Slashdot Mirror
Implantable Cardiac Devices Could Be Vulnerable To Hackers, FDA Warns (vice.com)
The U.S. Food and Drug Administration warned on Monday that pacemakers, defibrillators and other devices manufactured by St. Jude Medical, a medical device company based in Minnesota, could have put patients' lives at risk, as hackers could remotely access the devices and change the heart rate, administer shocks, or quickly deplete the battery. Thankfully, St. Jude released a new software patch on the same day as the FDA warning to address these vulnerabilities. Motherboard reports: St. Jude Medical's implantable cardiac devices are put under the skin, in the upper chest area, and have insulated wires that go into the heart to help it beat properly, if it's too slow or too fast. They work together with the Merlin@home Transmitter, located in the patient's house, which sends the patient's data to their physician using the Merlin.net Patient Care Network. Hackers could have exploited the transmitter, the manufacturer confirmed. "[It] could (...) be used to modify programming commands to the implanted device," the FDA safety communication reads. In an emailed response to Motherboard, a St. Jude Medical representative noted that the company "has taken numerous measures to protect the security and safety of our devices," including the new patch, and the creation of a "cyber security medical advisory board." The company plans to implement additional updates in 2017, the email said. This warning comes a few days after Abbott Laboratories acquired St. Jude Medical, and four months after a group of experts at Miami-based cybersecurity company MedSec Holding published a paper explaining several vulnerabilities they found in St. Jude Medical's pacemakers and defibrillators. They made the announcement at the end of August 2016, together with investment house Muddy Waters Capital.
Well over a decade ago RSA was working with a cardiac device manufacturer to prevent the device being vunerable to hackers.
Apparently the device had a Z80 variant in it so the RSA guys had to get hold of some old books to work out how to code for it.
Of course there are always cowboys taking shortcuts so that's probably why the FDA is warning some manufacturers that they should not be taking a stupid shortcut.
If the FDA weren't so strict about certifying every possible change to a medical device, this would be less of an issue. Because of all the hoops and red tape manufacturers have to go through anytime they make a change, the FDA rules/regulations provide a disincentive to make changes.
And, why is the FDA pointing a finger at device manufacturers, whey they themselves are responsible for device approval and should have identified these issues before giving that approval? Either they're responsible for ensuring that devices are safe, or they're not. They can't have it both ways.
Your government at work.
"National Security is the chief cause of national insecurity." - Celine's First Law
See it free! Die? It's the cost you pay for info which MUST BE FREE! It's got to be FREE!
= " I opt for a Tomb"
1) Interactions with medical implants need to supply their own source of power (e.g. via RF).
2) Unpower interactions may only occur if the medical implant detects a medical event.
If your medical implant violates either of these rules then it is improperly designed.
Anons need not reply. Questions end with a question mark.
Karen Sandler, Executive Director of the Software Freedom Conservancy, has an enlarged heart (hypertrophic cardiomyopathy) and is at risk of suddenly dying (due to a medical condition called "sudden death"). She has no symptoms. She has given a talk about this many times at tech conferences, you should be able to find a copy of her talk online quite easily. She calls herself a "cyborg lawyer running on proprietary software" because she needs to wear a pacemaker/defibrillator device on her heart which keeps her heart beating within a predetermined acceptable range (not too slow, not too fast) by shocking her heart until it beats at an acceptable rhythm. Sandler said she's been shocked before and it's like being kicked in the chest and it takes the wind out of her for a while, requiring her to take some time for recovery.
She knew of software freedom and figured on these weaknesses in these devices, some of which can be controlled remotely at some distance, because all of them run on proprietary software. She tried to get the source code, even offering to sign a non-disclosure agreement to do so, and nobody would share the code with her. She said she was the only one to ask her doctors about what ran on the device. She therefore chose an older model which requires the "programmer" device which sends a signal to the pacemaker/defibrillator be quite close to her body so that she'd probably know if someone were doing things to her device. The lack of software freedom and full user control (ownership) of the device is quite obviously a health risk and possibly lethal. Don't let anyone tell you a lack of software freedom isn't serious.
