Slashdot Mirror
Researchers Mount Cyberattacks Against Surgery Robot
An anonymous reader writes: A group of researchers from University of Washington have tested the security of a teleoperated robotic surgery system created by their colleagues, and have found it severely lacking. "Teleoperated surgical robots will be expected to use a combination of existing publicly available networks and temporary ad-hoc wireless and satellite networks to send video, audio and other sensory information between surgeons and remote robots. It is envisioned these systems will be used to provide immediate medical relief in under-developed rural terrains, areas of natural and human-caused disasters, and in battlefield scenarios," the researchers noted, and asked: "But what if these robotic systems are attacked and compromised?"
never underestimate people's capacity to be mind-glowingly evil...
it seem's they have this thought in mind
Asking people to think is like asking them to buy you a new car
...has already thought about this.
You can't completely prevent your communication going down due to malice, accident, or acts of nature. When those fail you have to have a backup plan such as going into a failsafe mode.
BUT You can and must detect interference and either correct for it or treat it like a total communications failure. There is no excuse for being fooled into taking instructions from an unauthorized party (well, unless the instruction is "you think I'm hacking your communications but I'm really doing a side-channel attack to trick you into doing what you normally do when you lose communications, now obey me and do what you normally do when your communications are hosed, thank you.").
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Which is worse for a patient with a condition that is typically not fatal and for which on-site surgery has a known risk of fatality:
* Sorry, you'll have to wait for a doctor who may never come
* We'll give you remote surgery but there's a chance someone will hack the system in a way that could kill you, plus there is still the normal risk you will never wake up from the anesthesia
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Even with a secure link it's possible to overload the network with a denial of service attack.
Not just that. Humans are corruptible. Send a doctor in to do it live and there's no reason that a doctor couldn't be compromised and kill the person anyways.
The exactly same thing will happen if they do not provide the service to undeveloped areas, the patient suffers and possibly dies. Any effort to do something is better than doing nothing despite the risks involved.
Sure, but there's a few more options than doing this and doing nothing. For example, if the connection is so unreliable would you rather have someone on-site try doing it under audio/video/photo/sketch/text guidance and if the connection breaks down he'll just have to wing it or do you really want a remotely operated robot that'll leave you stranded when the connection fails. Not to mention the latter is harsh, but maybe needed on-the-job training. And if you want remotely operated robots, well you need some pretty advanced skills to maintain and repair them so you might just replace one skill they don't have for another.
Live today, because you never know what tomorrow brings
Great that they are thinking about security on the device long before they are implemented... but, I would think that it would be way more important to think about the connection these things are communicating over first...
Seems to me that battlefield and rural areas would have the least reliable network connection possible. I would think that the bar would need to be raised in this area before SURGERY could be accomplished.
My eyes reflect the stars and a smile lights up my face.
And you thought _gamers_ complain about lag time on public networks. What about a robot with a knife in someone? Add to that the unreliability of battlefield network connections? This is not giving me the warm fuzzies...
Pay for real IT security staff. $250,000 a year each is a starting wage for Good ones. Until you do so you will have problems.
WE need to stop with this bullshit of trying to get security without paying for it. Tell these morons, DUH! you refuse to pay for it. until they understand.
Do not look at laser with remaining good eye.
Yes. The entire thesis of the researchers is more than a little bizzare:
A crucial bottleneck that prevents life-saving surgery being performed in many parts of the world is the lack of trained surgeons. One way to get around this is to make better use of the ones that are available.
No, these machines are going to be used in 'first world' situations in order to help surgeons perform difficult tasks. The idea that someone is going to send a highly complex robot out into the total boonies is pretty far fetched. Surgery is much more than the surgeon. It's the scrub and circulator nurses. It is the sterile OR and equipment. It is anesthesia and pre op and post op nursing. This machine will do little to help with the lack of care.
Now, having a poorly secured surgical robot anywhere isn't such a bright idea and it is likely that the manufacturers need to work on this, but surgery robots are in their infancy at present.
Faster! Faster! Faster would be better!
The attack will come from within.
Get free satoshi (Bitcoin) and Dogecoins
This sounds like the perfect vehicle for the cloak-and-dagger set to eliminate high-value targets while they are most vulnerable. That frightens me quite a bit.
"I drank WHAT?!"--Socrates
First they're doing surgery, then they're asking to join Starfleet. When does it end?
