TechDirt reports:
A team of hackers working for cybersecurity startup MedSec found a bevy of flaws in medical devices sold by St. Jude Medical Inc, ranging from a lack of overall encryption to vulnerabilities letting unauthorized devices communicate with the company's pacemakers and defibrillators. And while we've talked about the threat of hackable pacemakers for more than a decade, hackers are increasingly worming their way into poorly secured radiology equipment, blood gas analyzers and other hospital and nursing home equipment to steal data for identity theft, giving the threat an added dimension.
[...] Historically, many hackers and security firms either contact companies to alert them to vulnerabilities, or try to sell the not-yet-public vulnerabilities to corporate espionage and security firms or government agencies, who then happily exploit any impacted, unpatched systems (in this case, with potentially fatal results). But MedSec did something notably different. It reached out to the Muddy Waters Capital LLC investment firm, suggesting a partnership to short sell St. Jude stock before reporting the vulnerabilities to the FDA. Under the deal, MedSec makes more money the further shares fall.
Updated: El Reg reports:
"We're not saying the [MedSec] report [on St Jude Medical's implanted pacemakers and defibrillators] is false. We're saying it's inconclusive because the evidence does not support their conclusions. We were able to generate the reported conditions without there being a security issue", said Kevin Fu, [University of Michigan] associate professor of computer science and engineering and director of the Archimedes Center for Medical Device Security.
[...] MedSec's report [...] reads:
In many cases, the Crash Attack made the Cardiac Device completely unresponsive to interrogations from Merlin@home devices and Merlin programmers. It was therefore impossible to tell whether, and how the Cardiac Devices, are functioning. MedSec strongly suspects they were in many cases "bricked"--i.e., made to be non-functional. It is likely physicians would explant a device that did not respond to the programmer.
In some cases, a Cardiac Device subjected to a Crash Attack was still able to communicate with the programmer, and the information displayed was alarming.
According to U-M's team, though, the implanted pacemaker or defibrillators can and will continue operating as normal even if readings to the monitoring station are disrupted.
In other words, there's no conclusive evidence that the pacemaker or defibrillator actually stopped working after the radio communications were jammed. It's more of an annoyance for whoever is using the monitoring terminal than a potentially lethal situation.
[...] In El Reg's view, if the communications are temporarily disrupted it's hard to see how this is a super serious issue. On the other hand, if the radio jamming stops all further communication from the implant to a monitoring terminal, that's going to potentially require surgery to fix, which is not optimal. However, bear in mind, there is no hard evidence that a device is "bricked"--merely MedSec's strong hunch that this has happened.
Related Stories
TechDirt reports:
[The week of January 12,] the FDA was forced to issue a warning, noting that security vulnerabilities in the St. Jude Medical implantable cardiac device and corresponding Merlin@home Transmitter could be a serious problem. It's notable as it's the first time we've seen the government publicly acknowledge this specific type of threat.
The St. Jude Medical Merlin@home Transmitter uses a home monitor to transmit and receive RF signals wirelessly to the pacemaker. But the FDA found that this transmitter was vulnerable to attack, with the press release politely tap dancing around the fact that said vulnerability could be used to kill:
"The FDA has reviewed information concerning potential cybersecurity vulnerabilities associated with St. Jude Medical's Merlin@home Transmitter and has confirmed that these vulnerabilities, if exploited, could allow an unauthorized user, i.e., someone other than the patient's physician, to remotely access a patient's RF-enabled implanted cardiac device by altering the Merlin@home Transmitter. The altered Merlin@home Transmitter could then be used to modify programming commands to the implanted device, which could result in rapid battery depletion and/or administration of inappropriate pacing or shocks."
According to the FDA, they have no evidence of anybody dying because of the vulnerability yet. They're also quick to note that St. Jude Medical issued a patch on January 9 that fixes this vulnerability.
Apparently, the "Move on; nothing to see here" claims were wrong.
University of Michigan Says Flaws That MedSec Reported Aren't That Serious
...and the "Let's look closely at these" lot were right way back when.
US Security Agencies Look at Medical Device Security
The Security Ledger reports:
Software used to remotely program implantable cardiac devices by a number of vendors is rife with exploitable software vulnerabilities that leave the devices vulnerable to attacks and compromise, according to a report by the firm Whitescope Inc.
