Slashdot Mirror
Hackers Penetrate Top Medical Device Makers
An anonymous reader writes "Hackers have penetrated the computer networks of the country's top medical device makers, The Chronicle has learned. The attacks struck Medtronic, the world's largest medical device maker, Boston Scientific and St. Jude Medical sometime during the first half of 2013 and might have lasted as long as several months, according to a source close to the companies."
When I hear about stuff like this, I'm ashamed of the savage thoughts and desires I feel towards the perpetrators.
I imagine they'll take what they can get: IP, personal data, or just more computers to control.
If it really is China as suggested in the article that could make sense. China's population is going to be aging, and medical devices would be handy for either internal use or for another technology to develop and market.
This is interesting (FTA): "The medical device makers were not aware of the intrusions until federal authorities contacted them, and they have formed task forces to investigate the breach, he said."
Who do you suppose noticed the breaches, and how?
much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
Someone probably already wrote a sci-fi story along these lines, but I can easily see someone with an artificial heart, pacemaker, or some other medical device getting a phone call threatening to shut their thing off unless they make an extortion payment. While I think most of these are air gapped at the moment, it's inevitable that they will become more interconnected, especially as a means of delivering diagnostic information (aka "heartbeats", heh), at which point it will be possible to run exploits against them. Even if a person's devices aren't experiencing a legit attack, I can also see plenty of people being scared into coughing up dough because they won't know any better.
When you think of IT as that annoying office of geeks you have to tolerate in the company.
They are your first line of defense, when they ask for something you GIVE IT TO THEM.
Do not look at laser with remaining good eye.
Welcome to the Internet of Things. Now, IT Security is not simply a venue to stop embarrassment (website defacements), disruption (DDoS), and exposure (SQLi), but potentially a life and death issue. Disruption of a pacemaker, insulin pump, etc. can have a very real impact. Perhaps a modern day "Pinto" incident will change the view of IT Security from an expense item to a necessary partner.
with web/Internet access on the same computer they used for admission and they were using Microsoft's Internet Explorer. Same thing for a CPA and her entire office while handling taxes for corps and individuals. So it should be no surprise to hear medical companies have been hacked into. Security is something others with important information do.
Did they get the IP address and password to Dick Cheney's implants? That's what we all want to know.
Medical devices are huge threats. "Hey lets slap WiFi on this heart rate monitor and give it to a hospital" - how about an insulin pump?
Recall the story of using bluetooth to kill someone with a pacemaker?
Simple fact is people have no idea what they are doing security wise and are designing this stuff to be web enabled.
When I was in the hospital last year I noticed that the heart monitor (with built in defib) had bluetooth. I don't think I want something hooked up to me that has both A) the ability to deliver massive amounts of electricity to my chest and B) bluetooth.
Pacemakers and defibrillators can be reprogrammed wirelessly by physicians. The more sophisticated ones (usually defibrillators) often have a patient unit, which can be kept at home, and can query the device and send telemetry back to the physician over the internet. This can reduce the need to travel to the hospital for routine examinations.
In general, there is no real authentication performed between the wireless programmer and the implanted device, other than a check of the serial number. The channel is rarely encrypted, so that anyone who can procure a programmer could use it in (possibly with some form of power amplifier/antenna combo) to reprogram a device from a distance.
There are limits to what can be programmed, and there are hardware limiters in the circuits which will inhibit outputs that are out of range, even in the event that software limits fail. However, pacemaker/drug prescriptions do need a degree of care, and the hardware limits generally won't be sufficient to prevent harm from an incorrect prescription.
It's a challenging attack, but certainly not infeasible.
Oddly enough, for the very fear of this, Dick Cheney had wifi access to his pacemaker disabled.
His heart is closed to attackers. Just like it is to empathy and humanity.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
And soon some medical devices will be penetrating the hackers.
I can take the Beta, but a direct feed from Fox News is a little bit to much....
What, you don't think the doctor should be using wireless stethoscopes?
No problem, as long as they don't also give it the ability to send massive amounts of electricity into my heart.