A worldwide security team has identified different types of medical devices including pacemakers which have critical security flaws that could cost the lives of their users.
Researchers Identified Critical Security Vulnerabilities in Pacemakers and Other Medical Devices
A worldwide research team has identified 10 different types of medical devices such as pacemakers which feature critical security vulnerabilities.
The experts examined implantable pacemakers using black box testing conditions – testing conditions where the researchers have no prior knowledge about the devices or any special access to them. They were able to use standard off-the-shelf equipment to hack the communications protocols.
The team was able to compromise the devices from a distance of 5 meters. This proves that its very easy to cause life threatening attacks quite easily. Other devices that have been tested include insulin pumps and neurostimulators. The researchers were able not only to capture the wireless communications that are emitted by the devices but also to reverse engineer the protocols. This allowed them to impersonate genuine readers and perform various types of attacks. In the case of the pacemakers this means that attackers can cause life threatening shocks to patients which could lead to death.
The work is published in a research paper titled “the (in)security of the Latest Generation Implantable Cardiac Defibrillators and How to Secure Them” which is available here.
The Abstract reads the following:
Implantable Medical Devices (IMDs) typically use proprietary protocols with no or limited security to wirelessly communicate with a device programmer. These protocols enable doctors to carry out critical functions, such as changing the IMD’s therapy or collecting telemetry data, without having
to perform surgery on the patient. In this paper, we fully reverse-engineer the proprietary communication protocol between a device programmer and the latest generation of a widely used Implantable Cardioverter Defibrillator (ICD) which communicate over a long-range RF channel
(from two to five meters). For this we follow a black-box reverse-engineering approach and use inexpensive Commercial Off-The-Shelf (COTS) equipment. We demonstrate that reverse-engineering is feasible by a weak adversary who has limited resources and capabilities without physical access to the devices. Our analysis of the proprietary protocol results in the identification of several protocol and implementation weaknesses. Unlike previous studies, which found no security measures, this article discovers the first known attempt to obfuscate the data that is transmitted over the air. Furthermore, we conduct privacy and Denial-of-Service (DoS)
attacks and give evidence of other attacks that can compromise the patient’s safety. All these attacks can be performed without needing to be in close proximity to the patient. We validate that our findings apply to (at least) 10 types of ICDs that are currently on the market. Finally, we propose
several practical short- and long-term countermeasures to mitigate or prevent existing vulnerabilities.
