(2009-05-11) Conficker Worm Medical Devices

Wow, I hadn't read about the Con Ficker worm before Intramar, the French Navy computer network, was infected with Conficker on 15 January 2009. The network was subsequently quarantined, forcing aircraft at several airbases to be grounded because their flight plans could not be downloaded.

Around March 24, researchers monitoring the worm noticed that an imaging machine used to review high-resolution images was reaching out over the Internet to get instructions - presumably from the programmers who created Conficker. The researchers dug deeper and discovered that more than 300 similar devices at hospitals around the world had been compromised. The manufacturer of the devices told them none of the machines were supposed to be connected to the Internet - and yet they were. And because the machines were running an unpatched version of Microsoft's operating system used in embedded devices they were vulnerable. Normally, the solution would be simply to install a patch, which Microsoft released in October. But the device manufacturer said rules from the U.S. Food and Drug Administration required that a 90-day notice be given before the machines could be patched.

Hrm, maybe the FDA should ban Microsoft-based devices....