Slashdot Mirror
DHS Investigates 24 Potentially Lethal IoT Medical Devices
An anonymous reader writes: In the wake of the U.S. Food and Drug Administration's recent recommendations to strengthen security on net-connected medical devices, the Department of Homeland Security is launching an investigation into 24 cases of potential cybersecurity vulnerabilities in hospital equipment and personal medical devices. Independent security researcher Billy Rios submitted proof-of-concept evidence to the FDA indicating that it would be possible for a hacker to force infusion pumps to fatally overdose a patient. Though the complete range of devices under investigation has not been disclosed, it is reported that one of them is an "implantable heart device." William Maisel, chief scientist at the FDA's Center for Devices and Radiological Health, said, "The conventional wisdom in the past was that products only had to be protected from unintentional threats. Now they also have to be protected from intentional threats too."
Of course, it's always good to see patient safety is encouraged. I hope making it public does push towards fixing the issues and not people panicking.
William Maisel, chief scientist at the FDA's Center for Devices and Radiological Health, said, "The conventional wisdom in the past was that products only had to be protected from unintentional threats. Now they also have to be protected from intentional threats too."
This statement comes so late... The security community has been saying that for years! What happened to forward-thinking?
...when referring to connected/connectable devices as IoT dies.
Is it just my observation, or are there way too many stupid people in the world?
As I pointed out a few weeks ago, most implants with electronics or metal can be "hacked" by targeting them with microwaves. Sure, so can the human body but you don't need as much power to disable a possibly-life-sustaining electronic device as you to do cook flesh. Even metal parts will heat up (and cook adjacent living tissue) with less power than the human body.
However, if my heart is dying and I have a choice between getting an implantable artificial heart even knowing that I could be killed by someone armed with a microwave gun or dying waiting for a human donor, I'll take the artificial heart.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If you are going to connect things to the internet, you pretty much need to harden them against malicious attacks.
So many of these things are done with the very naive "what could possibly go wrong?" kind of attitude where there's pretty much no attempt at security.
So many companies (especially some of the medical companies) treat security as something they don't need to worry about. The problem is if something is accessible, and people can muck about with it, they will simply because it's there.
It may sound like a movie plot, but if I know you have a particular kind of internet-enabled implant ... it's far easier to go after you from a distance than up close.
Sadly, while they're looking at the medical stuff, I'm betting there will still be a huge list of other "IoT' devices for which security is a complete joke, if not outright non-existent.
Which is why I have no interest at all in the Internet of Things. At present, it's marketing hype, which hasn't even begun to address basic security and privacy issues.
Lost at C:>. Found at C.
Anything computerized with a network connection can (and most likely WILL) be hacked...
Screw this stupid "Internet of Things"
But don't we have an agency that is competent and less "Ministry of Information Retrievaly" than the DHS?
https://www.youtube.com/watch?...
"If any question why we died, Tell them because our fathers lied."
The only surprise is that catastrophes are not commonplace. As an information security professional I can tell you based on a first-hand experience that we are metasploit module away from a major disaster. Industrial automation, medical, automotive and many other industries simply do not get information security. Chances are, your municipal water treatment system, you office building's elevators and heating, your glucose monitoring system, your car's infotainment system, your neighborhood's stoplights are trivially hackable. The only good news is that there is no money (but plenty of mayhem) to be made from compromising these systems. As such, people who can ether don't have a motivation or a conscientious enough to do that. Such miniscule margin of safety keeps me up at night.
Data Protocol: HL7 While 3.0 is XML based, almost everyone uses v.2 which is a multi-row Pipe (Technically is is definable, but everyone uses pipes) delimited file.
How the data is transferred.
There are two common ways to transfer HL7 data.
File Drop and read,
Push via a non encrypted TCP/IP.
Most healthcare systems try to put in VPN and separate networks in place to minimize the damage. But if someone was on the network they could say data update new dose, on the OBX.
We need to get technology to support encryption better. But health care system are notoriously decades out of date.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Isn't this it a bit over the top?