An interesting thing happened during her pregnancy, which she explained in an update to her talk: She learned that a pregnant woman's heart sometimes naturally races. For most women of childbearing age this isn't a problem as they're unlikely to need a pacemaker/defibrillator, so their heart can occasionally race without serious consequences. For Sandler this racing triggers the device to shock her back into an "acceptable" heart rhythm. It appears that the pacemaker/defibrillator device makers didn't test this device on women young enough to be of childbearing age but they're apparently happy to sell the devices for implanting into users of any age. This lack of testing in combination with the lack of software freedom means the device manufacturers aren't doing due diligence and they're preventing younger women, such as Sandler, from looking out for their own interests—avoiding "sudden death". One can only imagine what horrible multiply lethal outcome could predictably result for a pregnant woman with the same condition Sandler has whose heart races when she was driving while receiving a shock from her non-free pacemaker/defibrillator device. Don't let anyone tell you a lack of software freedom isn't serious.
Digital Citizen
I know I can't think of any internet connected system that doesn't have potential vulnerabilities. Why would anyone think medical devices were some sort of magical exception ?
True story.
I thought the only thing that non-negotiably *had* to be removed prior to cremation was the RTG nuclear batteries used about 40 years ago (before regulators banned new ones out of concerns that it was only a matter of time until one literally went "up in smoke", or got stolen (after killing the owner) by terrorists wanting plutonium for a diy dirty bomb.)
Pacemakers aren't that radioactive. They are on similar level as tritium tubes used for illumination. You need lots and lots of them to do a meaningful dirty bomb, and it isn't the right isotope for fission bombs.
As for banning them, are they really banned? There are many reasons why they aren't used anymore :
- improvement in lithium battery technology
- life expectancy of people with pacemaker is relatively low on average. So in most case, the extreme battery life of nuclear pacemaker is not needed.
- pacemaker technology constantly evolves so changing an old pacemaker has benefits beyond the battery
- plutonium-238 is becoming more and more expensive and hard to find, even space agencies have trouble getting it
Anyone who manages to get Linux running on a pacemaker deserves a lot of credit. These devices consume an order of magnitude or two less power than the smallest systems to run Linux.
I am TheRaven on Soylent News
To apply the patch, you have to twist the patient's nipples in opposite directions to the beat of the music that plays when Darth Vader enters a scene.
Freedom to fear. Freedom from thought. Freedom to kill.
I guess the War on Terror really is about freedom!
Not unlike documentation, once the miracle gizmo has made it past the FDA (I.e., gone into production), going back to fix kludges and clean up dirty code slides wa-a-ay down the list of priorities.
And this is why capitalism is evil. It doesn't care about you, it just wants your money. It doesn't care how much environmental damage is done, for example. Therefore, it rewards a company for forever abandoning projects half-finished, at the point at which someone will pay for them. Then we are buried beneath an avalance of ill-conceived garbage.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
"One can imagine how X could be a problem therefore X is a problem" is a fallacy. I can imagine that unicorns exist. That doesn't mean (unfortunately) that they exist.
A high ranking intelligence official, speaking on condition of anonymity, cited details of a classified government report which confirms without a doubt that hackers working on behalf of the Russian government, and personally supervised by Vladimir Putin, are conspiring to hack pacemakers in elderly Democrat-leaning USA voters to interfere with the 2018 elections.
Pacemaker and implanted device procedures aren't that dumb. They're actually pretty well thought out. All implanted pacemaker devices require near-proximity access(1-2 centimeters) to access, the communication is completely encrypted between the programmer unit and the device being implanted. Once it's implanted it can ONLY be "tuned, modified" with your cardiac surgeon present, and in an operating theater environment. Changing anything in the device is treated exactly the same as a "new surgery." They expect that any change could potentially brick the device... so they have to be ready to go in. And, no the "manufacturer" does not retain any ownership of the device once it has been implanted. The laws upheld by the Supreme Court state anything implanted in a persons body becomes the property of the person. Period. That's just the law. The answer to the "nightmare scenario" as envisioned by techies, there is no universal "standard diagnostic port" in case you're wheeled into an emergency room and the doctors need to "access your device to save your life!" No. They can't. There's no expectation that they would, could, or should. That's not the medical procedure. If your pacemaker is malfunctioning and causing a threat to your life, then it *is* the problem, and they would remove it. They don't try to "fix" it... or reboot it, or read the diagnostic logs... not while you're dying on the table. They just remove it and stabilize you without one and get you prepped for a new one.
