Slashdot Log In
Hacking a Pacemaker
Posted by
CmdrTaco
on Wed Mar 12, 2008 08:29 AM
from the probably-not-the-best-idea dept.
from the probably-not-the-best-idea dept.
jonkman sean writes "University researchers conducted research into how they can gain wireless access to pacemakers, hacking them. They will be presenting their findings at the "Attacks" session of the 2008 IEEE Symposium on Security and Privacy. Their previous work (PDF) noted that over 250,000 implantable cardiac defibrillators are installed in patients each year. This subject was first raised along with similar issues as a credible security risk in Gadi Evron's CCC Camp 2007 lecture "hacking the bionic man"."
Related Stories
Submission: Hacking a pacemaker by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Bionic eye (Score:5, Interesting)
Oh yeah, the oblig: We are cyborg. You will be assimilated. resistance is not only futile but you won't resist, you'll beg to join us..
Re:Bionic eye (Score:4, Interesting)
Pacemakers are [i]implanted[/i] under the skin. The only way to interface with them is through induction or radio signals. The signals have ranges measured in centimeters.
Parent
Re:Bionic eye (Score:5, Funny)
Parent
Re: (Score:3, Interesting)
Re:Bionic eye (Score:5, Insightful)
Um, yes you do. Do you want them to have to cut you open because you don't like the maximum pacing rate and want to have it reduced by 5 bpm ?
Parent
Re: (Score:3, Funny)
Re: (Score:3, Interesting)
Finding out which settings you like or don't like unfortunately involves putting a pacemaker into you first. Of course, you could go with a completely dumb device, but your heart would be paced too fast when you're asleep and too slow when you're physically active.
Re:Bionic eye (Score:4, Interesting)
Parent
Re:Bionic eye (Score:4, Interesting)
Public-Private Key cryptography. The manufacturer has a public key, and it's embedded into the device. The manufacturer's private key is kept secret in the same way as the PKI people do it; there are multiple parties required to do anything to the key, there is armed security 24/7, and the key is treated as if people's lives depend on it because that's the situation. There's a process to go through for a hospital to get certified to update the device. When the hospital certifies a doctor to update the device, the doctor's public key is signed by the manufacturer's private key. The doctor keeps his private key on a smart card that requires a PIN with the full knowledge that people could die if he loses it. Preferably the smart cards are kept under lock and key at the hospital next to the lethal drugs and the morphine. When an update command is done, a specially formatted message is signed by the doctor's private key, and the message is send along with the doctor's certificate (the doctor's public key signed by the manufacturer's private key). If there's no valid certificate or the message format is not correct, no command interpretation takes place. If everything checks out, the command is logged in onboard flash memory and the device updates. If someone's pacemaker is updated in a manner that kills them, there is an audit trail pointing to exactly who's at fault. I don't care how much more expensive it is, particularly when the answer is 'not very.'
People's lives are at stake here, the manufacturers should be held liable and negligible if they aren't using already existing methods that essentially guarantee security.
Parent
Re: (Score:3, Insightful)
Sure. Will you ship your secure, encrypted pacemaker with an external power supply to plug it in ?
Sheesh. These things don't come with a multi-core desktop CPU. They're ultra low-power systems, optimized for battery life because changing the battery requires surgery, which already puts your life at stake (Sorry - cutting your chest open isn't trivial. And the chance of something bad happening during or after surgery (infection, complications with the anesthesia, etc), as
Re:Bionic eye (Score:4, Informative)
I'm an EE with a lot of embedded experience in RF devices. I've had to make recalls because the standby current* was 50uA instead of 12uA. (For a GPS tracking board with VHF transmitter.)
The level of misunderstanding that's required to think that you can surreptitiously reprogram somebody's pacemaker without their knowledge is astounding. If you've got a pacemaker and someone tries to walk up to you and reprogram your chest, just walk away, man. Walk away. It's not like it's going to take 2 seconds to line everything up correctly. Even if all the technical details are magically sorted, a different brand could make your hack useless. So could temperature, humidity, clothing, chest hair, and any of the other RF voodoo things that you have to deal with.
*(Technically "quiescent" but I'm not sure everyone knows what that means.)
