Slashdot Mirror
750,000 Medtronic Defibrillators Vulnerable To Hacking (startribune.com)
The Homeland Security Department has issued an alert Thursday describing two types of computer-hacking vulnerabilities in 16 different models of Medtronic implantable defibrillators sold around the world, including some still on the market today. The vulnerability also affects bedside monitors that read data from the devices in patients' homes and in-office programming computers used by doctors. From the report: Medtronic recommends that patients only use bedside monitors obtained from a doctor or from Medtronic directly, and to keep it plugged in so it can receive software updates, and that they maintain "good physical control" over the monitor. Implantable defibrillators are complex, battery-run computers implanted in patients' upper chests to monitor the heart and send electric pulses or high-voltage shocks to prevent sudden cardiac death and treat abnormal heart beats. The vulnerabilities announced Thursday do not affect Medtronic pacemakers.
The more serious of the two is a vulnerability that could allow improper access to data sent between a defibrillator and an external device like an at-home monitor. The system doesn't use formal authentication or authorization protections, which means an attacker with short-range access to the device could inject or modify data and change device settings, the advisory says. A second vulnerability allows an attacker to read sensitive data streaming out of the device, which could include the patient's name and past health data stored on their device. The system does not use data encryption, the advisory says. (Deploying encryption in medical devices is tricky because is increases computational complexity and therefore uses the battery faster.) The FDA isn't expected to issue a recall as the vulnerabilities are expected to be patched via a future software update.
The more serious of the two is a vulnerability that could allow improper access to data sent between a defibrillator and an external device like an at-home monitor. The system doesn't use formal authentication or authorization protections, which means an attacker with short-range access to the device could inject or modify data and change device settings, the advisory says. A second vulnerability allows an attacker to read sensitive data streaming out of the device, which could include the patient's name and past health data stored on their device. The system does not use data encryption, the advisory says. (Deploying encryption in medical devices is tricky because is increases computational complexity and therefore uses the battery faster.) The FDA isn't expected to issue a recall as the vulnerabilities are expected to be patched via a future software update.
Only hitler?
No, sireeeee.
Let's put Bluetooth and WiFi in everything just because.
Implantable defibrillators at risk to be compromised by potential outside control?
If you're sitting at home hacking your ass off to shorten the life of defibrillator patients, man, you need to get out more.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
If I were a poet I would capture you
Logic today seems to dictate that all the input data is sent over to a server somewhere, and the control commands come back down from the server over the internet, with zero local control between the two. Isn't that how things should be done these days?
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
The FDA isn't expected to issue a recall as the vulnerabilities are expected to be patched via a future software update.
Could you imagine (another)heart surgery due to a recall for a software bug? This entire concept needs to be rethought IMO. The testing obviously does not meet requirements. Wonder if there's a "make grandpa grab his chest" easter egg /s.
"Deploying encryption in medical devices is tricky because is increases computational complexity and therefore uses the battery faster"
Locking your door is tricky because is[sic] increases the time to get into your house and makes you use up calories.
Having a PIN on your credit card is tricky because is[sic] increases the time to get your munney and stuff.
Coming up with stupid excuses why in 2019 you didn't deploy encryption by blaming battery life means your software is SHIT.
(Is[sic] increases the stupid factor).
E
Sounds like a great ransomware opportunity. Other malicious operators have shown zero remorse or mercy for impacting systems that manage patient care and could lead to deaths.
People need to go to prison for releasing insecure pieces of shit like this onto the market and for allowing them to be implanted in people.
I read about this shit all the time, and sadly I'm always astounded that NO ONE paid the slightest thought to hardening or securing these kinds of devices. It goes well beyond negligence. Fucking mind-boggling.
Just cruising through this digital world at 33 1/3 rpm...
Hackers! With Hacks! Hacking! Everywhere! And the Hackers are now even Hacking with their Hacks IN YOUR HEART!!!!1!
It's Official! You Should Panic! And also click our links a lot. Thanks. Remember! It's Okay To Panic About HACKERS!!!!!1!
Can we turn them into something useful like tac-welders?
Deploying encryption in medical devices is tricky because is increases computational complexity and therefore uses the battery faster
I claim bullshit. An AES implementation in hardware is secure and very cheap, especially at the modest communication speeds that these devices would need.
University of Washington had a presentation I saw almost a decade ago where security researchers showed how they can use the fact that the implantable defibrillator uses plain text serial communications (via RF) and how they can remotely do many things, including:
* read all of patients data, including their social security numbers
* change settings of the device, including disabling it completely
* kill a person (theoretical exploit) by disabling the defibrillator function and enabling a test mode which induced a heart attack to stop the heart (the mode is supposed to be used during implantation only, with chest open and doctor ready to standby to revive if the defibrillator didn't revive the patient)
All of the above done with a laptop and $50 worth of parts, up to 100 feet away. The presentation I saw did not disclose which manufacturer that was, but they did say that FDA did not have rules at that time that would prevent manufacturers from using un-encrupted, un-authenticated, not even simple password, connections to control all functions of the device.
I'm sorry but this doesn't sound like a run of the mill bug. This sounds like criminal negligence. Failure to make even a small amount of effort to take reasonable steps to secure a potentially lethal device is criminal.
SHOCKING!
I served on a security eval panel at a Hospital for network device approval. While not the only vendor that was apathetic about security Medtronic was absolutely the worst for not caring about security. They deserve to be sued.
Don't hack me, Bro!
Slashdot's name? When my compiler sees
There was an FDA medical recall a few months ago, which is a far bigger problem in practice. That too is expected to be fixed with a software 'update'.
My personal experience with Medronic has been terrible. I once had a Insulin pump from them that forced data uploads to occur over HTTP connections. I raised that as a likely HIPA violation with them, since they weren't securing the transfer of my medical records. Such bounced around their support for months before I gave up wasting my time trying to get it resolved.
You have to be physically touching the patient with a com cone to activate the communication (reed switch)
So you are worried about a hacker where, in the same room?
Such devices should not exist in the first place.
oh so bad!
Karen Sandler of the GNOME Foundation (and Software Freedom Law Center) called attention to this exact problem in 2010 after she had a Medtronic defibrillator installed.
http://www.softwarefreedom.org...
https://www.youtube.com/watch?...