Hacking a Pacemaker

Bionic eye by sm62704 · 2008-03-12 01:32 · Score: 5, Interesting

I'm sure glad the device in my eye (see my sig for details) is focused by the eye's muscles rather than electronics/motors. Some things shouldn't be networkable.

Oh yeah, the oblig: We are cyborg. You will be assimilated. resistance is not only futile but you won't resist, you'll beg to join us..

--
mcgrew's razor: Never attribute to stupidity that which can be explained by greedy self-interest

Re:Bionic eye by sm62704 · 2008-03-12 01:58 · Score: 2, Interesting

I would think the safest thing would be to have to physically interface with it to program any electronics in it. Once they've sewn one into my chest (thank God heart disease doesn't run in my family) I wouldn't want it to be programmable!

--
mcgrew's razor: Never attribute to stupidity that which can be explained by greedy self-interest
Re:Bionic eye by Ihlosi · 2008-03-12 02:03 · Score: 5, Insightful

Once they've sewn one into my chest (thank God heart disease doesn't run in my family) I wouldn't want it to be programmable!
Um, yes you do. Do you want them to have to cut you open because you don't like the maximum pacing rate and want to have it reduced by 5 bpm ?
Re:Bionic eye by Misagon · 2008-03-12 02:05 · Score: 3, Interesting

Some things shouldn't be networkable. Not networkable. A pacemaker communicates only with the diagnostic equipment.
Pacemakers are [i]implanted[/i] under the skin. The only way to interface with them is through induction or radio signals. The signals have ranges measured in centimeters.

--
"We mustn't be caught by surprise by our own advancing technology" -- Aldous Huxley
Re:Bionic eye by StylusEater · 2008-03-12 02:09 · Score: 5, Funny

I can see the headlines... "Cheney's Pacemaker Hacked by Chinese Militants" ... :-) One can only wish.
Re:Bionic eye by sm62704 · 2008-03-12 02:36 · Score: 2, Funny

I want them to get the pacing rate right BEFORE they sew it in.

--
mcgrew's razor: Never attribute to stupidity that which can be explained by greedy self-interest
Re:Bionic eye by Ihlosi · 2008-03-12 02:40 · Score: 2, Interesting

I want them to get the pacing rate right BEFORE they sew it in.
Finding out which settings you like or don't like unfortunately involves putting a pacemaker into you first. Of course, you could go with a completely dumb device, but your heart would be paced too fast when you're asleep and too slow when you're physically active.
Re:Bionic eye by tsa · 2008-03-12 03:32 · Score: 4, Informative

Believe me, you really want the thing to be programmable. They have to try a few settings to find oujt which makes you feel good, and if/when your body changes they can adjust the pacemaker accordingly. Modern pacemakers are marvellous pieces of technology that can give you your life back as long as you program them well!

--
-- Cheers!
Re:Bionic eye by darkfire5252 · 2008-03-12 03:39 · Score: 3, Interesting

Yes, I want it to be programmable. But I want the designer to keep in mind that it's my life at stake. We know how to do these things securely.

Public-Private Key cryptography. The manufacturer has a public key, and it's embedded into the device. The manufacturer's private key is kept secret in the same way as the PKI people do it; there are multiple parties required to do anything to the key, there is armed security 24/7, and the key is treated as if people's lives depend on it because that's the situation. There's a process to go through for a hospital to get certified to update the device. When the hospital certifies a doctor to update the device, the doctor's public key is signed by the manufacturer's private key. The doctor keeps his private key on a smart card that requires a PIN with the full knowledge that people could die if he loses it. Preferably the smart cards are kept under lock and key at the hospital next to the lethal drugs and the morphine. When an update command is done, a specially formatted message is signed by the doctor's private key, and the message is send along with the doctor's certificate (the doctor's public key signed by the manufacturer's private key). If there's no valid certificate or the message format is not correct, no command interpretation takes place. If everything checks out, the command is logged in onboard flash memory and the device updates. If someone's pacemaker is updated in a manner that kills them, there is an audit trail pointing to exactly who's at fault. I don't care how much more expensive it is, particularly when the answer is 'not very.'

People's lives are at stake here, the manufacturers should be held liable and negligible if they aren't using already existing methods that essentially guarantee security.
Re:Bionic eye by shaiay · 2008-03-12 05:33 · Score: 2, Insightful

Even if you can transmit very strong signals to the pacemakers from afar, the answer will be very faint (these things need to run for years on a single battery, they are very low power). Most communication protocols are bidirectional, so you won't really be able to communicate with it.

