BD Alaris 8015 Firmware Security Analysis

Firmware Security Analysis of the BD Alaris 8015 PC Unit: Unencrypted Wi-Fi Credential Storage and Compound Vulnerabilities (CVE-2016-9355)

-orange)

Overview

This project presents a firmware security analysis of the BD Alaris 8015 Point-of-Care (PC) infusion pump, focusing on CVE-2016-9355 — a vulnerability that allows extraction of unencrypted Wi-Fi credentials from the device's NAND flash memory.

Course: CY 7790 - Medical Device Cybersecurity
Professor: Kevin Fu (Former Acting Director, Medical Device Cybersecurity at FDA)
Institution: Northeastern University
Team: Kalyan, Varun, Abisath, Arafat

Key Findings

Primary Vulnerability (CVE-2016-9355)

The device stores wireless network credentials in plaintext XML files on NAND flash, including:

• WPA2-PSK passphrases
• 802.1X enterprise domain credentials (PEAP-MSCHAPv2)
• EAP-TLS private key passphrases
• AES session keys

Compound Vulnerabilities Discovered

Methodology

Analysis Approach

• Track: Hardware Analysis (Static Firmware Analysis)
• Target: Firmware version 9.33 (September 2017)
• Environment: Kali Linux

Tools Used

• binwalk - Firmware extraction
• UBI Reader - UBIFS filesystem reconstruction
• strings / xxd - Binary analysis
• Python 3 - Custom UBIFS traversal scripts
• Entropy analysis tools

Analysis Steps

1. Firmware package extraction and hash verification
2. UBIFS filesystem reconstruction from NAND image
3. Credential path identification (/etc/summit/)
4. XPath extraction from OSE.ELF binary (WlanProfileParser class)
5. Entropy analysis confirming absence of encryption
6. Compound vulnerability identification

Technical Details

Device Specifications

Credential Storage Location

/etc/summit/[ProfileName].xml

Vulnerable XPaths (from OSE.ELF)

/PSK/Passphrase/text() /Password/text() /PEAP/Identity/text() /EAPTLS/PrivateKeyPassphrase/text() /EAPTLS/UserCertPassphrase/text() /AES/Key/text()

Threat Model (STRIDE)

Mitigations

References

• ICS-CERT Advisory ICSMA-16-333-01: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-317-01
• CVE-2016-9355 (NVD): https://nvd.nist.gov/vuln/detail/CVE-2016-9355
• MITRE Playbook for Threat Modeling Medical Devices

Disclaimer

This research was conducted for academic purposes under the Medical Device Cybersecurity course at Northeastern University. All analysis was performed on firmware images only — no physical devices were accessed. Credential samples shown are fictional and for demonstration purposes only.

---

Author: Mohammed Arafat Nadaf
GitHub: github.com/nadafarafat
LinkedIn: linkedin.com/in/arafatnadaf