuses to support? and it is on the network where other machines can talk to it?
what could possibly go wrong here?

how much does one of these cabinets cost? it obviously is still actually useful but if proper security was taken right now it would be air gapped which would break what it is actually useful for. maybe just maybe you could design proper computing security and an computing only upgrade path for the device in the first place instead of having to possibly junk what would otherwise be a working system just because the OS is old?

3 Likes

Alas, they’re still being used in the far future in the Firefly 'verse. Probably still unpatched!

6 Likes