As an added precaution, some manufacturers (at least Biotronic IMHO) have devices which only communicate when a magnet is placed near (again centimeters) the device, thus closing a magnetic switch and enabling communication.
This is extremely hard to "hack" from afar -- you would need a very strong magnet which would probably cause a lot of other problems.
Re:Bionic eye by Ihlosi · 2008-03-12 06:12 · Score: 2, Insightful

Public-Private Key cryptography.
Sure. Will you ship your secure, encrypted pacemaker with an external power supply to plug it in ?
Sheesh. These things don't come with a multi-core desktop CPU. They're ultra low-power systems, optimized for battery life because changing the battery requires surgery, which already puts your life at stake (Sorry - cutting your chest open isn't trivial. And the chance of something bad happening during or after surgery (infection, complications with the anesthesia, etc), as of now, is about infinitely higher than someone hacking your pacemaker to kill you).
If you'd get a pacemaker, would you get the one that requires you to be cut open every five years, or the one that requires you to be cut open every eight years ?
Re:Bionic eye by bay43270 · 2008-03-12 06:19 · Score: 3, Interesting

Also, your pacing needs change as you grow and as your heart develops. Not all pacemakers go into 70-year-olds.
Re:Bionic eye by nahdude812 · 2008-03-12 07:08 · Score: 3, Insightful

And once the private key is cracked or exposed, do you operate on everyone with that model pacemaker?

The thing is that this private key needs to be sent to every hospital and doctor's office which wants to make adjustments to the pacemaker. They'll have it, whether it's embedded in a chip or written in a config file. You have to make this information public in some sense, the very best you could hope to do is use some kind of DRM to protect the key from exposure, but as we all know, such exercises are fated to failure.

And what happens when a pacemaker manufacturer discontinues a line and stops manufacturing the equipment to tune certain kinds of pacemakers (such as would be expected to happen should a key be discovered), do these patients just have to hope that the equipment used for tuning their pacemaker outlives them?

Also, will doctors and hospitals have to buy dozens of different pacemaker adjustment machines, one of every type, even those they don't install themselves so that they can treat patients who move into the area? What happens when the patient needs emergency adjustment of his pacemaker but doesn't remember the model he has (or isn't conscious)?

Finally, these devices don't exactly have little general purpose CPU's in them. One of their biggest concerns is decent battery life. If we put something in there as computationally intensive as strong private/public key cryptography, you're going to significantly hurt the battery life of these devices.

This problem is not as simple as it seems on the surface. It turns out that human life is fragile, and there are many ways in which you can kill someone, some of them even require little effort to kill many people. Hacking this device in a way that endangers other humans would not even need new laws to be punishable since we fortunately already have laws which surround murder, reckless endangerment, and other such things which actually or reasonably could result in the death or injury of other humans.

--
Slay a dragon... over lunch!
Re:Bionic eye by Beardo+the+Bearded · 2008-03-12 07:17 · Score: 3, Informative

Ah, finally, someone understands something! Most programmers think that EVERYTHING that can be programmed has a multi-core architecture with a hard drive, monitor, etc. You haven't seen most of the computers that you use on a daily basis. Do you think your elevator runs a Duo-core? Your apartment buzzer controller isn't made by AMD.

I'm an EE with a lot of embedded experience in RF devices. I've had to make recalls because the standby current* was 50uA instead of 12uA. (For a GPS tracking board with VHF transmitter.)

The level of misunderstanding that's required to think that you can surreptitiously reprogram somebody's pacemaker without their knowledge is astounding. If you've got a pacemaker and someone tries to walk up to you and reprogram your chest, just walk away, man. Walk away. It's not like it's going to take 2 seconds to line everything up correctly. Even if all the technical details are magically sorted, a different brand could make your hack useless. So could temperature, humidity, clothing, chest hair, and any of the other RF voodoo things that you have to deal with.

*(Technically "quiescent" but I'm not sure everyone knows what that means.)

--

---
ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
Re:Bionic eye by darkfire5252 · 2008-03-12 08:13 · Score: 3, Insightful

Look up public private key cryptography and get back to me. Asymmetric cryptography does not require revealing the private key to hospitals....
Re:Bionic eye by pnewhook · 2008-03-12 08:47 · Score: 2, Insightful

Yes, its all nice and simple to the software guy that doesn't know what he is talking about.
Yes what you are asking is possible but it's prohibitively expensive, pointless, and adds ZERO benefit to the patient. In fact because of the extra power draw of this pointless device the patient will have to undergo extra surgeries to replace the battery more ofter thereby further jeopardizing the patient safety.

