Slashdot Mirror


FDA Issues Recall of 465,000 St. Jude Pacemakers To Patch Security Holes (zdnet.com)

In what may be a first, patients with heart conditions that are using particular pacemaker brands will have to visit their doctors for firmware updates to keep their embedded devices safe from tampering. From a report: It seems such an odd concept at first, but with many kinds of pacemakers now "smarter," with connections to mobile devices and diagnostic systems, the avenue has been carved for these medical devices to potentially be tampered with, should a threat actor choose. In particular, Abbott's pacemakers, formerly of St. Jude Medical, have been "recalled" by the US Food and Drug Administration (FDA) on a voluntary basis. The devices must be given a firmware update to protect them against a set of critical vulnerabilities, first reported by MedSec, which could drain pacemaker battery life, allow attackers to change programmed settings, or even change the beats and rhythm of the device. On Tuesday, the FDA issued a security advisory, warning that the pacemakers must be recalled -- and as they are embedded within the chests of their users, this requires a home visit or trip to the hospital to have the software patch applied.

73 comments

  1. What do the patients do by fredrated · · Score: 1

    while their device is rebooting?

    1. Re:What do the patients do by Anonymous Coward · · Score: 5, Informative

      Pacemakers are there to correct a bad or weak rhythm. They don't do the actual work of pumping blood.

      Also, it's possible to hook up an external pacemaker while the implanted one is being reflashed.

    2. Re:What do the patients do by Anonymous Coward · · Score: 1

      They'll probably be praying that the damn thing will come back up again and not get bricked by a failed update.

    3. Re:What do the patients do by Shotgun · · Score: 1

      Congregate in the aisles and complain about management like the rest of us?

      --
      Aah, change is good. -- Rafiki
      Yeah, but it ain't easy. -- Simba
    4. Re:What do the patients do by courteaudotbiz · · Score: 1

      Also, it's possible to hook up an external pacemaker while the implanted one is being reflashed.

      I hope it's the case, cause having 465,000 pacemakers to reflash, you know... ever heard of Murphy's law? The patient better be in a good mood during the firmware update.

    5. Re:What do the patients do by sjames · · Score: 1

      And in many cases, as long as the patient is lying down comfortably, they will be fine with their own heart rhythm for a few minutes.

    6. Re:What do the patients do by courteaudotbiz · · Score: 1

      They'll probably be praying [...]

      I don't see how a prayer will save anything, let alone a pacemaker firmware update.

    7. Re:What do the patients do by Anonymous Coward · · Score: 0

      The only person I've known with a pacemaker was a girl who's heart rate would go astronomically high for no apparent reason. It only happened a few times a week and the pacemaker would kick in and bring it back down.

      Other than during those events, the pacemaker didn't do anything.

    8. Re:What do the patients do by Anonymous Coward · · Score: 0

      a girl who's heart rate would go astronomically high for no apparent reason

      It's called "orgasm".

    9. Re:What do the patients do by Hognoxious · · Score: 1

      Why would that make her heart rate go up?

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    10. Re:What do the patients do by parkinglot777 · · Score: 1

      The only person I've known with a pacemaker was a girl who's heart rate would go astronomically high for no apparent reason. It only happened a few times a week and the pacemaker would kick in and bring it back down.

      Other than during those events, the pacemaker didn't do anything.

      That's not a pace maker. That is defibrillator. Don't be confused. Pace maker is to accelerate heart beat from too slow to normal. Defibrillator, on the other hand, is to slow down the heart beat from abnormal to normal range.

    11. Re: What do the patients do by Anonymous Coward · · Score: 0

      Pacemakers can have the ability to do overdrive suppression known as anti-tachycardia pacing (ATP). The pacemaker paces fast enough to break a re-entrant arrhythmia by triggering/elongating the refractory period of the cardiomyocytes.

      This option is more commonly implemented in ICDs or CRT-Ds but is available on certain pacemakers.

    12. Re:What do the patients do by Chewbacon · · Score: 1

      Some pacemakers -can- overdrive pace patients out of tachy rhythms. I think Medtronic is rolling this out in more pacers after favorable data in a trial of overdrive pacing while charging defibrillators (ICDs) - saved patients a bunch of shocks. Doesn't always work, however, and depends on the mechanism of the rhythm.

      --
      Chewbacon
      The Bible is like Wikipedia: written by a bunch of people and verifiable by questionable sources.
    13. Re: What do the patients do by Chewbacon · · Score: 1

      Generally, the refractory period won't change much from overdrive pacing the atrium. And not all are from re-entry circuits. What is happening is the stimulus from ATP conducts down a pathway while it conducts from the opposite direction, ergo obliterating the propagation and stopping the circuit. It doesn't always work and sometimes a shock is necessary if the device is configured to do so.