Parent
Re: (Score:3, Informative)
Sure, a few chips have built-in single-line multipliers, but I don't think that's what they use in pacemakers.The pacemaker
Re:Bionic eye (Score:4, Insightful)
The thing is that this private key needs to be sent to every hospital and doctor's office which wants to make adjustments to the pacemaker. They'll have it, whether it's embedded in a chip or written in a config file. You have to make this information public in some sense, the very best you could hope to do is use some kind of DRM to protect the key from exposure, but as we all know, such exercises are fated to failure.
And what happens when a pacemaker manufacturer discontinues a line and stops manufacturing the equipment to tune certain kinds of pacemakers (such as would be expected to happen should a key be discovered), do these patients just have to hope that the equipment used for tuning their pacemaker outlives them?
Also, will doctors and hospitals have to buy dozens of different pacemaker adjustment machines, one of every type, even those they don't install themselves so that they can treat patients who move into the area? What happens when the patient needs emergency adjustment of his pacemaker but doesn't remember the model he has (or isn't conscious)?
Finally, these devices don't exactly have little general purpose CPU's in them. One of their biggest concerns is decent battery life. If we put something in there as computationally intensive as strong private/public key cryptography, you're going to significantly hurt the battery life of these devices.
This problem is not as simple as it seems on the surface. It turns out that human life is fragile, and there are many ways in which you can kill someone, some of them even require little effort to kill many people. Hacking this device in a way that endangers other humans would not even need new laws to be punishable since we fortunately already have laws which surround murder, reckless endangerment, and other such things which actually or reasonably could result in the death or injury of other humans.
Parent
Re:Bionic eye (Score:4, Insightful)
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Yes, its all nice and simple to the software guy that doesn't know what he is talking about.
Yes what you are asking is possible but it's prohibitively expensive, pointless, and adds ZERO benefit to the patient. In fact because of the extra power draw of this pointless device the patient will have to undergo extra surgeries to replace the battery more ofter thereby further jeopardizing the patient safety.
Re:Bionic eye (Score:5, Informative)
Parent
pacemakers (Score:5, Funny)
Don't fear.... much (Score:5, Insightful)
One:
Similarly the argument that it took $30,000 worth of equipment and a 'team of experts' is retarded because the same might probably have been said about DVD encryption till an adolescent did it in his bedroom with his home computer and enough caffeine.
If I had an AICD, I sure as hell wouldn't want to be around Cheney, lest the signal from mine be confused with his. Of course maybe that is why he has a man sized safe in his office is a Faraday cage.
Re: (Score:3, Interesting)
Not only that, but let's say the President of the United States has a pacemaker... $30000 is pittance for someone who wants him dead.
Re: (Score:3, Interesting)
Re:Don't fear.... much (Score:5, Informative)
In the worst case scenarios, either 1) put a donut magnet over it and it can be stopped or 2) give me a scalpel and 30 seconds and I can cut the leads, and then we can externally pace and/or defibrillate the person.
So I am not sure that the risk of being password protected would outweigh the risk of not being password protected. I'd want mine password protected, then put the password on a medic-alert bracelet that I wear.
Parent
But why? (Score:2, Insightful)
Re: (Score:3, Insightful)
Life imitates art (Score:2)
% The Simpsons happen upon Krusty, who is having a Y2K crisis of his
% own. His pacemaker is stuck in the "hummingbird" mode. Krusty
% lifts himself in the air briefly by flapping his arms, before
% collapsing on the ground.
See also:
http://en.wikipedia.org/wiki/Treehouse_of_Horror_X#Life.27s_a_Glitch.2C_Then_You_Die [wikipedia.org]
-theGreater.
Easy fix (Score:2)
Just shut it off (Score:2, Insightful)
Wait for it (Score:5, Funny)
So they can crack RSA and then get the pacemaker? (Score:3, Interesting)
Re:So they can crack RSA and then get the pacemake (Score:5, Interesting)
Parent
A better method (Score:5, Interesting)
Insider (Score:3, Insightful)
Yee-ha! (Score:5, Funny)
I'm gonna overclock this sucker!
Better than a triple espresso!
Some health care insurance / hospitals may want to (Score:3, Informative)
Some of them have said that a kidney transplant is to experimental and they let a someone die just to get out of paying for it.
When my pacemaker is tested (Score:4, Interesting)
It is a truly heartfelt experience.
Bookwormhole.net [bookwormhole.net] -- a site for book lovers.
