Medical device insecurity was covered at the recent Black Hat and Def Con security conferences in Las Vegas. One set of researchers showed off hacks to pacemakers and insulin pumps that could potentially prove lethal, while another researcher explained how hospital patients’ vital signs could be falsified in real time.
Pacemaker and insulin pump hacks at Black Hat USA
A decade has passed since we learned about pacemaker hacks, but still implantable medical devices that can save patients’ lives can be hacked to potentially kill them. Even now, as was highlighted at Black Hat USA, attackers can cause pacemakers to deliver a deadly shock to the heart or deny a life-saving shock, as well as prevent insulin pumps from delivering needed insulin.
After asking attendees with implanted medical devices to leave the room, researchers Billy Rios of WhiteScope and Jonathan Butts of QED Secure Solutions demonstrated how attackers could remotely install malicious firmware on a device used by doctors to control their patients’ pacemakers. That’s due to the lack of encryption in Medtronic’s firmware update process. The duo also discussed vulnerabilities in Medtronic’s network infrastructure for software deliveries.
[ Read also: The IoT security survival guide | Get the latest from CSO: Sign up for our newsletters ]
They showed how it was possible to compromise Medtronic’s CareLink 2090 programmer, a programming device that runs on Windows XP and is used by doctors to control patients’ implanted pacemakers. They demonstrated two hacks that ultimately changed the programming so it would harm patients with pacemakers. Butts explained, “You can obviously issue a shock, but you can also deny a shock.”
The firmware is not digitally signed, and updates sent to the programmers are not delivered via an encrypted HTTPS connection. Medtronic basically blew off the malicious reprogramming threat as being a “low risk” and impractical attack. Making sure there is no hack is something doctors can allegedly do. If it weren’t so sad, that response would be funny considering how many patients have been affected by data breaches or hospitals slammed with ransomware.