      --
      Chewbacon
      The Bible is like Wikipedia: written by a bunch of people and verifiable by questionable sources.
    14. Re: What do the patients do by Anonymous Coward · · Score: 0

      The refractory period actually becomes longer when the AV node is overdriven. This can be seen physiologically when atrial flutter drops out of 1:1 conduction. I did not say all arrhythmias are from re-entrant circuits as this wouldn't work in stopping any ectopic activity so why would I mention the ectopic variant? As I said, the obliteration of the circuit occurs because the wavefront depolarization from the pathologic circuit is stopped due to the cells being in their refractory period.

    15. Re:What do the patients do by Anonymous Coward · · Score: 0

      It operates in backup mode with 67 beats per minute. FDA has details.

    16. Re: What do the patients do by Chewbacon · · Score: 1

      Right and that is a property of the AV node, which involved in AVNRT but not atrial flutter.

      --
      Chewbacon
      The Bible is like Wikipedia: written by a bunch of people and verifiable by questionable sources.
    17. Re:What do the patients do by david_thornley · · Score: 1

      Last I heard, defibrillators restarted the heart on a new cycle.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  2. Bricked by Anonymous Coward · · Score: 0

    Hope the firmware update doesn't leave the pacemakers and consequently their users bricked.

  3. This can't be. by Anonymous Coward · · Score: 0

    They just cannot be so sick as to not have an insanely secured and ultra-simple system for a life-supporting device... That is simply too evil even for humans...

    1. Re:This can't be. by Narcocide · · Score: 1

      Is there a punchline you forgot to add, or am I just missing the sarcasm?

  4. Threat Actor? by Anonymous Coward · · Score: 0

    Is that like Method Acting?

    Or is it an actor who specializes in guesting on those cop porn shows as the "bad guy"?

    "I'm gonna KILL you sucka!!!"

    Threat acting.

  5. Is this why St Jude calls me every day? by Anonymous Coward · · Score: 1

    For the last five years!

  6. You know, it occurs to me that the entire plot.... by mark-t · · Score: 3, Interesting

    .. of Logan's Run (caution.... spoilers follow)....

    ...could be avoided if the City just installed devices that terminated people at the requisite age if they did not participate in their ritual instead of having to maintain a police-like organization of people that hunted them down.

    Of course, this could be circumvented by the (surgical) removal of such a device, which could itself have been the plot point of a different kind of story.

  7. Robocop by lobiusmoop · · Score: 1

    This is like something from the original Robocop movie.

    A similar kind of messed-up.

    "and remember... we care!"

    --
    "I bless every day that I continue to live, for every day is pure profit."
  8. Darwinism in action by Anonymous Coward · · Score: 0

    If you have a weak, defective heart that cannot maintain its own rhythm and subsequently allow a doctor to implant a hackable pacemaker into your chest, and then allow someone to get near enough to hack it, well my friend, it's time for you to go. Good day, sir.

    1. Re:Darwinism in action by arth1 · · Score: 1

      If you have a weak, defective heart that cannot maintain its own rhythm and subsequently allow a doctor to implant a hackable pacemaker into your chest, and then allow someone to get near enough to hack it, well my friend, it's time for you to go. Good day, sir.

      It is a problem that with the US medical system, the patient has no choice of treatment except a Hobson's choice. The doctors have far too much power. Even if you said you would want a device not running any software, a surgeon or insurance company would never let the patient decide.

    2. Re: Darwinism in action by Anonymous Coward · · Score: 0

      That's BS. If you don't want a pacemaker then it is your decision not to get one. The doctor and medical device company can't force you to take one. Now, if you want one with particular features that is entirely different but again you, as the patient, makes the final call.

    3. Re:Darwinism in action by Blinkin1200 · · Score: 1

      Do you really think the doctor is going to know whether the device can be hacked? They all have some sort of communication protocol. My ICD is a older model. I have been able to communicate with it at distances up to ten feet. With a little antenna tweaking I hope to get the distance up to ten meters, then more... They are ALL designed for remote communications. All I am doing is changing the definition of the word 'remote'.

    4. Re: Darwinism in action by arth1 · · Score: 1

      That's BS. If you don't want a pacemaker then it is your decision not to get one.

      Exactly as I said, it's a Hobson's choice.

