Slashdot Mirror
Researchers Mount Cyberattacks Against Surgery Robot
An anonymous reader writes: A group of researchers from University of Washington have tested the security of a teleoperated robotic surgery system created by their colleagues, and have found it severely lacking. "Teleoperated surgical robots will be expected to use a combination of existing publicly available networks and temporary ad-hoc wireless and satellite networks to send video, audio and other sensory information between surgeons and remote robots. It is envisioned these systems will be used to provide immediate medical relief in under-developed rural terrains, areas of natural and human-caused disasters, and in battlefield scenarios," the researchers noted, and asked: "But what if these robotic systems are attacked and compromised?"
never underestimate people's capacity to be mind-glowingly evil...
it seem's they have this thought in mind
Asking people to think is like asking them to buy you a new car
...has already thought about this.
...hooked into everything. Then Eyenet took over, launching missiles against Russia.
The exactly same thing will happen if they do not provide the service to undeveloped areas, the patient suffers and possibly dies. Any effort to do something is better than doing nothing despite the risks involved.
You can't completely prevent your communication going down due to malice, accident, or acts of nature. When those fail you have to have a backup plan such as going into a failsafe mode.
BUT You can and must detect interference and either correct for it or treat it like a total communications failure. There is no excuse for being fooled into taking instructions from an unauthorized party (well, unless the instruction is "you think I'm hacking your communications but I'm really doing a side-channel attack to trick you into doing what you normally do when you lose communications, now obey me and do what you normally do when your communications are hosed, thank you.").
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
This is more security research for the sake of security research, so they can sell snake oil security products for threats that don't exist. Turn in your "ethical hacker" certificate and get real job.
Even with a secure link it's possible to overload the network with a denial of service attack.
Great that they are thinking about security on the device long before they are implemented... but, I would think that it would be way more important to think about the connection these things are communicating over first...
Seems to me that battlefield and rural areas would have the least reliable network connection possible. I would think that the bar would need to be raised in this area before SURGERY could be accomplished.
My eyes reflect the stars and a smile lights up my face.
And you thought _gamers_ complain about lag time on public networks. What about a robot with a knife in someone? Add to that the unreliability of battlefield network connections? This is not giving me the warm fuzzies...
Pay for real IT security staff. $250,000 a year each is a starting wage for Good ones. Until you do so you will have problems.
WE need to stop with this bullshit of trying to get security without paying for it. Tell these morons, DUH! you refuse to pay for it. until they understand.
Do not look at laser with remaining good eye.
The attack will come from within.
Get free satoshi (Bitcoin) and Dogecoins
Sorry, we thought you said you needed a craneotomy, not an appendectomy!
This sounds like the perfect vehicle for the cloak-and-dagger set to eliminate high-value targets while they are most vulnerable. That frightens me quite a bit.
"I drank WHAT?!"--Socrates
First they're doing surgery, then they're asking to join Starfleet. When does it end?
Somewhere, something incredible is waiting to be known. -Carl Sagan
Why bother hacking into a single robot when comm links are fragile and you can bring everything down?
I did a design review of a robotic surgery device a number of years ago. They told me that when the trigger was pushed, the device would cut. When the trigger release signal was received, the device would stop cutting. When I asked about immunization a link failure they said .... Oops!
Conducting a threat and risk assessment along with vulnerability analysis in an open and methodical manner is one step to resolving the oops! Issue.
As an example, it's very hard to get any MDs or nurses in some of the emptier remote parts of WA, BC, and ID, and at times, even if you could drive it, it's 50-100 miles to the nearest hospital over mountain passes with a heck of a lot of snow where I grew up. Some days the highway won't reopen for a week.
So something like this is way more important than you might realize.
Links aren't that fragile in many of these remote areas, as a lot of our power generation is going on there, so you can piggyback on the transmission line power at very high communication rates, but sometimes you can't even fly there, and the surgery is needed ASAP.
-- Tigger warning: This post may contain tiggers! --
Look at where and when they plan to use these. It sounds like they intend them for situations where a live doctor is not available. If they use it in 10 emergencies, 1/2 of the time it is succesful and 1/2 of the time it is hacked then that's 5 lives saved that would have died and 5 lost that would have died anyway.
Don't get me wrong, these things should be secured and the goal should be to save all 10. But.. no use letting the 5 lucky ones die just because it isn't ready yet!
Fight your way out of reach of a flock of hysterical surgery robots, recently hacked and delivering death at the corridors of the hospital. Wipe your tears as one of the robots encapsulates its disappointment to its designer and its builder at the factory to clean 1500 byte packets. Team up with disaffected MIT graduates to deliver deadly blows to the robots using improvised weaponry made solely out of the equipment found from the hospital cafeteria. Enjoy the drama, enjoy the action, enjoy the Battle Field Robotic General!
And again. It's not just the doctor that you can't get in rural areas. It's the nurse, the anesthetist, the OR tech, the OR, the pieces parts, the blood bank, the ventilator, etc. Surgery is a whole package. It is much safer to get the patient out to an institution that does the procedure on a regular basis than to try to hack through a treatment that the staff hasn't done in a year. Not everything goes right. Sometimes you want another specialist to help when surgical misadventures arise. Until the tech gets to be something like a Weyland Med Pod, robot surgery is going to be a niche area, confined to hard to get areas or procedures that need extremely fine physical control.
Faster! Faster! Faster would be better!
Actually, the UW surgical robot is the one you see in the space training sequences of certain SF movies. Ender's Game specifically.
It actually exists.
-- Tigger warning: This post may contain tiggers! --
the researchers noted, and asked: "But what if these robotic systems are attacked and compromised?"
Then we shoot their field doctors too. There's a reason why medics paint a big visible cross on their helmet, it keeps them from getting specifically targeted on the battlefield. Specifically targeting the medical telerobotics systems with your cyberwarfare apparatus will likely escalate far beyond what would happen if you had just killed the patient properly. Healthy soldiers, fair game. You fuck up and don't kill your enemy, then that's on you, you don't get to kill the medics.
In other words: The "researchers" didn't think shit through properly, again.
Surgery over a satelite link to a remote location sounds dangerous, due to the 500ms latency for any feed back...