Slashdot Mirror
Hack Causes Pacemakers To Deliver Life-Threatening Shocks (arstechnica.com)
An anonymous reader quotes a report from Ars Technica: Life-saving pacemakers manufactured by Medtronic don't rely on encryption to safeguard firmware updates, a failing that makes it possible for hackers to remotely install malicious wares that threaten patients' lives, security researchers said Thursday. At the Black Hat security conference in Las Vegas, researchers Billy Rios and Jonathan Butts said they first alerted medical device maker Medtronic to the hacking vulnerabilities in January 2017. So far, they said, the proof-of-concept attacks they developed still work. The duo on Thursday demonstrated one hack that compromised a CareLink 2090 programmer, a device doctors use to control pacemakers after they're implanted in patients. Because updates for the programmer aren't delivered over an encrypted HTTPS connection and firmware isn't digitally signed, the researchers were able to force it to run malicious firmware that would be hard for most doctors to detect. From there, the researchers said, the compromised machine could cause implanted pacemakers to make life-threatening changes in therapies, such as increasing the number of shocks delivered to patients. Rios and Butts were also able to use a $200 HackRF software-defined radio to hack a Medtronic-made insulin pump and make it withhold a scheduled dose of insulin. Medtronic has released a page that lists all the security advisories they have issued on the pacemakers and insulin pumps.
I work as an MD. The amount of ignorance in the healthcare sector about info sec is absurdly high. Something needs to change before people start getting hurt.
Stupid millenial child BeauHD.
Because updates for the programmer aren't delivered over an encrypted HTTPS connection and firmware isn't digitally signed, the researchers were able to force it to run malicious firmware that would be hard for most doctors to detect.
I just LOVE the implications of this naive statement.
1. HTTPS is actually secure
2. HTTPS is the protocol that they should be using
3. There aren't millions of better protocols than HTTPS for this application
4. Doctors actually try or would be the ones to try to detect malware
And the hackers go to jail now, right?
It's not a gizmo no one cares about, all the products in the 80/90s had plenty of testing before shipping with just one firmware that wasn't updateable. These updates make manufacturers lazy and sometimes they push out something worse than the one that preceded it.
No updates, much less need for security. I don't want stuff in me to use the internet in any fashion.
Sure, so true, because after all the manufacturers will take this article (and the fine /. writeup), post it on the bulletin board, and the product teams will study this and make the minimum changes to address those, and only those, deficiencies.
Sadly, people think less of manufacturers every day. I would expect that they will also consider signing their data, oh, damn, you missed that.
Feh.
deleting the extra space after periods so i can stay relevant, yeah.
Can I do that? Is there a http access to my pacemaker to do that? How?
the film Dead in a Heartbeat
In addition to using signed binaries, run a pair of wires to just beneath my skin.
If it ever needs reprogramming, make a small incision and wire me up for the upgrade.
Save the wireless things for less-consequencial things like reading the device's status. Even then, figure our some way to prevent an adversary from reading it unless he is rught up next to me for an extended period of time.
....does not go to the BlackHat Conference, they should be fine!
Sadly, people think less of manufacturers every day
As well they should. I know that my own company is pretty much incompetent, and it's a miracle we have any customers at all.
Of course, we have tens of thousands of customers and are reasonably successful.
And there you see is the problem.
The vendors already default to lowest-cost solutions which is why HTTP is what is currently used; HTTPS isn't ideal but it would be a significant improvement (except of course the certs will get left out on a web server to be stolen, because security?).
Beyond security, there are issues about proper testing (did you know that pace makers are only tested on 50+ males; what happens when you put one in a 20yo pregnant woman?) and (the lack of proper) government oversight.
See Karen Sandler (https://twitter.com/o0karen0o; https://punkrocklaywer.com/ of the Software Freedom Conservancy and the battles she's had with pace maker manufacturers trying to get access to information on the device implanted in herself. And she can tell the first hand story about being a 20+yo pregnant woman being shocked by her pace maker while exercising...
Why in the bloody fuck does a pacemaker 1) connect to a network or 2) need firmware updates?
Holy shit!
