Slashdot Mirror
Ransomware Expected To Hit 'Lifesaving' Medical Devices In 2016 (forrester.com)
An anonymous reader writes: A surge in ransomware campaigns is expected to hit the medical sector in 2016, according to a recent report published by forecasters at Forrester Research. The paper 'Predictions 2016: Cybersecuirty Swings To Prevention' suggests that the primary hacking trend of the coming year will be "ransomware for a medical device or wearable," arguing that cybercriminals would only have to make mall modifications to current malware to create a feasible attack. Pacemakers and other vital health devices would become prime targets, with attackers toying with their stability and potentially threatening the victim with their own life should the ransom demands not be met.
But that would qualify.
I suppose it's inevitable that these devices would become a Target at some point. Security is a Hot Topic these days. Sak's to be a victim.
Also, Walmart.
It's my understanding that when you're committing a crime, the last thing you want to do is break even worse laws that will get you a worse sentence if caught. Ransoming encrypted computer files is one thing. Murder is something else.
What kind of modifications to a mall would they need to make? The Hot Topic needs to switch places with the Spencers Gifts?
I meant, click bait. Accidental.
How about we don't put a network chip on a pacemaker, dumbasses.
Why would you ever need to communicate with it? Is there ever a time when you want your heart not to beat?
Would that be Darth Mall where I do my holiday shopping for medical truth extraction bots? What changes are they making?
Some drink at the fountain of knowledge. Others just gargle.
Something like what Wikipedia administrators would do to innocent editors that they revert. Also the medical devices would be updated to use systemD.
I think it is supposed to be small vs mall. That is unless they plan on targeting mall walkers.
Why in hell is a pacemaker something accessible in any way to a random malware distributor?
It's a bloody pacemaker. It goes into your chest cavity. They've been around since the 1950's and have never had the ability or need to talk to the internet. Why would anyone design one with this vulnerability, when it could potentially mean the death of the person using it?
Nothing a 13 GB HOSTS file can't solve.
I bet articles like these are going to do more damage to people than any actual malware infections. How many people do you think are going to actually be walking around with an infected pacemaker? It's not like you can open up your chest and run Malwarebytes on the damn thing. So when some hospitals patient files gets hacked, and Joe Shmoe gets a phone call or an Email implying that if he doesn't pay up his heart will explode, he's going to be breaking out his checkbook just to be safe.
On the other hand, this is really just another reason to go with an external pacemaker.
The problem with hacking medical devices, if such thing is possible at all, that cybercrimes are usually ignored by authorities, even the FBI says it's better pay up, but murder cannot be ignored. The FBI will need to investigate those cases until the perpetrators are identified and brought to justice in the USA. Even if that takes co-axing the CIA and NSA into the investigation. The FBI depends on the people liking them for the financing they receive via representatives and thus needs to solve cases that scare people.
The paper 'Predictions 2016: Cybersecuirty Swings To Prevention'
Editors, is it too much to ask that you do your job - that you actually edit submissions?
The effectiveness of ransomware is that it can lock you out of your files in an effective way.
That's not true in case of medical / wearable devices - all you have to do is reflash the firmware.
I think the subscription fee of $499 to read the actual article should make this Ransomware.
Put a "revert firmware" Big Red Switch on all of it, have backup procedures in place for data, and don't pay one penny for "tribute" or "Dane geld" to those SOBs. Problem solved.
It hasnt stopped Humana
How many thousands (millions?) of murders have they committed in the pursuit of their pyramid scheme?
jury full of doctors, and a hanging judge, three cameras, and a satellite channel would make a real good reality show for hackers. I'll run sound or lighting for free, experience in local TV, prefer weekends so I can get back to my day job...
if this is supposed to be a new economy, how come they still want my old fashioned money?
Near. Field. Communications.
It seems pretty irresponsible to me that pacemakers and other implantable medical devices are accessible via WiFi and/or cellular data. Communication with the device in question should require a proximity measured in inches. Yes, it might still be possible with a strong transmitter and a sensitive receiver to extend that range to some tens of feet; but in that case the success of the attack is way less likely than one which can be launched from almost anywhere in the world.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
I know there is US-CERT, and then ICS-CERT, anything dedicated to just medical devices?
It's my understanding that when you're committing a crime, the last thing you want to do is break even worse laws that will get you a worse sentence if caught.
Yeah, you'd think that. And some of them actually do think of that.
But many criminals don't think very well, or very far ahead. Not thinking about being caught is common. Not expecting to be seriously inconvenienced if they ARE caught is common also.
Think about it: How is "Send me a bitcoin or your insulin pump will deliver a fatal dose!" different from armed robbery for a fat wallet? "Give me a bunch of money or I shoot you!" And a bunch of them DO shoot - (VERY) often even if they GOT the money.
The threat of law-enforcement escalation for murder doesn't seem to have stopped up-front-and-personal armed robbery. Why should it stop distant-and-anonymous ransomware?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Medical ransomware already exists. It is euphemistically called "hospital billing system."
to look at porn on her pacemaker.
on Linux though.
... required to pay for all of the damages caused by their stupidity.
Seriously this could only work if you connected medical devices (incompetently) to a network. It could only work if you used some completely overcomplex operating system with far more features than you need.