Everything except telemetry should require some kind of hardware level permission (analogous to write protect switch), not software. Telemetry should be end to end encrypted.
John_Chalisque
I don't see anything in your post that makes me believe that if Karen Sandler had access to the code she could make improvements to the device for her particular situation.
First, as another poster has noted, modern implantable devices are extensively configurable, and yet most of them go in with the default settings, because the cardiologist/surgeon don't know enough about each device to tweak the settings. So it is quite conceivable that it could be already be configured to deal properly with a pregnant woman's racing heartbeat.
Second, all of these devices walk a hazard/benefit tightrope. You are dealing with devices that can kill the patient if they fail. The patient might die due to the ordinary surgical complication risk that is always present. The device might function but not actually help them because of their particular physiology. So the validation of the device talks a lot about risk and reward, and the testing will focus on the population most likely to benefit. It is likely that pregnant women form a miniscule market for this device, so they may be considered an off label use - something that was not studied and about which nothing is known.
Think of pharmaceutical ads, and how often you hear the phrase "women who are pregnant or thinking of becoming pregnant should consult their doctor". That tells you right there that either pregnant women weren't studied, or that they have additional risk factors because of the pregnancy.
To think that access to the sourcecode by an interested layperson could make the software meaningfully better is a stretch. Perhaps getting access to the programming manual for the device would help, but that doesn't require access to the source code.
should we start CVE's for biomedical equipment?
Did some research... pacemakers actually used Promethium, not Plutonium. From what I can tell, the betavoltaic battery cost skyrocketed in the mid-70s, and the manufacturer decided it wasn't worth bothering with.
A far as dirty bombs go, they wouldn't *have* to directly kill anyone with radiation... the sheer public panic after a confirmed explosion of one would almost *certainly* kill dozens, if not hundreds (trampling, car wrecks, panicked looting, etc). For terrorist purposes, just *having* something radioactive -- in any quantity -- will achieve the goal of inciting public panic.
You don't want kludges in your pacemaker. There's a time and place for them, but that's not it.
"First they came for the slanderers and i said nothing."
Al, is that you?
This is exactly like from game Hacknet! One mission was to hack medical device manufacturer system, find a patient's pacer IP and kill him. He wanted a euthanasia, but wasn't allowed to get one legally, so the player had to overload the pacer.
So the threat of death is enough for you to argue the status quo standing behind proprietors and denying the user full control of a device they obtained (in Sandler's case wear inside their body) but not enough for you to let the user control. We still don't think that's the case for more common devices that are involved in lot of harm such as cars. In light of what's actually already happened to Sandler, your response is remarkably sycophantic to power. Automakers would probably be interested to talk to you in light of the ongoing embarrassment they face in Dieselgate.
Interested people already modify the source code to the software running on various devices, it's a matter of which people get to inspect, share, and modify. For all you know, in Sandler's case she could take said code to someone who is sufficiently skilled. In any event, to whom the user takes the source code is nobody's business but theirs and not a justification for the failures that have already occurred or foreseeable problems to others.
Digital Citizen
So the threat of death is enough for you to argue the status quo standing behind proprietors and denying the user full control of a device they obtained (in Sandler's case wear inside their body) but not enough for you to let the user control. We still don't think that's the case for more common devices that are involved in lot of harm such as cars. In light of what's actually already happened to Sandler, your response is remarkably sycophantic to power.
I think you are mixing arguments. I was making the utilitarian case that the remedy proposed (software freedom) was unlikely to be an effective remedy in this case. I said nothing pro or con about software freedom.
If you want to argue conceptually for software freedom, then Karen Sandler's case is nothing but an anecdote, and we can rehash the usual pro/anti FSF and GPL arguments all day long. Personally I don't view proprietary software as evil or even morally suspect, and I am fairly sure you disagree with that view.
Not quite - you see, the manufacturer is going to create a newer, better version of their product (to preserve patent and copyright protections and maximize profits^H^H^H^H^H^H^Hbenefits to the public), so the code cleanup will probably find its way into the 2.0 version of their wonder widget/frammis/dololly.