--
Tesla was a genius. Edison however was a overrated hack who liked to torture puppies.
Re:Bionic eye by geekyMD · 2008-03-12 09:03 · Score: 2, Insightful

You sir, are a moron. You suggest: 1) Requiring doctors to carry smart cards with encryption data 2) Requiring doctors to keep said cards with "the morphine" (showing you have never seen how a hospital manages secure resources) 3) Said hideously rare and necessarily hard to obtain cards would be required to save a life in dire emergent situations. This shows: 1) You have never seen how an emergency room or hospital inpatient floor works. 2) You have no idea how a pacemaker interrogator works. Furthermore, you suggest: 1) A hideously complex encryption system based on ONE point of weakness: the manufacture's private key. 2) You KNOW this is a weak point by your suggestion of "armed guards" (where should they be? in yur hard drivez guardin' your bites?) Therefore: 1) You have suggested a security by obscurity scheme which even the RIAA is learning just doesn't work. 2) You have definitively solved a "hard" problem in a field of experience vastly different from your own by applying your specific brand of expertise without any form of intellectual humility. Which shows: You're a slashdotter alright. I also stipulate: Due to your heinous disregard of human life in your brash search for security, and disregard of other peoples input on this forum, as priorly asserted: You sir, are a moron.
Re:Bionic eye by Beardo+the+Bearded · 2008-03-12 09:03 · Score: 2, Informative

Both multiplication and division are "heavy" operations in the embedded world. Incorporating them into the code even once can mean that your code won't fit into the footprint. One chip I used in 2006 has 512 bytes of Flash and 24 bytes of RAM. Not for a trivial application either - there are tens of thousands of that product out in use right now, and people depend on the device to live.

Sure, a few chips have built-in single-line multipliers, but I don't think that's what they use in pacemakers.The pacemaker chips are probably running at 32kHz (kilohertz) for battery efficiency.

I don't think that the very remote chance of a pacemaker hack with technology that doesn't exist is a sufficient threat to require encryption on the pacemaker. If thousands of people start dying as a direct result of this hack, then I might change my mind.

--

---
ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.

pacemakers by gEvil+(beta) · 2008-03-12 01:35 · Score: 4, Funny

Hacking a pacemaker? What could possibly go wr... *thud*

--
This guy's the limit!

Don't fear.... much by NIckGorton · 2008-03-12 01:38 · Score: 4, Insightful

From TFA:

a team of computer security researchers plans to report Wednesday that it had been able to gain wireless access to a combination heart defibrillator and pacemaker. They were able to reprogram it to shut down and to deliver jolts of electricity that would potentially be fatal

hundreds of thousands of people in this country with implanted defibrillators or pacemakers to regulate their damaged hearts -- they include Vice President Dick Cheney -- have no need yet to fear hackers No need to fear they tell us because:
One:

The experiment required more than $30,000 worth of lab equipment and a sustained effort by a team of specialists from the University of Washington and the University of Massachusetts to interpret the data gathered from the implant's signals. And two:

"To our knowledge there has not been a single reported incident of such an event in more than 30 years of device telemetry use, which includes millions of implants worldwide," Um, that was until a NYTimes article described that it could be done and (more importantly) a /. article linked to that NYTimes article so tons of geeks worldwide see the information. While security through obscurity doesn't really work, there is something to be said for people just not noticing that a thing is hackable.

Similarly the argument that it took $30,000 worth of equipment and a 'team of experts' is retarded because the same might probably have been said about DVD encryption till an adolescent did it in his bedroom with his home computer and enough caffeine.

If I had an AICD, I sure as hell wouldn't want to be around Cheney, lest the signal from mine be confused with his. Of course maybe that is why he has a man sized safe in his office is a Faraday cage.

Re:Don't fear.... much by TheRealMindChild · 2008-03-12 02:20 · Score: 2, Interesting

Similarly the argument that it took $30,000 worth of equipment and a 'team of experts' is retarded because the same might probably have been said about DVD encryption till an adolescent did it in his bedroom with his home computer and enough caffeine.

Not only that, but let's say the President of the United States has a pacemaker... $30000 is pittance for someone who wants him dead.