    5. Re:Darwinism in action by david_thornley · · Score: 1

      In what way do the doctors have too much power? They've got more knowledge and expertise than the rest of us, so they typically offer what treatments they think good, and the patient decides how to proceed among available options. You seem to think the options too limited, and seem to blame the doctors for not keeping obsolescent devices around.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  9. Re:You know, it occurs to me that the entire plot. by Sindar+By+Choice · · Score: 0

    With all the shitty remakes of films recently, I can't believe they haven't done one for Logans Run.
    With todays CGI, and the story of people only being able to live to 30, you would think a studio would be frothing at the mouth to remake it.

  10. I made the mistake once by Anonymous Coward · · Score: 0

    I made the mistake of giving them $20 one time. Since then, I estimate they have spent almost $200 trying to get me to give more, between the constant telemarketer calls and postage spent on weekly solicitations in the mail.

    Red Cross is the same deal. I gave some money one time ten years ago and I have been constantly harassed since then.

  11. Re:What OS do they run? by NicknameUnavailable · · Score: 1

    I'd seriously doubt it were more complex than a PIC microcontroller.

  12. Re:You know, it occurs to me that the entire plot. by Penguinisto · · Score: 1

    With all the shitty remakes of films recently, I can't believe they haven't done one for Logans Run.

    Having seen how studios treat awesome classics of late when they try to crucif^M remake them?

    You can shut your damn mouth now and not give the studios any more ideas. :/

    Regards,
    Someone who has also had more than quite enough of the whole "gritty reboot" treatment.

    --
    Quo usque tandem abutere, Nimbus, patientia nostra?
  13. Re:What OS do they run? by courteaudotbiz · · Score: 2

    I think mine runs on ARGGGHHHHH....... ARGHHHHHH....... beeeeeeeeeeeeeeeeeeeeeeep

  14. Photo? by Anonymous Coward · · Score: 0

    Come on. Post this Circus with no photo?!

  15. Hippocratic oath requires open source software by Anonymous Coward · · Score: 0

    When software runs a device that you literally depend on to live you have a right to it's source code.

    1. Re:Hippocratic oath requires open source software by clodney · · Score: 1

      When software runs a device that you literally depend on to live you have a right to it's source code.

      If you are going to stand on principle, why not go for "When you need a device to live, you have a right to the device"? Having access to the source code is mostly meaningless, and far less consequential than having access to the actual device.

  16. Re:You know, it occurs to me that the entire plot. by PCM2 · · Score: 1
    --
    Breakfast served all day!
  17. Re:What OS do they run? by Anonymous Coward · · Score: 1

    Coroner's Note: He appears to have had his pacemaker beat changed and his heart wasn't funky enough to take it.

  18. Hacker=Threat Actor? by bigdady92 · · Score: 4, Funny

    Is this the new buzzword term of the week? What the hell is a Threat Actor? Tom Cruise on a bad hair day?

    --
    Wheel of Time: Book by Book and Sumview (summary review) Bigdady92 style: http://bigdady92.blogspot.com/
  19. Why is this necessary? by Locke2005 · · Score: 1

    You know, if you'd even think about launching a denial-of-service attack on a pacemaker, you're kind of an asshole, as well as a homicidal maniac!

    --
    I've abandoned my search for truth; now I'm just looking for some useful delusions.
    1. Re:Why is this necessary? by PolygamousRanchKid+ · · Score: 1

      You know, if you'd even think about launching a denial-of-service attack on a pacemaker, you're kind of an asshole, as well as a homicidal maniac!

      *Shrug*. What about folks who think about running rental vans into crowds of innocent pedestrians, and following up with machete attacks . . . ?

      Our Western Civilization is very tolerant of assholes . . . and those who support their doctrines in words and deeds.

      That's why it is necessary. I remember that when I was in elementary school, we didn't even have to lock our bikes. By the time I was in high school, you needed an elephant shackle. It's like an Law of Thermodynamics entropy decline where "asshole-ishness" is growing and cannot be stopped.

      --
      Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
  20. Is it Patch Tuesday? by Anonymous Coward · · Score: 0

    Because...you know...patching never creates different issues. This could be the first time it actually causes widespread death, though. Sorry for those people who Accepted the EULA.

  21. Should have included 3g for remote administration by edtice1559 · · Score: 4, Insightful

    This is what happens when you try to save a few cents on the bill of materials and don't include a 3g radio for remote administration. That way you can just push out updates when security defects are found. Plus you could collect experience data in order to improve future products. (Apologies to the humor impaired)

  22. Re:You know, it occurs to me that the entire plot. by Sindar+By+Choice · · Score: 0

    Yea, I guess it is defined by what you would consider an "awesome classic".

    I know several people who are film buffs who think Logans Run stunk it up...
    Personally I like it, and thought it wasn't bad for the time it came out.

