{"id":2228,"date":"2013-08-14T10:00:56","date_gmt":"2013-08-14T14:00:56","guid":{"rendered":"http:\/\/me-en.kaspersky.com\/blog\/?p=2228"},"modified":"2020-02-26T18:57:44","modified_gmt":"2020-02-26T14:57:44","slug":"hacking-humans","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/hacking-humans\/2228\/","title":{"rendered":"Hacking Humans"},"content":{"rendered":"

Go ahead and add insulin pumps and pacemakers to the ever-expanding list of computer-like-devices that contain bugs and are therefore vulnerable to exploit<\/a>. That\u2019s right, that little metal thing inside grandpa\u2019s chest that shoots out electrical impulses to keep the old man\u2019s heart beating correctly is vulnerable to a remote hack involving nothing more than a laptop. So too are the insulin pumps that have replaced syringes and daily injections for many diabetics seeking to regulate the high blood sugar levels at the root of that disease.<\/p>\n

\"humans_title_EN\"<\/a><\/p>\n

The bad news is that many of the millions of embedded medical devices many millions of people rely on are vulnerable to attack. The good news is that I don\u2019t know of any circumstances where anyone has actually attacked one of these devices in real life. The hard truth about cybercriminals is that they, unlike a lot of these lofty-minded researchers, don\u2019t hack for fun- they hack for profit. So until we find a way to make consistent money from poisoning a person with insulin or delivering a heavy shock to their pacemaker, I just don\u2019t see much incentive for these kinds of attacks.<\/p>\n

I admit, it\u2019s pretty flashy to imagine some hacker-assassin preying on wearers of embedded medical devices, but it\u2019s also incredibly silly. The barrier of entry to perform one of these attacks, the technical ability, testing environments, and knowledge of vulnerable systems needed, is so high, that almost no one could exploit a pacemaker or insulin pump. And even if they could, why would they? For murder? If you think that someone is trying to kill you, then I assure you embedded medical device attacks should be the least of your worries.<\/p>\n

\"12\"<\/a><\/p>\n

Nevertheless, if a potential security issue exists, it should be addressed.\u00a0 Sadly, Barnaby Jack, one of the vanguards of implantable medical device research, died last month, just a week before he was scheduled to present a briefing on the subject<\/a> at the Black Hat security conference in Las Vegas.<\/a>However, Jack, who worked as a security researcher at the application security firm IOActive, released a bunch of research on the topic in late 2012. His findings were grim to say the least.<\/a><\/p>\n

\"barnabyjack\"<\/a><\/p>\n

At the Breakpoint conference in Australia last year, Jack demonstrated that he could wirelessly send a signal from his laptop to a pacemaker and advise the device to deliver a potentially fatal shock from inside a patient\u2019s body. The attack arose from a programming error whereby the researcher could send a special command to the pacemaker and the pacemaker would respond with its model and serial number. Once he determined the type of device he was working with, he was able to deliver an 830-volt \u2013 potentially fatal \u2013 shock to the body in which the pacemaker rested. Moreover, Jack demonstrated that it\u2019s possible to program pacemakers to spread malicious code to other similar devices of the same vendor. Quite luckily, this scenario might be gladly accepted by Hollywood, but for real-life criminals or terrorists, it\u2019s more effective to use good old bombs and guns.<\/p>\n

Jack demonstrated that he could wirelessly send a signal from his laptop to a pacemaker and advise the device to deliver a potentially fatal shock from inside a patient\u2019s body.<\/div>\n

This wasn\u2019t Jack\u2019s first rodeo either. The researcher turned heads inside and outside of the security industry a year earlier at the Hacker Halted conference in Miami, Florida, when he demonstrated an attack successfully compromising an insulin pump and compelling it to deliver a fatal dose of insulin from as far away as 300 feet.<\/p>\n

Jack modified the antennae on one of these wireless pumps and fiddled with the software that controlled it. An earlier presentation by Jerome Radcliffe at Black Hat 2011 demonstrated that insulin pump manipulation was possible if an attacker could track down the unique numeric device number of the implantable pump in question. Jack\u2019s research went to the next level. He could compromise all the vulnerable devices without knowing their unique device identification.<\/p>\n

Jack was just one researcher among many and pacemakers and insulin pumps are just the tip of the iceberg. Beyond those there are an inconceivably massive number of potentially vulnerable medical devices, both the implantable and the external ones. As if it weren\u2019t scrutinized heavily enough as is, the medical device sub-topic of security is going to get a lot of attention in the years and months to follow, and we\u2019ll write about it here whenever there is interesting research to present.<\/p>\n

One of the problems with securing medical devices is that they are radically different from standard computers. An insulin pump delivers insulin and communicates with doctors to determine the levels of insulin it should deliver. Same for pacemakers: they deliver an electrical pulse to the heart to keep it beating normally, communicating with something outside the body to occasionally determine how big the impulse needs to be.<\/p>\n

\"pump\"<\/p>\n

If these devices can communicate with sources outside the body, then they are doing it wirelessly, which presents some obvious security problems as Jack and other researchers showed. The next step, it seems, would be to make sure these things communicate over encrypted channels and maybe set up some form of authentication, limiting access to the devices. It might be very challenging because of numerous restrictions imposed by nature of these devices. Setting passwords might prevent doctors in another country from saving your life while on vacation. Encryption may quickly drain the battery of a small implanted device. These challenges are new and answers are yet to be found.<\/p>\n

If there is one thing I am sure of, it\u2019s that doctors and security researchers are some of the smartest people in the world. Not only that, but doctors take great pride in saving lives. Security researchers themselves are a bit over-zealous at time when it comes to protecting data and systems.<\/p>\n

There isn\u2019t a whole lot you can personally do to protect yourself here. No one is developing security products to protect these things<\/a> and I seriously doubt there is anything in the way of user-controlled security settings. I suppose if you suffer from diabetes you could go back to the old-fashioned monitor-your-blood-sugar-and-manually-inject-insulin method. Maybe you\u2019ll be lucky and never have to wear a pacemaker, insulin pump, or any other implantable medical device, but maybe you already wear one: the best you can do is look to the manufacturers and the doctors and hope they are paying attention to research like this, which they almost certainly are.<\/p>\n

It may seem reckless to publish highly sensitive information in this way, but really, Jack\u2019s and other similar work is just the kind that can push medical device manufacturers to start making and maintaining more secure equipment. These are doctors and engineers after all. They learn from their mistakes. When a researcher shows them a bug in their products, that bug probably won\u2019t show up again.<\/p>\n

The bottom line is this: embedded medical devices save millions of lives every year and the number of people who have died as a result of a medical device hack is somewhere around zero.<\/p>\n","protected":false},"excerpt":{"rendered":"

Go ahead and add insulin pumps and pacemakers to the ever-expanding list of computer-like-devices that contain bugs and are therefore vulnerable to exploit. That\u2019s right, that little metal thing inside<\/p>\n","protected":false},"author":42,"featured_media":2229,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5],"tags":[190,97],"class_list":{"0":"post-2228","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"tag-device-protection","9":"tag-security-2"},"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/hacking-humans\/2228\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/hacking-humans\/2317\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/hacking-humans\/2389\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/hacking-humans\/2257\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/hacking-humans\/2477\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/hacking-humans\/1405\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/hacking-humans\/2477\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/hacking-humans\/2477\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/device-protection\/","name":"device protection"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/2228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/42"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=2228"}],"version-history":[{"count":2,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/2228\/revisions"}],"predecessor-version":[{"id":15593,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/2228\/revisions\/15593"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/2229"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=2228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=2228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=2228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}