Insulin pumps too! (Score:3, Insightful)
Several months ago she upgraded to a new pump. This new model (a Medtronic MiniMed) wirelessly communicates with a number of devices. It receives blood glucose data from a continuous glucose monitor. It also receives her regular readings from her standard "prick your finger" blood sugar tests via her test kit. And, it has a wireless key fob that allows her to adjust the pumps settings without having to dig through pockets and clothes to get at the unit.
My first comment to her was "With all of this wireless control, how easy is it for someone to use this wireless interface to put you into a diabetic coma, or worse, kill you?" She thinks it's a fairly ridiculous concept, citing encryption, receiver range, and "Why would anyone want to kill me?", among other reasons.
Well, I say that anything that has any type of wireless interface is hackable. There are, of course, no published documents that I can find detailing what steps have been taken to secure these devices. I'm seriously concerned as to whether or not the companies that make insulin pumps, pace makers, implants, etc, may not be taking these concerns seriously.
Re:Hmmm (Score:5, Funny)
Yes, but the purpose of this device is unclear. What exactly is it pacing ?
Parent
Re: (Score:3, Funny)
However, the notion that the heart is somehow related to empathy and love is also false. Instead, he had that section of his brain surgically removed. It helps him collect himself faster after his 3pm puppy kicking and orphanage closing.
Re: (Score:3, Funny)
Yup, he has the heart of a 20 year old.
It's in a jar on his desk.
Re:remote kill? (Score:5, Interesting)
The technology for that already exists; it's called a "gun". It replaced an older technology called an "arrow", which in turn was the replacement for an even older technology called the "javelin". There was also an older technology called a "sling" which was a peripheral device designed to increase the effectiveness of the original technology call the "rock".
People have been remotely killing other people for millions of years.
Parent
Re:remote kill? (Score:5, Insightful)
Parent
Hacking the VP (Score:5, Funny)
Parent
That kind of attitude is the problem (Score:3, Insightful)
Well, no, there are w
Re:That kind of attitude is the problem (Score:5, Insightful)
Because sticking a JTAG connector through someones chest is fairly painful. You're welcome to experiment on yourself to confirm this.
Also, it's not a WiFi interface. It's a short-range (it goes through your chest, and water absorbs radio waves like crazy), custom, wireless interface. You have no freaking need for those to be networked, in any form or shape.
And you're, what ? An M.D. ? A biomedical engineer ?
Tell you what: Have fun with your dumb fixed-rate 75 bpm pacemaker, but don't expect to be running up any stairs anytime soon.
Any interface to it or from it can be contact-based just as well.
It basically is, genius. Or do you want it so contact-based that they have to shoot a couple of amps through your chest in order to make the pacemaker respond ? Hint: Think of a vital organ that's very, very close to the pacemaker and reacts very badly to having current shot through it.
More importantly, we already do _both_ of those for life-and-death systems like flight control systems on airplanes or brake computers on cars. They're both built and reviewed to be as good as bulletproof, _and_ not wired to talk to the outside world, unless one physically plugs in a special connector and a special computer into it.
They're also conveniently located outside the human body, so plugging a special connector into them doesn't involve going through someones tissue first.
Parent
Re:Ah, the smart-arse non-sequiturs (Score:5, Informative)
Parent
Re: (Score:3, Insightful)
With the encryption that you say your company uses, wouldn't it simply be a matter of acquiring a single sending device, and reverse engineering it?
No. The individual communication session is protected by a unique key. Still, if you physically had a programmer (the sending device you mentioned), you could use it without any hack
Re: (Score:3, Informative)
Well it's not a pacemaker, it's a combination pacemaker/defibrilator. The second part is the reason why it can "deliver potentially fatal jolts" - that's just the range a defibrilator operates in. A connection via the internet allows a doctor to be notified of problems while the patient is at home, and the doctor could even take corrective actions right away. That's presumably why one of the doctors involved in this investigation said "If I needed a defi
Re:Easy solution (Score:5, Funny)
Parent
Re: (Score:3, Informative)
Re: (Score:3, Funny)
1. Bad guys want to kill Cheney. That seems quite plausible.
2. Secret Service anticipates this. NSA and the Office of the Sergeant at Arms of the U.S. Senate are tasked to establish and test a set of security controls.
3. Pursuant to applicable FISMA, OMB, NIST and DoD regulations, it is determined that Cheney's pacemaker must undergo Certification and Accreditation under DIACAP (Doing Information Assurance on Cheney's Automatic Pacemaker) throughout the VP's Life Cycl