Slashdot Mirror
Ransomware Expected To Hit 'Lifesaving' Medical Devices In 2016 (forrester.com)
An anonymous reader writes: A surge in ransomware campaigns is expected to hit the medical sector in 2016, according to a recent report published by forecasters at Forrester Research. The paper 'Predictions 2016: Cybersecuirty Swings To Prevention' suggests that the primary hacking trend of the coming year will be "ransomware for a medical device or wearable," arguing that cybercriminals would only have to make mall modifications to current malware to create a feasible attack. Pacemakers and other vital health devices would become prime targets, with attackers toying with their stability and potentially threatening the victim with their own life should the ransom demands not be met.
But that would qualify.
I suppose it's inevitable that these devices would become a Target at some point. Security is a Hot Topic these days. Sak's to be a victim.
Also, Walmart.
It's my understanding that when you're committing a crime, the last thing you want to do is break even worse laws that will get you a worse sentence if caught. Ransoming encrypted computer files is one thing. Murder is something else.
How about we don't put a network chip on a pacemaker, dumbasses.
Why would you ever need to communicate with it? Is there ever a time when you want your heart not to beat?
Would that be Darth Mall where I do my holiday shopping for medical truth extraction bots? What changes are they making?
Some drink at the fountain of knowledge. Others just gargle.
I bet articles like these are going to do more damage to people than any actual malware infections. How many people do you think are going to actually be walking around with an infected pacemaker? It's not like you can open up your chest and run Malwarebytes on the damn thing. So when some hospitals patient files gets hacked, and Joe Shmoe gets a phone call or an Email implying that if he doesn't pay up his heart will explode, he's going to be breaking out his checkbook just to be safe.
On the other hand, this is really just another reason to go with an external pacemaker.
Why in hell is a pacemaker something accessible in any way to a random malware distributor?
Because it's a programmable electronic device and they are all accessible to sufficiently sophisticated malware by definition. There's no way around that unless everything that ever accessed the device was completely air-gapped, self-contained and hardened. Note that this would also preclude any sort of data I/O with PCs etc., making the whole thing almost useless.
have never had the ability or need to talk to the internet
They still don't. Read the original article carefully, and be able to rationally separate wheat from chaff, or, as it is here, sensationalist bullshit.
A successful API design takes a mixture of software design and pedagogy.
jury full of doctors, and a hanging judge, three cameras, and a satellite channel would make a real good reality show for hackers. I'll run sound or lighting for free, experience in local TV, prefer weekends so I can get back to my day job...
if this is supposed to be a new economy, how come they still want my old fashioned money?
Near. Field. Communications.
It seems pretty irresponsible to me that pacemakers and other implantable medical devices are accessible via WiFi and/or cellular data. Communication with the device in question should require a proximity measured in inches. Yes, it might still be possible with a strong transmitter and a sensitive receiver to extend that range to some tens of feet; but in that case the success of the attack is way less likely than one which can be launched from almost anywhere in the world.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
I know there is US-CERT, and then ICS-CERT, anything dedicated to just medical devices?
It's my understanding that when you're committing a crime, the last thing you want to do is break even worse laws that will get you a worse sentence if caught.
Yeah, you'd think that. And some of them actually do think of that.
But many criminals don't think very well, or very far ahead. Not thinking about being caught is common. Not expecting to be seriously inconvenienced if they ARE caught is common also.
Think about it: How is "Send me a bitcoin or your insulin pump will deliver a fatal dose!" different from armed robbery for a fat wallet? "Give me a bunch of money or I shoot you!" And a bunch of them DO shoot - (VERY) often even if they GOT the money.
The threat of law-enforcement escalation for murder doesn't seem to have stopped up-front-and-personal armed robbery. Why should it stop distant-and-anonymous ransomware?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Medical ransomware already exists. It is euphemistically called "hospital billing system."
to look at porn on her pacemaker.
... required to pay for all of the damages caused by their stupidity.
Seriously this could only work if you connected medical devices (incompetently) to a network. It could only work if you used some completely overcomplex operating system with far more features than you need.