    I think with the right director and screenwriter it could be done well.

    I never placed Logans Run in the same category I would sci-fi films like Alien, Star Wars or 2001 a space odyssey...

  23. Simple Avoidance plan by Anonymous Coward · · Score: 0

    So, I posted the snide remark Where's the photo, but the more I think about it, it's an opportunity to save a couple of you nerd's lives. You see I was like you, up for days, smoking, drinking, coding, hacking, gettin er done. But it comes at a cost you see, I had a heart attack. BAMN plucked.

    So WHY did I have a heart attack?

    Because I listened to the FOOD PYRAMID I got FAT. You want a HFLC diet. Get the wheat out.
    Because my Dad smoked, I smoked from 11 to 50, and drank from 18-50.

    I worked in Cement and was pretty buff. Buff don't matter when it comes to inflammation. You put that SUGAR and IODIZED SALT in your mouth, it's as bad as drinking and smoking, it's worse!

    So I got a Stent. Think about that, a CHUNK of metal in your body.

    But I did something most people don't do, I quit smoking, drinking and worked at my diet until I am like way Crazy now, Stronger than before.

    So somewhere along the way, I was told if I wanted to reduce my chance of a heart attack 90%, all I had to do was eat an apple, carrot and beet every day.

    Guess what. I'm still here, and mean as snot. Check it out no DAPT drugs either. No statins (good god that crap almost had me bed-ridden forever)

    So ... Now YOU the reader... if you look down, can you see your stuff down there? Or you got to suck your stomach in like I did? (but don't now) Cause if you got to suck your stomach in, I got news for you. There's no authority figure, no doctor, nobody out there that cares, until after your dead. If your getting pills the doctors are MILKING YOUR SYMPTOMS not providing health care and restoring your body thru nutrition and work out therapy.

    You got headaches? Double vision? Confusion? Feel like crap all the time. I am telling you this is what's wrong. Put down that fucking COKE. quit sucking down the beers. Put that cigarette out it's your last one forever.

    Now I know what your saying, that's giving up too much. Okay here's what you can keep.
    VAPE as long as you don't combust the smoke
    72% Dark Chocolate A bar every couple days or so.
    sea salt
    Breathing. You get to keep BREATHING.
    Strength comes back.
    WOOD down there comes back.
    Vision - takes time, but does improve
    Pain and inflammation should be reduced to the point where you can sleep again
    if after your glycemic index can be better controlled through your vigilance action and willpower, THEN you may seek recipes for muffins- I suggest them in moderation, if you miss the BREAD. like I did. Fact is I am now going through family recipes to see if anything Grandma made can be actually eaten on my new nutritional path. Most of it is never going to touch my mouth ever again sadly. Makes me real sad knowing this. SO anything with flour has to be converted to some kind of nut flour equivalent. Same for Sugar etc. Anyway, it's not ever a priority but I am ticking away at it, thankful I am still sucking air and kicking butt.

    Note this: how many heart patients do you know can work in 108 degrees shoveling and picking all day in the sun?

    To be honest, I wonder how many of you really know the difference between HEARTBURN and HEART ATTACK. Don't let "OH shit" be your last fucking words on this beautiful earth.

    You can mark this post down, but you really are scum of the earth if you do.
    I am trying to save your life. I used to be so drunk I would skip a post like this.

  24. Not so easy to infiltrate by Anonymous Coward · · Score: 1

    Wife has difibulator/ pacemaker. To do any programming you have a antenna placed over device to interrogate it. Any further then a few inches and you loose signal. Yes, anything is possible but clearly unless someone jumps you and proceeds to hack your device. I think most people are pretty safe. Also the Saint Jude devices like my wife’s cannot be reprogrammed over remote connection. Only recover events and errors.

    1. Re:Not so easy to infiltrate by PolygamousRanchKid+ · · Score: 1

      Yes, but even the slightest whiff of potential lawsuits for "enabling a real Internet kill switch" has the manufacturers of such devices running scared.

      There are going to be damn sure that their devices are hardened now. Hell, you could build a portable microwave pacemaker fryer if you want. And given the trend of things these days, someone will do it for shits & giggles. But the pacemaker manufacturer can't be held liable for that.

      --
      Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
    2. Re:Not so easy to infiltrate by sjames · · Score: 1

      Keep in mind, bluetooth is a short range signal as well, but with a specialized antenna, 100 meters or more is possible. Also keep in mind that if the device is programmable at all, an exploit could allow re-programming even if remote connections are supposed to be read-only.

    3. Re:Not so easy to infiltrate by arth1 · · Score: 1

      Hell, you could build a portable microwave pacemaker fryer if you want. And given the trend of things these days, someone will do it for shits & giggles.