People with pacemakers die of problems every day, you're oblivious lol. "Faulty pacemakers 'killing 2,000 a year': Third of unexpected deaths among patients thought to be caused by malfunctions" :
Scientists say there is evidence implants could be 'cause of mortality'
Research found 30 per cent of cases of sudden death were caused by mechanical flaws in the battery-powered devices
PUBLISHED: 19:29 EDT, 9 August 2015 | UPDATED: 13:08 EDT, 30 October 2015
A third of unexpected deaths among heart patients with pacemakers and similar devices could be caused by malfunctions, research suggests.
Scientists say there is evidence the implants could be a 'leading cause of mortality' and warn the findings are a 'major concern'.
So no, there is room for improvement you dumbass. No device is perfectly designed in one go, anyone claiming that updates are never required is a FUCKING MORON, PERIOD. Get tested for the incompetence bug.
The issue was their plaintext implementation and insecure IP protocols, not the fact that it needs to be updated from time to time like all complex digital devices in the world, you fucking moron.
Sure, you can hack a pacemaker and kill its wearer. You can also shoot him with a gun, poison him, bomb him, whatever. It is made even easier by the fact that people who wear pacemakers aren't usually at the peak of their shape.
But like they say in obligatory xkcd, most people aren't murderers.
I'm Sparticus!
I work as an MD. The amount of ignorance in the healthcare sector about info sec is absurdly high. Something needs to change before people start getting hurt.
The medical profession generally has arrogance and ignorance together while making life or death decisions. I'm not surprised they have issues with info sec too.
This is not uncommon. Non-tech business people severely underestimate the costs of IT. Most of them have no business collecting credit cards because they are total dipshits.
As the main cheerleader for US waterboarding, I've wondered how a motivated individual might subject him (Cheney) to a similarly terrifying and helplessness inducing experience.
Tweaking his pacemaker up & down through it's full range of speeds...with occasional stops & restarts might just do the trick! Just imagine how exciting it would be to discover your heart racing at 180 BPM for no apparent reason...then dropping off to an almost unconsious 20 BPM...now back up to 180 for a bit... Perhaps almost as terrifying as the repeated sensation of drowning.
Variations on this same story, with almost exactly the same comments, have been appearing for maybe 3 years afaik.
So do I. The level of dumbassery is astounding. I can walk into any hospital with a HUGS infant tracking system and shut it down. I called the company about the vulnerability in 2008. Itâ(TM)s still there.
Homebrew Pancreas Gets 30 Minutes of Fame
I feel Life Hacks is oddly appropriate too.
They'll get it fixed in about 15 years after FDA approves their new design.
pony up 50 000$ or get shocked every 2 minutes!
What's wrong with using tls with client certs for this?
Say you are the US and want to kill Putin/Castro/insert boogey man of your choice. There is a risk of nuclear war if detected. Do you : 1) do make a plain sniper murder or do you 2) hack the re-programmer for the pace maker so that if it detects a specific patient it change the therapy to be deadly ,e.g. fail to deliver shock or do it at an irregular rate, but report to forensic the correct rate ? Same thing for any group XYZ wanting to murder somebody ABC but wanting to avoid the consequence IJK associated with plain murder.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
The VP was right with his concerns when he got one. Damn.
No hackers required for a pacemaker to malfunction. My father had one of those and it was of great benefit at first. But then, at some routine examination, the doctors decided to enroll him in a study /without telling him/. What exactly they did I don't know but it amounted to programming the pacemaker to only do its job when the heart on its own beats at a very low frequency (40 bpm). What they wanted to study was the psychological influence of bearing a pacemaker on the heart's pace, i.e. whether the psyche can control a failing heart.
Only after my father's health deteriorated progressively without any obvious reason (he had a very hard time breathing, i.e. getting enough oxygen) did they undo these changes. His heart was damaged by this procedure though and he never recovered from it and eventually he died from the consequeces. My mother put the doctors and the hospital on trial and she could actually prove what they had done with the medical records while they could not produce any proof of his consent being included in the study.
This was 65 years after WWII in Austria, btw.
So yeah, pacemakers can be reprogrammed from the outside, whether by malicious hackers or malicious doctors makes no difference.