Researcher Turns Pacemakers Into Mass Murder Machines

Recommended Videos

lacktheknack

Je suis joined jewels.
Jan 19, 2009
19,316
0
0
Andy Chalk said:
The function is presumably intended for diagnostic purposes, but he discovered that they have no encryption and even found user names and passwords for what is apparently the manufacturer's development server.
WHEN WILL PEOPLE STOP DOING THIS?

WHEN?

WHEEEEENNNNN?
 

Callate

New member
Dec 5, 2008
5,118
0
0
Lyri said:
Why would you even announce that this is actually possible and not just quietly get into contact with the developers of the brand and discuss your findings?
Regrettably, sometimes a release like this is the only way to get companies to act on this kind of information. Sometimes people in positions of power can be very cavalier about the possibility of other people's lives being in jeopardy, judging the danger to be too remote to warrant acting upon. If someone did act on it, it could well take a very long time before anyone discovered the means by which people were being killed. Patients with serious heart conditions dying? Not a surprise to anyone. And having all patients who had that brand of pacemaker come in for a firmware reset- or possibly a replacement- would not be cheap or easy, and result in a significant PR black eye.

Also, he only did the experiment on one brand; that's not to say that others might not be similarly hackable. By making this information public, he gives companies he hasn't tested reason to make sure that if they need security protocols on their software, it's up to snuff.

And finally, there's nothing in the article to say that he didn't make that information available to the company- and for all the reasons above, subsequently making the information public may have been the right call.

I'm surprised no one has made a Cheney joke yet. Tasteful bunch.
 

Strazdas

Robots will replace your job
May 28, 2011
8,407
0
0
Now im no expert so explain me this: if a device produces a 830V shock discharging its battery, how do you recharge it without, you know, changing the battery? can you recharge the device remotely, like those wi-fi battery rechargers?

Why would you even announce that this is actually possible and not just quietly get into contact with the developers of the brand and discuss your findings?
i wont mention any names buti knew a guy that found a flaw in a software design that pretty much allowed anyone to control your computer if they knew how. the guy contacted the company stating this and that he could help. the companies reply was something like "there is no flaw, you are stupid". he did in the end used it to hack some government based computer, which got attention fast, and he was going to jail, but the company decided to hire him instead to fix the flaw and others if there are any. going public was his only shot at fixing it.
 

renegade7

New member
Feb 9, 2011
2,046
0
0
Excuse me while I go the gym and do 3 hours of cardio a day so I never get stuck with a pacemaker...

Doom972 said:
No encryption? No failsafe? I'm sure this guy isn't the first one to discover this. Probably the first to talk about it publicly though.
I've certainly considered the matter but I didn't think the manufacturer would actually put wireless communications in a pacemaker. Just...why?

"Hey, did you get that email?"
"No let me just check my pacemaker."
 

TrevHead

New member
Apr 10, 2011
1,458
0
0
Lyri said:
Kargathia said:
Oh c'mon, if you managed to reverse-engineer pace-makers to enable a cartoony super-villain mass-murder spree, you'd also want the whole world to know you did it.
No, no I don't think I would.

I don't believe I eluded to such in my post, it seems criminally stupid to actually announce that one brand of pacemaker has a weakness and leaves people vulnerable.
It would be better if all involved were actually contacted and quietly without a public display of knowledge and the company looked into a fix for their customers.
Yeah the genie is out of the bottle now, I bet religious nutters and shady governments will be rubbing their hands.

I expect to see a new phishing scam in my spam box soon.
 

(name here)

New member
Oct 8, 2010
76
0
0
Why do pacemakers even have wifi connections that allow firmware updates? Why would you ever need to do that?
 

IckleMissMayhem

New member
Oct 18, 2009
939
0
0
+1 reason to avoid poor cardiac health!

I've spent the past six years fully believing pacemakers = torture devices after witnessing my uncle's death in hospital... turns out they can't always be switched off, therefore will keep shocking somebody who would otherwise have died quickly, painlessly and peacefully.

Basically, no bugger's putting one of those things in my chest. Ever.
 

