Hackers Outsmart Pacemakers, Fitbits: Worried Yet?

Some of the most sensational findings in medical device security revolve around devices that keep the heart beating: pacemakers and implantable cardiac defibrillators. The threat was brought to light by a 2008 paper. Before his death this year, the security researcher Barnaby Jack demonstrated that it was possible to hack a pacemaker remotely and cause it to deliver a life-threatening jolt.

The intended role of wireless communications is to allow these devices to be reprogrammed or to report diagnostic information without the need for surgery. Because they are designed to operate for a decade or more on a single battery, these devices have little power to spare for the kind of encryption you take for granted on your PC. Research focuses on the most frugal methods of protecting data links.

"For about a decade now, with wireless communication for medical devices, the assumption by the manufacturers has been that the telemetry interface is proprietary, and nobody is going to know what these bits mean," Denis Foo Kune, a visiting scholar at the University of Michigan, told us. Kune is working with professor Kevin Fu, one of the foremost medical device security researchers. The security-by-obscurity strategy was partly based on the fact that the devices use radio frequencies that few other devices could access, Kune said. "However, since about 2008, researchers have been showing that they could use software-defined radios to detect the bits coming out and play them back."

Through methodical hacking, it's often easy to decode and manipulate communications, Kune said. Even when communications are better protected, his research has shown the potential of hacking device sensors so they feed false data to higher-level applications, potentially leading to the administration of an unnecessary shock to the heart or an overdose of medicine.

(Source: Wikimedia Commons)