--

"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
Re:Don't fear.... much by MMC+Monster · 2008-03-12 02:48 · Score: 2, Interesting

Recent models of pacemakers and defibrillators from the major companies (Guidant, Medtronic, etc.) allow remote telemetry from home: You have a device sitting on a table next to the patient's bed which will check the device every night (or one night a week, etc.) and report back to the physician any abnormalities. Some also allow wireless programability, but not from home: The nurse waves the wand over the device, then the patient goes in another room and gets seen by the physician while the settings on the device are changed. The range is less than 50 feet, based on personal experience. Now, this can theoretically be done from home (if someone has the right device), and you can make changes without any passwords.

Before you ask, you should *not* start passwords-protecting these devices, as you may have a patient traveling and rendered unconscious and need to make setting changes and not have time (or ability) to call the manufacturer.

--
Help! I'm a slashdot refugee.
Re:Don't fear.... much by NIckGorton · 2008-03-12 04:03 · Score: 5, Informative

I'm not so sure about that (speaking as an ER physician who would generally be the one saying WTF is the password???)

In the worst case scenarios, either 1) put a donut magnet over it and it can be stopped or 2) give me a scalpel and 30 seconds and I can cut the leads, and then we can externally pace and/or defibrillate the person.

So I am not sure that the risk of being password protected would outweigh the risk of not being password protected. I'd want mine password protected, then put the password on a medic-alert bracelet that I wear.

But why? by Tsoat · 2008-03-12 01:40 · Score: 2, Insightful

Even if you could hack it wirelessly the only benefits I see are bragging rights cool they may be just doesn't seem worth the time and effort

Re:But why? by kalirion · 2008-03-12 02:16 · Score: 2, Insightful

Unless you're looking to kill someone by pressing a button, of course.
Re:But why? by MttJocy · 2008-03-12 04:23 · Score: 2, Insightful

Guns however create pesky ballistic evidence, a wireless signal passed to the device may show up in it's log somewhere if an old guy with a pacemaker dying of a heart attack was even autopsied but it could still be just taken as natural causes, not only that but even if you could prove the device was tampered with it could be difficult to link such a signal with the transceiver that sent it directly, unlike trying to link a bullet to a gun. Now bear in mind people have tried some pretty mental schemes in an attempt to get away with murder and it doesn't seam that ridiculous that someone could actually try something that elaborate in order to attempt to kill someone without it being traced back to the attacker. Of course there is still the fact that not having the pacemaker has pretty good odds of killing you anyway, having one without the wireless technology would mean it would need to be altered by surgery which also carries a risk of death which is far higher than the risk of hacking so it is overreacting really to get overly worried about it all the same.

Re:Hmmm by Ihlosi · 2008-03-12 01:43 · Score: 4, Funny

Doesn't Dick Cheney have a pace maker?

Yes, but the purpose of this device is unclear. What exactly is it pacing ?

Just shut it off by epilido · 2008-03-12 01:51 · Score: 2, Insightful

Most pacemakers and defibrillators can be turned off with just a magnet. This is designed to allow medical staff to stop a defective device. Yep I have done it myself and seen it done many times for diagnostic reasons in the hospital. M

Wait for it by Bombula · 2008-03-12 01:51 · Score: 4, Funny

"It wasn't me grabbing her ass your honor, someone hacked my arm!"

--
A-Bomb

So they can crack RSA and then get the pacemaker? by dbIII · 2008-03-12 01:52 · Score: 2, Interesting

RSA encryption is used in these devices. There certainly is a lot of techofear journalism about lately.

Re:remote kill? by Snowgen · 2008-03-12 01:53 · Score: 4, Interesting

does this mean that someone can eventually kill people remotely?

The technology for that already exists; it's called a "gun". It replaced an older technology called an "arrow", which in turn was the replacement for an even older technology called the "javelin". There was also an older technology called a "sling" which was a peripheral device designed to increase the effectiveness of the original technology call the "rock".

People have been remotely killing other people for millions of years.

A better method by yamamushi · 2008-03-12 01:54 · Score: 5, Interesting

The article details how the researchers had to be within 2 inches of the pacemaker, and several thousands of dollars worth of equipment. I suspect there is an easier way to deactivate a pacemaker, find out what frequency they operate at. I've got an FM radio blocker, that is basically just a 100mhz oscillator, a potentiometer, and a battery. It works by canceling out a given frequency, thus letting me silence my neighbors stereo from 50ft away. I know the technique works for the 2.4ghz band, for blocking out wireless phone signals and whatnot. I suppose finding an oscillator in the high ghz range would suffice for 'killing' a pacemaker.

