Medtronic Locks Down Vulnerable Pacemaker Programming Kit Due To Cybersecurity Concerns (theregister.co.uk)

AmiMoJo shares a report from The Register: The U.S. Food and Drug Administration (FDA) is advising health professionals to keep an eye on some of the equipment they use to monitor pacemakers and other heart implants. The watchdog's alert this week comes after Irish medical device maker Medtronic said it will lock some of its equipment out of its software update service, meaning the hardware can't download and install new code from its servers. That may seem counterintuitive, however, it turns out security vulnerabilities in its technology that it had previously thought could only be exploited locally could actually be exploited via its software update network. Malicious updates could be pushed to Medtronic devices by hackers intercepting and tampering with the equipment's internet connections -- the machines would not verify they were actually downloading legit Medtronic firmware -- and so the biz has cut them off.

Comments

And IoT will be much more secure... right

[Mathinker]

We're talking a device which when it malfunctions, kills (or could kill) someone. And still the manufacturer didn't get the basics of security correct: using signed software updates.

How can we believe that IoT devices, which are manufactured with much less profit overhead, will be more secure? (Unless somehow regulated -- which also didn't for for those FDA-approved pacemakers).

Re:And IoT will be much more secure... right

[JaredOfEuropa]

Does the FDA approval process include an audit of IT security measures and practices?

Re:And IoT will be much more secure... right

[gnasher719]

To put this into perspective: Anyone having _any_ pacemaker is vulnerable to non-electronic attacks involving loaded guns, and there are many more people capable of doing such an attack than the electronic attack.

Re: And IoT will be much more secure... right

[BanHammer]

I don't think anyone wants you to believe that IoT devices will be much more secure. They just claim to add some small convenience to your life and the masses are buying them like hotcakes with little concern for security or privacy.

Re:And IoT will be much more secure... right

[jellomizer]

The problem is no one wants to add 6 additional months to a product to make it much more secure.
Then there is getting people who are willing to think about security problems when making such products.

A good security design is much more then a normal checklist of items. It is designing your product in a way that you will assume that any level of your application could be broken into. So you need to make sure that each level once in will need to limit what damage it could do.

How does it improve security?

[enriquevagu]

The original company stops making updates available.
Before that, a hacker could impersonate the update server (probably using a MITM attack) so the device received a hacked firmware, not the legit one. But if no hacking occurs, the device receives a legit update.
After the change, if a hacker impersonates the (unavailable) update server, the device can only find the hacked firmware, never the legit one.
How is this exactly improving security?

Re:How does it improve security?

[gnasher719]

How is this exactly improving security?

Depends on how they are doing it. If you try to update an iPhone, the iPhone will ask Apple if the update is legit. Maybe they did something similar, but hackers found ways to create updates that will be identified as "legitimate". All they need to change is the "legitimate" checker to always return "NO".

Re:How does it improve security?

[AmiMoJo]

From what I can get from their web site the diagnostic system is basically a PC that downloads a firmware image, and then uploads it to the pacemaker. The pacemaker itself never connects directly to the internet.

The update disables the online update mechanism on the diagnostic equipment entirely. Presumably they could still send out a USB flash drive with new firmware if required. But the diagnostic PC won't even look for new firmware any more.

Re:How does it improve security?

[jellomizer]

Perhaps. But these things are being implanted on Baby Boomers, That generation made suing people for any sort of damages (Real or imaginary) cool and the trendy thing to do.
Granted it is probably a bit better then the old way, where they would just shoot each other.

Security not even an agenda item

[ArhcAngel]

I worked for a competitor to Medtronics that manufactured pacemakers in the 90s. The "state of the art" communication with the IC was an antenna that used PWM to talk. As long as you knew the handshake you could program it however you wanted. But if you wanted to be malicious you didn't even need to go to that much trouble. Many remember the signs posted in convenient stores that had microwave ovens because the stray noise from them could literally wipe out the programming on a pacemaker.

How is this not a solved problem

[cciechad]

Sign the code with a private key and compare a hash. Secure devices have been doing this for some time.