The analysis of hardware and software associated with implantable cardiac devices spanned four separate vendors and product families but found a wide range of security weaknesses, among them the use of permanent (or "hardcoded") authentication credentials like user names and passwords and the use of insecure communications, with one vendor transmitting patient data "in the clear." All four product families were found to be highly susceptible to "reverse engineering" by a knowledgeable adversary, exposing design flaws that might then be exploited in remote or local attacks, researchers Billy Rios of Whitescope and Dr. Jonathan Butts wrote in their report.
The two researchers investigated a range of hardware and software tools that together make up the ecosystem of implantable cardiac devices. In addition to the implantable devices, Rios and Butts obtained and analyzed "physician programmers" that are used to configure and update implanted devices wirelessly, home monitoring system hardware and software and the patient support network.
[...] A subsequent report by the U.S. Food and Drug Administration (FDA), released in April, found that St. Jude Medical knew about serious security flaws in its implantable medical devices as early as 2014, but failed to address them with software updates or other mitigations, or by replacing those devices.
The latest report, while omitting the names of specific products or vendors, finds similar evidence of lax security throughout implantable device ecosystems.
[...] "Across the 4 programmers built by 4 different vendors, we discovered over 8,000 vulnerabilities associated with outdated libraries and software in pacemaker programmers," the researchers report.
[...] Use of third-party hardware and software is rife in these medical devices. Across the four vendors, there was an average of 86 third-party components used in the implantable devices and 43 vulnerable third-party components. Per-device, the average number of known vulnerabilities in those third-party components was 2,166.
In its article on the topic, The BBC reports:
Submitted via IRC for SoyCow3941
About 350,000 implantable defilibrators are up for a firmware update, to address potentially life-threatening vulnerabilities.
Abbott (formerly St. Jude Medical) has released another upgrade to the firmware installed on certain implantable cardioverter defibrillator (ICD) or cardiac resynchronization therapy defibrillator (CRT-D) devices. The update will strengthen the devices' protection against unauthorized access, as the provider said in a statement on its website: "It is intended to prevent anyone other than your doctor from changing your device settings."
The patch is part a planned series of updates that began with pacemakers, programmers and remote monitoring systems in 2017, following 2016 claims by researchers that the then-St. Jude's cardiac implant ecosystem was rife with cybersecurity flaws that could result in "catastrophic results."
Source: https://threatpost.com/abbott-addresses-life-threatening-flaw-in-a-half-million-pacemakers/131709/
Related: A Doctor Trying to Save Medical Devices from Hackers
Security Researcher Hacks Her Own Pacemaker
Updated: University of Michigan Says Flaws That MedSec Reported Aren't That Serious
Fatal Flaws in Ten Pacemakers Make for Denial of Life Attacks
After Lawsuits and Denial, Pacemaker Vendor Finally Admits its Product is Hackable
8,000 Vulnerabilities Found in Software to Manage Cardiac Devices
465,000 US Patients Told That Their Pacemaker Needs a Firmware Upgrade
Submitted via IRC for SoyCow1984
Life-saving pacemakers manufactured by Medtronic don't rely on encryption to safeguard firmware updates, a failing that makes it possible for hackers to remotely install malicious wares that threaten patients' lives, security researchers said Thursday.
At the Black Hat security conference in Las Vegas, researchers Billy Rios and Jonathan Butts said they first alerted medical device maker Medtronic to the hacking vulnerabilities in January 2017. So far, they said, the proof-of-concept attacks they developed still work. The duo on Thursday demonstrated one hack that compromised a CareLink 2090 programmer, a device doctors use to control pacemakers after they're implanted in patients.
Because updates for the programmer aren't delivered over an encrypted HTTPS connection and firmware isn't digitally signed, the researchers were able to force it to run malicious firmware that would be hard for most doctors to detect. From there, the researchers said, the compromised machine could cause implanted pacemakers to make life-threatening changes in therapies, such as increasing the number of shocks delivered to patients.
Related: A Doctor Trying to Save Medical Devices from Hackers
Security Researcher Hacks Her Own Pacemaker
Updated: University of Michigan Says Flaws That MedSec Reported Aren't That Serious
Fatal Flaws in Ten Pacemakers Make for Denial of Life Attacks
After Lawsuits and Denial, Pacemaker Vendor Finally Admits its Product is Hackable
8,000 Vulnerabilities Found in Software to Manage Cardiac Devices
465,000 US Patients Told That Their Pacemaker Needs a Firmware Upgrade
Abbott Addresses Life-Threatening Flaw in a Half-Million Pacemakers
(Score: 0) by Anonymous Coward on Monday September 05 2016, @05:02PM
"Fortunately, the computer virus did no harm to our records. It was immediately devoured by the bugs in our programs."