BehattedWanderer

Fell off the Alligator.
Jun 24, 2009
5,237
0
0
Why would you announce that? Why wouldn't you just contact the manufacturer, maybe a few of the other manufacturers, and say "hey, if I found this, someone else might as well. Just wanted to let you know, there's a critical flaw here." No, instead, you release it to the internet, where it can be used for harm. Lovely.
 

dmase

New member
Mar 12, 2009
2,117
0
0
Strazdas said:
Now im no expert so explain me this: if a device produces a 830V shock discharging its battery, how do you recharge it without, you know, changing the battery? can you recharge the device remotely, like those wi-fi battery rechargers?

Why would you even announce that this is actually possible and not just quietly get into contact with the developers of the brand and discuss your findings?
i wont mention any names buti knew a guy that found a flaw in a software design that pretty much allowed anyone to control your computer if they knew how. the guy contacted the company stating this and that he could help. the companies reply was something like "there is no flaw, you are stupid". he did in the end used it to hack some government based computer, which got attention fast, and he was going to jail, but the company decided to hire him instead to fix the flaw and others if there are any. going public was his only shot at fixing it.
Most pacemakers can be put in by just making an incision in a major artery and inserting it from there, i'm not sure if they just change batteries or the whole device though. I wouldn't be surprised if they is a battery that can be charged by a trans-dermal patch out there though, at least in development.

Pacemakers send a charge based on the electric pulses going through the heart and make appropriate modifications when necessary. Pacemakers keep your heart from failing they usually don't pump out electricity 24/7, while i'm sure that's possible for some people it's much less common.

I wanna say that pacemakers have fail safes that when an excess current is applied it increases the resistance of the device but if someone can control the voltage they would probably be able to change the resistance as well.
 

dmase

New member
Mar 12, 2009
2,117
0
0
Skeleon said:
As a person who works in the medical field, I have to ask... why is medical software almost always incredibly shitty? The stuff crashes, has errors, is bad in terms of user-friendliness, layout and functions... and here it apparently lacks even basic security measures...
Programmers aren't trained as doctors(in most cases) so they rely on doctors to tell them what they want. And doctors aren't engineers so they don't know how to articulate what they want.
 

MASTACHIEFPWN

Will fight you and lose
Mar 27, 2010
2,279
0
0
Yeah, you show those elderly/people with heart problems!
But why do pacemakers have fucking hackable wifi connections?
I would point out Deus ex, but everyone and there mother already did.
 

TitanAura

New member
Jun 30, 2011
194
0
0
Thank god he's not a super-villain... or is he simply using this to gain public trust to then turn on us when we need him most?!
 

Andrew_C

New member
Mar 1, 2011
460
0
0
Sadly, these sort of pacemaker hacks have been around since 2008 at least, see http://www.theregister.co.uk/2008/03/12/heart_monitor_hacking/ and http://www.theregister.co.uk/2011/08/25/medtronic_insulin_pump_hacking/

It's outrageous that the medical device industry has done NOTHING in the past 4 years to improve the security of their implants. How many will have to die before they do something?
 

Serinanth

New member
Apr 29, 2009
135
0
0
dmase said:
Strazdas said:
Now im no expert so explain me this: if a device produces a 830V shock discharging its battery, how do you recharge it without, you know, changing the battery? can you recharge the device remotely, like those wi-fi battery rechargers?

Why would you even announce that this is actually possible and not just quietly get into contact with the developers of the brand and discuss your findings?
i wont mention any names buti knew a guy that found a flaw in a software design that pretty much allowed anyone to control your computer if they knew how. the guy contacted the company stating this and that he could help. the companies reply was something like "there is no flaw, you are stupid". he did in the end used it to hack some government based computer, which got attention fast, and he was going to jail, but the company decided to hire him instead to fix the flaw and others if there are any. going public was his only shot at fixing it.
Most pacemakers can be put in by just making an incision in a major artery and inserting it from there, i'm not sure if they just change batteries or the whole device though. I wouldn't be surprised if they is a battery that can be charged by a trans-dermal patch out there though, at least in development.

Pacemakers send a charge based on the electric pulses going through the heart and make appropriate modifications when necessary. Pacemakers keep your heart from failing they usually don't pump out electricity 24/7, while i'm sure that's possible for some people it's much less common.

I wanna say that pacemakers have fail safes that when an excess current is applied it increases the resistance of the device but if someone can control the voltage they would probably be able to change the resistance as well.
The older style pace makers were actually powered with plutonium, and they lasted around 40 years. They were replaced with lithium batteries with about a ten year life. As for a fail safe, not so much.