      I doubt you would be able to elicit giggles with such a device. The other one, probably.
      Hacking hearing aids for the lulz is also coming, I'm sure. And electric wheelchairs.

  25. Re:Should have included 3g for remote administrati by Anonymous Coward · · Score: 1
  26. New market by Ol+Olsoc · · Score: 1

    The internet of dead things.

    --
    The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
  27. Definitely don't want to brick that upgrade. by emmjayell · · Score: 1

    But if you do brick it, for the RMA, do you send the whole human back with the pacemaker, or do you extract the pacemaker so you can save on shipping?

    1. Re:Definitely don't want to brick that upgrade. by Crypto+Gnome · · Score: 1

      You'd need to uninstall the device and ship it *in the original packaging*.

      Sure uninstallation typically produces significant damage at the "installation site" (er human being) but that's not the manufacturers problem.

      --
      Visit CryptoGnome in his home.
  28. Re:Should have included 3g for remote administrati by Gravis+Zero · · Score: 1

    This is what happens when you try to save a few cents on the bill of materials and don't include a 3g radio for remote administration.

    I hope you are joking.

    A) A 3g radio would take a LOT of power compared to the rest of the unit.
    B) That would be one hell of a security hole! Cell networks are NOT secure. Baseband modems are NOT secure. A DoS attack alone could drain the battery in minutes!

    This is on par with tying a rope around your neck and attaching the other side to your car seat so that you don't get whiplash. It does solve the whiplash problem but you're still retarded for doing it.

    --
    Anons need not reply. Questions end with a question mark.
  29. Re:You know, it occurs to me that the entire plot. by Gravis+Zero · · Score: 1

    You know, it occurs to me that the entire plot of Logan's Run (caution.... spoilers follow)....

    Really?! Spoilers on the internet already?! It was just release to theaters two score and one year ago!

    --
    Anons need not reply. Questions end with a question mark.
  30. CAN YOU SWIM?! by Thud457 · · Score: 2

    when re-flashing a pacemaker, always be sure to mount a scratch monkey

    --

    the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff

  31. Re:Should have included 3g for remote administrati by omnichad · · Score: 1

    It's definitely a joke. And even funnier, because of using cellular data operating in the microwave band - which people with pacemakers are already avoiding (at this close of a range, at least).

  32. Re:Should have included 3g for remote administrati by Hognoxious · · Score: 1

    Protip: read right to the end before replying.

    --
    Confucius say, "Find worm in apple - bad. Find half a worm - worse."
  33. Re:You know, it occurs to me that the entire plot. by mark-t · · Score: 1

    Hey, I've been chewed out before just for saying stuff online about Star Wars a New Hope. My point was to offer a disclaimer in the hopes of avoiding that.

    I can't win.

  34. Re:You know, it occurs to me that the entire plot. by Gravis+Zero · · Score: 1

    I can't win.

    Welcome to the internet.

    --
    Anons need not reply. Questions end with a question mark.
  35. Null by godel_56 · · Score: 1

    Undoing moderation.

  36. They Can't by Anonymous Coward · · Score: 0

    They're going to screw up the ending to Watchdogs.

  37. In old times there was a reed switch... by Anonymous Coward · · Score: 0

    which you had to apply a magnetic field to to make the pacemaker responsive to communication. I guess that kind of security is not needed in the modern times we live in. IOT all the way!

  38. Re:What OS do they run? by Mal-2 · · Score: 1

    However, he was still able to get down. I'd dare say he couldn't help himself. HNNNGGGGG!!!

    --
    How is the Riemann zeta function like Trump rallies? Both have an endless number of trivial zeros.
  39. Re: Should have included 3g for remote administrat by Anonymous Coward · · Score: 0

    I wouldn't be so sure about that. The device was found to have a vulnerability in the code and you want to increase the attack surface and range by including a 3G modem.

  40. SIMPSON'S DID IT! SIMPSON'S DID IT! by Anonymous Coward · · Score: 0

    In Metal Gear Solid 2, a man named Ames wears a pacemaker, and the sound it makes is how Raiden finds him among a room full of hostages in an oil decontamination facility. To further replicate the Shadow Moses incident under the S3 plan, The Patriots shut down his pacemaker via nanomachines, causing him to suffer a fatal heart-attack.

    Calling it, uppity individuals with these pacemakers will suffer fatal heart attacks, if it hasn't happened already.

  41. "should a threat actor choose" what? by Anonymous Coward · · Score: 0

    "should a threat actor choose to do so"... is the correct way to phrase the sentence. And what is a "threat actor" when it's at home?