Hospital robots are supposed to be your plastic pal who is fun to be with while you are having an unpleasant experience in hospital. They transport medications, bed linen, food, medications and laboratory specimens across a hospital campus.
They have space to transport critical goods and security access to enter restricted parts of the hospital and ride elevators, all while cutting labour costs.
Insecurity experts at Cynerio, a cybersecurity startup focused on securing hospital and healthcare systems, found five vulnerabilities in one breed of Aethon robots which they say allowed malicious hackers to remotely hijack and control them.
The five vulnerabilities, which Cynerio collectively call JekyllBot:5, aren't with the robots themselves but with the base servers that are used to communicate with and control the robots that traverse the hallways of the hospitals and hotels.
The bugs range from allowing hackers to create new users with high-level access in order to then log in and remotely control the robots and access restricted areas, snoop on patients or guests using the robot's in-built cameras, or otherwise cause mayhem.
Asher Brass, the lead researcher on the Aethon vulnerabilities, warned that the flaws required a "very low skill set for exploitation."
Cynerio said the base servers have a web interface that could be accessed from inside the hospital's network, allowing "guest" users to view real-time robot camera feeds and their upcoming schedules and tasks for the day without needing a password.
Although the robots' functionality were protected by an "admin" account, the researchers said the vulnerabilities in the web interface could have allowed a hacker to interact with the robots without needing an admin password to log in.
One of the five bugs, the researchers said, exposed robots to remote control using a joystick-style controller in the web interface, while exploiting another one of the bugs to interact with door locks, call and ride elevators, and open and close medication drawers.
"The bugs were fixed in a batch of software and firmware updates released by Aethon, after Cynerio alerted the company to the issues," notes TechCrunch. "Aethon is said to have restricted internet-exposed servers to isolate the robots from potential remote attacks, and fixed other web-related vulnerabilities that affected the base station."