A range of implanted medical devices with nine newly discovered security vulnerabilities won’t be fixed by the manufacturer, despite the possibility that, if abused, the weaknesses could lead to injury or death. In new research presented at the Black Hat information security conference, a pair of security researchers remotely disabled an implantable insulin pump, preventing it from delivering the lifesaving medication, and then took total control of a pacemaker system, allowing them to deliver malware directly to the computers implanted in a patient’s body. Jonathan Butts of QED Secure Solutions and Billy Kim Rios of Whitescope.io demonstrated the hacks in a live session, warning anyone with an implanted medical device to leave the room before issuing the disabling command to the insulin pump.
To take control of the pacemaker, Rios and Butts went up the chain, hacking the system that a doctor would use to programme a patient’s pacemaker. Their hack rewrote the system to replace the background with an ominous skull, but a real hack could modify the system invisibly while ensuring that any pacemaker connected to it would be programmed with harmful instructions. “You can issue a shock,” Butts said, “but you can also deny a shock.” Because the devices are implanted for a reason, he added, withholding treatment can be as damaging as active attempts to harm. The pair criticised Medtronic, the manufacturer of the devices, for its response to the discoveries. “We first reported this to the manufacturer 570 days ago,” Butts said. “About 155 days ago we told them how someone could take it over,” Rios added. The pair shared specific proof-of-concept attacks with the company, highlighting the damage that could be done. “Months ago, we hit a turning point and said ‘enough’s enough,’” he said, prompting them to go public with their experience at the conference.
Butts and Rios also criticised Medtronic’s slow response and attempted to downplay the weaknesses. In its cybersecurity alerts, the company said the attacks weren’t possible remotely and failed to fully explain how wide-ranging the weaknesses were. A bulletin warning about the weakness that Rios and Butts used to reprogram the pacemaker, for instance, said only that an attacker “could influence” the data sent to its software update system. “When someone gets this advisory, and they’re reading this language, it’s almost impossible for them to understand what the risks are,” Rios said. Medtronic has said it will not fix the flaws discovered, instead recommending patients and doctors take extra care with the networks they connect the devices too. The company says the flaws pose a “low (acceptable)” risk to patient safety.
Suzanne Schwartz, an FDA director responsible for the agency’s cybersecurity partnerships, said that the case study illustrates a “gap in the ecosystem. Manufacturers find themselves in different places in their ability to respond,” Schwartz added. “Ultimately we want to make sure that these devices, that provide the extraordinary ability for patients to live good quality lives, are protected from attacks.” A spokesperson for Medtronic said the company had “independently assessed” the potential vulnerabilities highlighted by Whitescope and was “not aware of any additional vulnerabilities they have identified at this time. Medtronic places product safety above all considerations,” the company added. “All devices carry some associated risk, and, like the regulators, we continuously strive to balance the risks against the benefits our devices provide.”
Credit: Alex Hern for The Guardian, 9 August 2018.