--
- Aetheral Research -

Re:A better method by EMCEngineer · 2008-03-12 07:51 · Score: 2, Informative

That is not strictly true. You can create EMP-like pulses in a lab setting. If you have the right antenna and a big enough amplifier you can fry most electronics. The difference is you are very limited in distance of effectiveness, and susceptible frequency range will change with different devices and orientations.

So in a strictly theoretical sense, yes you can kill electronics with RF. On the practicle side, it's like saying you can build a rail gun at home. Sure you can build a 5th grade science class level one that shoots marbles, but that's not what people mean when they say rail gun.

More interestingly: get away with it by davidwr · 2008-03-12 01:58 · Score: 2, Insightful

I heard Uncle Joe is about to write me out of his will. He has a pacemaker. He's old, there won't be an autopsy. Hmmm......

--
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.

It's not that bad by Anonymous Coward · 2008-03-12 02:03 · Score: 2, Interesting

(Posting this as AC since I don't want to get in trouble).

I think the summary is more alarming than the actual article. The researchers had to be at two inches from the device in order to tamper with it.

It's probably not such a big deal now, but some more thought should definitely go into future products. 30000$ sound like much, but it certainly sounds like a bargain if you can kill the Vice President of the USA without even touching him.

I mean, imagine the following scenario:

1. Bad guys want to kill Cheney. That seems quite plausible.

2. They find out the exact model of his pacemaker. That sounds feasible with some knowledge of the field, money, time and determination.

3. They buy one and hire some researchers to crack it and to create an automated system which is portable and works reliably. Say, a laptop with some transmitter attached or something similar. This is quite hard, but should be feasible as well with enough money and time.

4. The researchers manage to increase the range from 2 inches to 20 inches. This is probably the hardest part.

5. The bad guys put the laptop in a briefcase, wires running up the sleeve and the transmitter in the other sleeve (close to the hand). This is easy.

6. Now they just have to get close enough to Cheney. I have no idea about how hard this is.

7. He has a "heart attack". Bodyguards/security come running and push all the people away. People go away because they don't want trouble, including the guy with the briefcase. I think this is quite realistic.

8. Cheney dies. Maybe they find out that the pacemaker was tampered with, maybe not. If not, the plan worked out perfectly. If yes, they will have some video on a security camera showing the bad guy, who is in another country by now. Maybe they catch him, maybe not.

This sounds pretty far fetched (and it is), but it could be possible with some minor advances. So some more thought should go into these devices.

Pacemakers have batteries which have enough power to supply some encryption hardware. What should be done to prevent this scenario is something like this:

1. Create a key pair for every pacemaker. The public key is on the pacemaker, the private key gets printed on a 2d barcode on a piece of plastic. The patient gets the barcode which he carries in his wallet. The patient's doctor/hospital also gets a barcode.

2. The devices used to communicate with the pacemaker have a slot for the barcode.

3. The pacemaker ignores any request not signed with the private key. Problem solved!

Re:It's not that bad by mbstone · 2008-03-12 12:53 · Score: 2, Funny

I mean, imagine the following scenario:

1. Bad guys want to kill Cheney. That seems quite plausible.

2. Secret Service anticipates this. NSA and the Office of the Sergeant at Arms of the U.S. Senate are tasked to establish and test a set of security controls.

3. Pursuant to applicable FISMA, OMB, NIST and DoD regulations, it is determined that Cheney's pacemaker must undergo Certification and Accreditation under DIACAP (Doing Information Assurance on Cheney's Automatic Pacemaker) throughout the VP's Life Cycle.

4. Since the responsible government employees want to CYA, it is determined that the C&A work will be done by Contractors. An RFP is put together and posted to FedBizOpps.

5. A consortium of contractors including SAIC, Booz Allen, and Northrop Grumman are awarded the contract, with the real work to be done by a Section 8(a) minority small business contractor out of Bethesda.

6. The DIACAP team is assembled, a set of 8500.2 security controls is agreed upon, and the Veep is called in for several days of Security Control Assessments.

7. The contractors decide that a full SCA is too much hassle, so an SP 800-26 risk assessment checklist is completed instead.

