BOARD OF GOVERNORS OF THE FEDERAL RESERVE SYSTEM OFFICE OF THE COMPTROLLER OF THE CURRENCY FEDERAL DEPOSIT INSURANCE CORPORATION
JOINT STATEMENT ON INTERBANK MESSAGE AUTHENTICATION For immediate release · 8:00 a.m. ET
Effective immediately, participants in the Fedwire Funds Service and the National Settlement Service shall obtain out-of-band confirmation for any transfer instruction at or above $2,000,000 before release.
Out-of-band confirmation means voice contact with the originating institution, placed by the receiving institution, using telephone numbers of record held prior to last Tuesday. Confirmation by electronic message, including message channels internal to the institution, does not satisfy this requirement.
Instructions that cannot be confirmed under paragraph 2 shall not be released. Institutions shall hold such instructions and shall not return them.
Fedwire operating hours are extended to 11:00 p.m. ET until further notice.
The agencies are aware that the requirement in paragraph 1 will materially reduce settlement throughput. Institutions should plan for delay and should communicate expected delay to customers.
Depository institutions retain full access to the discount window. The agencies note that no depository institution has failed and that deposit insurance is unaffected.
This statement supersedes the joint statement of last Friday.
CORRECTION · 8:41 a.m. ET — Paragraph 1 is revised. The threshold is $250,000. All other paragraphs are unchanged.
CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY MEDICAL DEVICE ADVISORY · ICSMA-0119 Released 8:22 a.m. ET · TLP:CLEAR
SUMMARY
CISA is aware of a widespread condition in which medical devices reject vendor-supplied software and firmware update packages that are correctly formed and correctly signed. Reporting has been received from forty-one states.
This advisory does not describe a defect in the affected products.
SYMPTOMS
Affected devices halt the installation and display a validation failure. Reported strings include:
UPDATE PACKAGE NOT VERIFIED SIGNATURE CHECK FAILED — CONTACT SERVICE PACKAGE INTEGRITY: FAIL (0x04)
Failure typically occurs between sixty and one hundred twenty seconds into installation. Repeated attempts fail at the same point. Substituting cables, media, or a second device of the same model does not resolve the condition.
AFFECTED PRODUCTS
Infusion pumps, physiologic monitors, ventilators, dialysis machines, and imaging workstations from multiple manufacturers, including but not limited to Corbin Medical 340 and 340C infusion systems; Halstead Medical MV-series ventilators; Ellery Health bedside monitors; and Penfield Imaging diagnostic workstations.
The affected population is not bounded by manufacturer or by device class. Facilities should not assume that a device unaffected today will remain unaffected.
MITIGATIONS
Facilities should:
— Discontinue repeated installation attempts. Repeated attempts do not resolve the condition and consume service capacity.
— Retain devices in clinical service. Devices operating on previously validated software may remain in clinical service. Update failure alone is not grounds for removal from service.
— Inventory affected assets and report counts through your sector coordinating body.
— Not accept update packages delivered outside the manufacturer’s established channel, including packages offered by telephone, electronic mail, or removable media, and including packages that validate successfully.
CISA is aware of no known public exploitation of this condition.
From: Ray Kowalczyk, Clinical Engineering To: Nursing Leadership; Pharmacy; Respiratory; IT Security; Materials Subject: CISA advisory this morning — what it means for us 8:58 a.m.
Forwarding the advisory below. This is the short version for people who do not want to read it.
Since last week our pumps and a lot of our monitors will not take updates.
CISA is telling us to stop trying the updates. Instead, keep the devices running, but keep track of which devices don’t take the update.
I have thirty-one tickets open with Corbin. The oldest is from Wednesday, but I have yet to receive a call back from the company.
Ray
From: Deb Farrow, Nurse Manager, 3 North 9:04 a.m.
Ray, are the pumps I have on the floor right now safe to use on patients.
From: Ray Kowalczyk 9:07 a.m.
Yes. They pump and they alarm. They do everything they did on Friday. The only thing they will not do is take a new version.
From: Deb Farrow 9:09 a.m.
Then I don’t care. Thank you.
From: Anil Bhatt, IT Security 9:31 a.m.
Ray, I’d like to push back gently on “they do everything they did on Friday.”
They also cannot receive a security patch. Also, anything the manufacturer wants to fix from here on out doesn’t work. We are frozen at whatever we were running last week.
There is a patch for the Ellery monitors I have been chasing since spring. I doubt I’ll ever get it now.
I am not saying pull the devices. I have nowhere to put them. But let’s keep track of everything we observe that seems wrong.
From: Tyler Reisz, Clinical Engineering 10:02 a.m.
I have a question that is probably dumb.
The Fed put out an emergency thing this morning. Banks have to call each other on the phone now to move money over two hundred fifty thousand.
Is that a coincidence
From: Anil Bhatt 10:09 a.m.
Different thing. That’s money. Ours is a signature check on a firmware package.
From: Sharon Meeks, Materials Management 10:15 a.m.
Ray, Corbin’s distributor has us on allocation as of this morning. Four pumps a month. I asked them for how long and they wouldn’t tell me.
They also want payment cleared before anything ships now, and our wires are taking a day and a half. So four a month is optimistic.
We replaced nine last month. So this could be a problem if it doesn’t get resolved.
From: Ray Kowalczyk 10:21 a.m.
Sharon, that changes my recommendation. Nobody sends a pump out for cosmetic damage until further notice. Cracked housing, worn label, sticky keypad — I will fix it here. If it pumps, keep it in the building.
From: Deb Farrow 10:24 a.m.
3 North has four with bad clamps I was going to send down this week.
From: Ray Kowalczyk 10:26 a.m.
Send them down. I have clamps.
From: Tyler Reisz 1:52 p.m.
There are two hundred and six for this building. If you include the clinics, it is two hundred and forty-one.
I green-tagged sixty-one of them myself this morning. RUNNING — UPDATE PENDING, date, initials. I ran out of tags on 2 and had to go down to the shop for more. My hand hurts. I’ll do the others after lunch.