I don't have to be an "independent security researcher" to be able to tell you that kitchen knives are potentially lethal if used by a "hacker". And cars. And plastic bags. And that most dangerous chemical, dihydrogen monoxide (lethal if inhaled for just a few minutes).
Is that a reason to have a government agency investigate them, or is it sufficient to just keep prosecuting and punishing those who actually abuse them?
in neonatal units for example, nearly everything is wireless and unencrypted. Its why visitors and parents are frequently told to shut off cellphones as no ones entirely certain the devices wont interfere with heart rate monitors or life support systems. Its theoretically possible to create a denial of service condition in a hospital where a nurses station for an entire floor suddenly sees life-threatening conditions for every patient, or receives a nurse request page for every patient. Injection attacks can also result in patients that are dead for hours but reported as still alive.
Good people go to bed earlier.
I know security comes way down the list for a lot of device manufacturers but when plot lines from TV shows from over 20 years ago are ahead of the curve on device security you know you're doing something wrong...
A friend of mine and I were just talking about this. He has a pacemaker that they put in that also has a recorder. The doctor pulls data off of the device using a wireless connection (so he doesn't have to open him up again). The device has no security on it (the doctor actually pointed that out at one point). Depending on the device you could theoretically kill someone by "hacking" into something like that (upload a new set of heart settings that drive you into a heart attack). The problem becomes though what happens if you loose the password (you are going to have to open him up to "reset" the device). Worse yet, what happens when you are rushed to the ER and they need to adjust your device. You may be unresponsive and not be able to give the password. Do they sit there with technical support for your device while you code on the table? I am not saying that medical devices don't need security, there just need to be a lot of checks and balances, especially when you are dealing with someones life.
Please let it be the same one DICK Cheney uses. Though if it is on the list, he'll just switch back to yet another heart of a forsaken orphan.
So, other than some moronic social experiment of "information wants to be free so if you see what's in my fridge what's the harm" ... what the hell would I want one for? What benefit does it give me?
A good question. I've heard a few answers that make some sense, mostly revolving around service and maintentance. I leave it as an exercise to you to determine whether these uses are actually of any value.
1) An internet connected device can notify maintenance services in the event of equipment failure automatically. You could have a service contract whereby the "health" of the machine is monitored by qualified service companies and service scheduled as needed possibly even before failure.
2) It would allow data gathering for manufacturers regarding operating conditions and usage to help improve designs and optimize performance in real time. Perhaps manufacturers could offer an improved warranty in exchange for such monitoring capabilities.
3) Some devices like refrigerators may integrate displays on the door and any time there is a screen there are potential applications for internet connectivity. For example if you use an online grocery service (like Amazon's) you could reorder milk or other items directly from the fridge the moment you realize you need them. You could also display movies or stream music through the fridge for entertainment while working in the kitchen.
4) Monitoring your stove to actually make sure you turned it off. (No I wouldn't allow it to be turned on remotely - just off)
I'm sure there are more. You have to think a little harder about how and why such a thing might be helpful. To make use of internet connectivity you have to completely re-evaluate how you use the device and what features might work well with it. No you probably aren't going to hook your toaster up to the internet but there are actual applications that make sense for some people in certain circumstances.
Like airing the vulnerability, launching an investigation, and giving off a signal that the *manufacturers* should pay attention to security and at least make a reasonable effort to make their kit tamper-resistant
It would be in total accordance with a certain political outlook to suppress the news, pose as being "tough on crime" by imposing ridiculous penalties on offences that could be construed as breaking into medical equipment, and criminalising research into and publications of weaknesses.
Perhaps I'm being optimistic ... perhaps this will still happen. That "certain political outlook" I mentioned could be a bit behind the tech news on this issue. We can still hope though.
It's good to see the DHS worry about security and not theatre. But given the 'stop-n-search ordinary citizens' policy of many DHS departments, I wonder when this will be applied to the IoT.
Apropos is a 1990's story about how medical devices connected to an "internet of things" were used to kill their users: "Killobyte" by Piers Anthony.