8. Cheney leaves Bethesda Naval Hospital hardwired to a golf cart full of equipment at a cost of $35 million.

Insider by More+Trouble · 2008-03-12 02:04 · Score: 2, Insightful

Would I need a "team of experts" and $30K of gear if I had worked as an engineer for Medtronic?

That kind of attitude is the problem by Moraelin · 2008-03-12 02:07 · Score: 2, Insightful

Well, sad to say and please don't take it as an offense, it's that kind of attitude that's the cause of half the problems today. Products are made by engineers couldn't care less about security, with their budget dictated by a boss who couldn't care less about security, and end up configured by users who couldn't care less about security. Because they all operate under that assumption that if it's even remotely related to computers or electronics, it can be hacked anyway, so why bother?

Well, no, there are ways to prevent that.

Let's start with the simplest: you can't remote-hack a computer which isn't connected to the net. Pull your network cable out of the computer and that's it, you can't be hacked by some guy in China any more.

Of course, you don't want to do that to your home computer, but we're talking pacemakers and the like. Why _does_ a pacemaker need a WiFi interface anyway? No, seriously. It's not like you want the users to surf for porn and post to Slashdot on their pacemakers. It's not even an appliance, as far as the user is concerned, it's a standalone device like their computer chair or the windshield wipers on their car. You have no freaking need for those to be networked, in any form or shape.

And here's an even more sobering thought: even if you wanted some control from outside, you're near your pacemaker the whole time. In fact, it's inside you. There's no time when you're on the other side of the town than your pacemaker is. So even if you're one of the die-hards that can argue with a straight face why you might need to log in to your fridge from work, the same doesn't apply to pacemakers. You're near it all the time. Any interface to it or from it can be contact-based just as well.

Second, even if you do want it networked, there _are_ ways to minimize bugs drastically. Code _can_ be proven correct, test cases can cover the code to ridiculous extents, and the thing can be riddled with pre- and post-condition checks right in the code and be able to fail safely to its normal offline mode. Yes, it's damn expensive to do that to something the size of Vista. But we're talking a pacemaker. It's just not the same number of lines of code. (Or if it does have millions of lines of code, maybe you just need to fire the guy who programmed it;)

More importantly, we already do _both_ of those for life-and-death systems like flight control systems on airplanes or brake computers on cars. They're both built and reviewed to be as good as bulletproof, _and_ not wired to talk to the outside world, unless one physically plugs in a special connector and a special computer into it. You don't want a car's brakes to be hijacked by wireless by the guy in the next car, so you just don't give them a wireless connection. Do you see any reason why we wouldn't apply the same thinking to a pacemaker? It's even more likely to kill than hijacking someone's brakes. There is no airbag to save you when your pacemaker fails.

So what I'm saying is: let's all stop and think twice before shrugging and dismissing security as impossible anyway. Sometimes it's very feasible to make it bulletproof, and, really, it has no excuse to not be so.

--
A polar bear is a cartesian bear after a coordinate transform.

Re:That kind of attitude is the problem by Ihlosi · 2008-03-12 02:15 · Score: 4, Insightful

Why _does_ a pacemaker need a WiFi interface anyway?
Because sticking a JTAG connector through someones chest is fairly painful. You're welcome to experiment on yourself to confirm this.
Also, it's not a WiFi interface. It's a short-range (it goes through your chest, and water absorbs radio waves like crazy), custom, wireless interface. You have no freaking need for those to be networked, in any form or shape.
And you're, what ? An M.D. ? A biomedical engineer ?
Tell you what: Have fun with your dumb fixed-rate 75 bpm pacemaker, but don't expect to be running up any stairs anytime soon.
Any interface to it or from it can be contact-based just as well.
It basically is, genius. Or do you want it so contact-based that they have to shoot a couple of amps through your chest in order to make the pacemaker respond ? Hint: Think of a vital organ that's very, very close to the pacemaker and reacts very badly to having current shot through it.
More importantly, we already do _both_ of those for life-and-death systems like flight control systems on airplanes or brake computers on cars. They're both built and reviewed to be as good as bulletproof, _and_ not wired to talk to the outside world, unless one physically plugs in a special connector and a special computer into it.
They're also conveniently located outside the human body, so plugging a special connector into them doesn't involve going through someones tissue first.
Re:That kind of attitude is the problem by Asic+Eng · 2008-03-12 02:34 · Score: 2, Informative