Somewhere, something incredible is waiting to be known. -Carl Sagan
It is Skynet's pupil.
Sorry, we thought you said you needed a craneotomy, not an appendectomy!
A crappendectomy?
Why bother hacking into a single robot when comm links are fragile and you can bring everything down?
No, these machines are going to be used in 'first world' situations in order to help surgeons perform difficult tasks.
No, they'll be used in first world, but the operator sits in an Indian surgery center fixing your heart valve for $10 per hour.
As an example, it's very hard to get any MDs or nurses in some of the emptier remote parts of WA, BC, and ID, and at times, even if you could drive it, it's 50-100 miles to the nearest hospital over mountain passes with a heck of a lot of snow where I grew up. Some days the highway won't reopen for a week.
So something like this is way more important than you might realize.
Links aren't that fragile in many of these remote areas, as a lot of our power generation is going on there, so you can piggyback on the transmission line power at very high communication rates, but sometimes you can't even fly there, and the surgery is needed ASAP.
-- Tigger warning: This post may contain tiggers! --
Look at where and when they plan to use these. It sounds like they intend them for situations where a live doctor is not available. If they use it in 10 emergencies, 1/2 of the time it is succesful and 1/2 of the time it is hacked then that's 5 lives saved that would have died and 5 lost that would have died anyway.
Don't get me wrong, these things should be secured and the goal should be to save all 10. But.. no use letting the 5 lucky ones die just because it isn't ready yet!
It depends on the cost of these things. If each robot is a gazillion dollars then yes, you're right, they'll only be used in the first world. If the price is intermediate then they may well be mounted in military helicopters and mobile facilities to do battlefield surgery beyond the capability of the corpsmen. If they are cheap (comparatively) then they will be widely deployed, never mind the network and security issues, in the Third World. In Peru, which I am most familiar with, the top surgeons tend to prefer to live in Lima or Arequipa, and if you need their services you need to travel there. Most other Third World countries are much the same. If I lived in Machu Picchu and needed heart surgery I would need to travel to Cusco, and then to Lima, three days of travel before I could even be examined. If I can go to Cusco and be examined and treated I would dramatically reduce the travel and expense necessary while still receiving decent care. Even more likely is that advanced medical students will be called in to perform large numbers of basic medical services, like dental treatment and cataract removal, in the smaller towns while still under the supervision of their instructors.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
But if you lived in Machu Picchu and needed heart surgery, it would be extremely unlikely that anyone would truck the machine up there. Because you also need a bypass machine. And a damned good anesthesiologist (who probably lives with the other docs in the big city) and the nurses and the dacron grafts and the special sutures and the ventilators and the vent techs and so forth and so on.
So having the smart machine doesn't help you over much. Even for battlefield medicine, I don't think surgical robots are going to prove useful for the same reasons. It's easier to just pack up everyone as a team and dump them on some handy flat piece of ground away from the front. Then drag your victim in using paramedic level persons and helicopters - things that can stand being shot at and don't need high bandwidth connections to function.
The supervision of basic providers is an excellent model but that is typically going to be just video rather than a robot. Anything with opposable thumbs can do a basic cataract - you could build a robot that would do some of the manipulations, but it's pretty automated as it is. There are going to be niches with this sort of tech, certainly we can work on changing some procedures that have remained the same for 200 years, but surgical robots are going to be just a small part of things. Hell, a 3D printer might even be more useful - a common situation in remote areas is that the docs / providers know how to do something, they just don't stock the special screw / graft / gizmo that a bigger hospital would. Even 3D printed orthotics (ie, very low tech) would be pretty useful (and I'm sure I've seen articles where they are starting on this).
Faster! Faster! Faster would be better!
And again. It's not just the doctor that you can't get in rural areas. It's the nurse, the anesthetist, the OR tech, the OR, the pieces parts, the blood bank, the ventilator, etc. Surgery is a whole package. It is much safer to get the patient out to an institution that does the procedure on a regular basis than to try to hack through a treatment that the staff hasn't done in a year. Not everything goes right. Sometimes you want another specialist to help when surgical misadventures arise. Until the tech gets to be something like a Weyland Med Pod, robot surgery is going to be a niche area, confined to hard to get areas or procedures that need extremely fine physical control.
Faster! Faster! Faster would be better!
Actually, the UW surgical robot is the one you see in the space training sequences of certain SF movies. Ender's Game specifically.
It actually exists.
-- Tigger warning: This post may contain tiggers! --