(Score: 2) by davester666 on Monday September 05 2016, @06:01PM
Yeah, this is stupid.
Why would they not take one of these pacemakers/defibrillators that are not installed in a person, rig up a system to make the sensors of it to think it's in a person, jam it and then check to see if it still is functioning?
(Score: 1) by bro1 on Wednesday September 07 2016, @11:35AM
http://risky.biz/RB425 [risky.biz]
I would recommend to listen to this podcast where one of MedSec researchers is interviewed. I don't really think security holesin med devices are so harmless.
(Score: 3, Informative) by tisI on Monday September 05 2016, @05:19PM
I've had a St.Jude pacemaker/ICD in since July 2010. Still have 2 years life left on a 5 year battery. Very nice device. Good company.
This report is complete and total shit, and invented for financial scam purposes only .. by trolls.
I don't fear someone fucking with my device in any way. There is NO need for these scam cocksuckers to attack this company like this, just to manipulate the "market".
These pieces of shit (Muddy Waters Capital LLC and MedSec Ltd), are the real terrorists and are the ones we should be hunting down like dogs.
The only danger with any of these devices is if you place a powerful magnet on top of it, and as with any harddrive, you will scramble/erase data.
Communication with the device is done with St. Jude equipment. The average retard hacker on the street cannot just "hack" you.
So, by their scenario, if a Muddy Waters or MedSec henchman wants to come into my bedroom, stand next to my bed, and fuck with my Merlin device scanner, I will pull my .357 from my nightstand drawer and blow their heads off.
This is the extent of the danger, except for turning the light on and exposing the real lowlife parasites like Muddy Waters Capital LLC and MedSec Ltd.
"Suppose you were an idiot...and suppose you were a member of Congress...but I repeat myself."
(Score: 2) by frojack on Monday September 05 2016, @05:29PM
Don't hold back, tisl, tell us how you really feel.
The whole thing sounded like nonsense when I first read the the reports.
No, you are mistaken. I've always had this sig.
(Score: 1) by tisI on Monday September 05 2016, @06:40PM
Yes, nonsense & bullshit
The full propose of their intent though is not benign.
Their intent is malice and slander. Nothing else.
Worse, they are given credit for releasing a sensational discovery that is a complete lie. And profiting off of it.
If you had a shred of morality, you'd be offended too.
"Suppose you were an idiot...and suppose you were a member of Congress...but I repeat myself."
(Score: 2) by dyingtolive on Tuesday September 06 2016, @12:46AM
I don't have a strong opinion on the tech, but shorting the stock of the company you're about to trash is some high quality next level fuckstick behavior.
Here's hoping that karma sees someone gets their nuts put on a pike as a warning to others over this.
Don't blame me, I voted for moose wang!
(Score: 0) by Anonymous Coward on Tuesday September 06 2016, @01:07PM
yeah... how is this not insider trading?
(Score: 2, Informative) by Anonymous Coward on Monday September 05 2016, @05:37PM
The precursor story wasn't included and hasn't made the front page yet.
Security Startup MedSec Shorts St. Jude Medical Stock To Punish It For Flimsy Pacemaker Security [soylentnews.org]
-- OriginalOwner_ [soylentnews.org]
(Score: 2) by takyon on Monday September 05 2016, @08:06PM
Fixed up, will consider a top up in a couple of hours.
[SIG] 10/28/2017: Soylent Upgrade v14 [soylentnews.org]
(Score: 3, Funny) by Snotnose on Tuesday September 06 2016, @02:45AM
> Um, looks like your heart rate has dropped to 0, shall I initiate a shock?
404, page not found
> Um, your heart rate looks pretty bad, wat du?
404, page not found
> I've looked it up, a 0 heart rate is Not A Good Thing(tm), I really need permission before I shock you with potentially life threatening electricity.
page not found.
When the dust settled America realized it was saved by a porn star.
(Score: 0) by Anonymous Coward on Thursday September 08 2016, @03:17AM
St Jude sues short-selling MedSec over pacemaker "hack" report [theregister.co.uk]
-- OriginalOwner_ [soylentnews.org]