Why _does_ a pacemaker need a WiFi interface anyway?
Well it's not a pacemaker, it's a combination pacemaker/defibrilator. The second part is the reason why it can "deliver potentially fatal jolts" - that's just the range a defibrilator operates in. A connection via the internet allows a doctor to be notified of problems while the patient is at home, and the doctor could even take corrective actions right away. That's presumably why one of the doctors involved in this investigation said "If I needed a defibrillator, I'd ask for one with wireless technology." This is great research though - while it may not be possible to prevent any attack, it's quite possible to put safeguards in place and these guys are pushing the FDA and the industry to make that happen.
Re:That kind of attitude is the problem by DataBroker · 2008-03-12 02:56 · Score: 2, Insightful

So what I'm saying is: let's all stop and think twice before shrugging and dismissing security as impossible anyway. Sometimes it's very feasible to make it bulletproof, and, really, it has no excuse to not be so.

The excuse is that people are not willing to spend the difference it would cost to make it bulletproof. There are diminishing returns (even on life-saving devices) which people won't recognize or spend on.

Imagine walking into a doctor's office being presented with two (apparently) identical devices. One costs $1000, and the other costs $10,000. Yes, it's your life, but spending another $9000 to make it more secure isn't going to be the option most people choose.

Beyond that, imagine trying to convince an HMO the medical necessity for spending more money on the secure version. I'd suspect that the manufacturers have already considered that and decided to be competitive instead.

Re:Easy solution by CrashPoint · 2008-03-12 02:08 · Score: 4, Funny

Why don't they build firewalls into the pacemakers?

Because then you'd get heartburn. Geez.

Yee-ha! by clickety6 · 2008-03-12 02:13 · Score: 4, Funny

I'm gonna overclock this sucker!
Better than a triple espresso!

--
----------------------------------- My Other Sig Is Hilarious -----------------------------------

Re:remote kill? by Oktober+Sunset · 2008-03-12 02:13 · Score: 4, Insightful

Killing people remotely is not hard, doing it without anyone knowing it was you, without any indication at the time that it was anything other than natural causes, requiring no opportunity other than being within wireless range and leaving no evidence behind whatsoever. That's the novel part.

--
What if Tetris was invented by Nazis?

Re:Hmmm by BakaHoushi · 2008-03-12 02:15 · Score: 2, Funny

I find this joke to be old and rather insulting, really. Of course Dick Cheney has a heart.

However, the notion that the heart is somehow related to empathy and love is also false. Instead, he had that section of his brain surgically removed. It helps him collect himself faster after his 3pm puppy kicking and orphanage closing.

Re:So they can crack RSA and then get the pacemake by frog_strat · 2008-03-12 02:31 · Score: 5, Interesting

Working on the communications software for one of these devices, I can say for sure there is no encryption on at least one of them. A decision was made by the company to not worry about this issue at the moment.

Some health care insurance / hospitals may want to by Joe+The+Dragon · 2008-03-12 02:33 · Score: 2, Informative

Some health care insurance / hospitals may want to cut you off if you can't pay or they found out that you had a pre existing condition they make you pay up and say pay or we cut you off.
Some of them have said that a kidney transplant is to experimental and they let a someone die just to get out of paying for it.

When my pacemaker is tested by InterGuru · 2008-03-12 02:50 · Score: 3, Interesting

Every six months my pacemaker is checked. Part of the test is to speed and slow down the pacemaker and my heart for a short time.

It is a truly heartfelt experience.

Bookwormhole.net -- a site for book lovers.

Hacking the VP by tobiasly · 2008-03-12 02:54 · Score: 5, Funny

Yes, that's a very real concern that the secret service has been terrified of for years. Most people know that Cheney has a pacemaker, but the real secret is that they forgot to turn off SSID broadcast and its password is "Linksys".

Re:remote kill? by legoman666 · 2008-03-12 03:38 · Score: 2, Insightful

Sorry friend, that niche is already filled: http://www.lessemf.com/personal.html

Re:Hmmm by jamstar7 · 2008-03-12 06:03 · Score: 2, Funny

I find this joke to be old and rather insulting, really. Of course Dick Cheney has a heart.

Yup, he has the heart of a 20 year old.

It's in a jar on his desk.

--
Understanding the scope of the problem is the first step on the path to true panic.

Re:Ah, the smart-arse non-sequiturs by I_Love_Pocky! · 2008-03-12 06:33 · Score: 4, Informative

I appreciate your enthusiasm, but thank god you aren't designing these devices. I work for one of the competitors to Medtronic (the company whose devices were studied). We have encryption in our RF communication. We DO take security into consideration, but there are trade offs that have to be considered. Battery life is generally the most important consideration. Every time surgery needs to be performed to physically access the device (usually because of a depleted battery) there is a risk of complications. These aren't insignificant risks either. Keep in mind the people getting these devices have health problems of some sort or they wouldn't be getting them. With that in mind, security solutions in this domain have to be very well thought out so as to avoid draining the battery significantly. So please, don't for a second presume that we are a bunch of monkeys sitting around on our asses ignoring real concerns. The real issue is that there are far more concerns than you are aware of. We do evaluate these concerns and try to build the best devices possible with the fewest compromises.

Insulin pumps too! by wizman · 2008-03-12 07:40 · Score: 2, Insightful

My girlfriend is a type 1 diabetic. Instead of regular injections, she uses an insulin pump. This pump is an external device, about the size of a pager, that feeds insulin into her body via a short tube.

Several months ago she upgraded to a new pump. This new model (a Medtronic MiniMed) wirelessly communicates with a number of devices. It receives blood glucose data from a continuous glucose monitor. It also receives her regular readings from her standard "prick your finger" blood sugar tests via her test kit. And, it has a wireless key fob that allows her to adjust the pumps settings without having to dig through pockets and clothes to get at the unit.

My first comment to her was "With all of this wireless control, how easy is it for someone to use this wireless interface to put you into a diabetic coma, or worse, kill you?" She thinks it's a fairly ridiculous concept, citing encryption, receiver range, and "Why would anyone want to kill me?", among other reasons.

Well, I say that anything that has any type of wireless interface is hackable. There are, of course, no published documents that I can find detailing what steps have been taken to secure these devices. I'm seriously concerned as to whether or not the companies that make insulin pumps, pace makers, implants, etc, may not be taking these concerns seriously.

Re:Dealing with the threat by Rick+Genter · 2008-03-12 08:04 · Score: 2, Informative

I agree with those that said that in order to "hack" the pacemaker you have to be at a very close range to the victim. At this range, you could just as easily stab or shoot them. As a more general rule, apart from a select few VIP figures, there is nothing we can do to prevent someone from carrying out a murder if they want to, the only thing we can do is punish them after the fact and hope it serves as deterrent for others.

What IS a problem is that unlike other means to kill a person at close range, this method is rather subvert, and unless you are an expert at recognizing behavior and/or expect the victim to be targeted, you will probably not even notice the attack took place. Picture this: a man walks by another man, with a wireless device in his pocket and already pre-configured to carry out the attack. They each go their own ways, and seconds later the other man has a heart attack. The pacemaker is likely not to keep any logs that can reveal the nature of the "hack". So unless you find the equipment used for "hacking" and can tie it to the attacker, you have very little evidence to charge them with.

I have a Medtronic pacemaker implanted. A few points:

1) When the doctor wants to communicate with it, he lays the transceiver on my chest, directly over the pacemaker. It works through my shirt, but the total distance is probably no more than 2 to 3 cms. Yes, it may work at a greater distance, but I doubt it's much more than 10 to 15 cms. One of the things about pacemakers is that they run at very low power. So, yes, it would be easier to shoot me than to hack my pacemaker.

2) The pacemaker has decent data storage. Any change to its settings is logged internally. All sorts of other biometrics (highest heart rate detected and when, %age of beats for which pacing was required, etc.) are logged as well and available for download. I'd be surprised if they *couldn't* tell that the pacemaker had been hacked, and when.

--
Don't underestimate the power of The Source

Re:Ah, the smart-arse non-sequiturs by I_Love_Pocky! · 2008-03-12 10:10 · Score: 2, Insightful

I can't speak to how Medtronic implements their RF communication, but as I said ours is encrypted and boosting the signal to "hack" someone does not get around the encryption.

With the encryption that you say your company uses, wouldn't it simply be a matter of acquiring a single sending device, and reverse engineering it?
No. The individual communication session is protected by a unique key. Still, if you physically had a programmer (the sending device you mentioned), you could use it without any hacks to change a patient's settings just as a doctor could, but it would require physical proximity on the order of a few cm. This sort of communication does not occur using RF. You can't spoof this with a high gain antenna or any such thing because the communication isn't occurring using radio frequencies at all. And as you said, at this range you could kill a person any number of other ways.

55 of 228 comments (clear)