After Lawsuits And Denial, Pacemaker Vendor Finally Admits Its Product Is Hackable

from the digital-wetworks dept

So we've noted how the lack of security in the Internet of Things is a bit of a problem. Initially, many of us thought that easily hacked smart tea kettles and smart refrigerators were kind of cute. Then we realized that this same, paper-mache grade security is also apparently embedded in everything from automobiles to medical gear. Then, more recently, we realized that all of these poorly-secured devices were being quickly compromised and used in botnets to help fuel massive, historically unprecedented, new DDoS attacks. The warnings were there all along, we just chose to ignore them.

For more than a decade people had been warning that the security on pacemakers simply wasn't very good. Despite these warnings, many of these devices are still vulnerable to attack. This week the FDA was forced to issue a warning, noting that security vulnerabilities in the St. Jude Medical implantable cardiac device and corresponding Merlin@home Transmitter could be a serious problem. It's notable as it's the first time we've seen the government publicly acknowledge this specific type of threat.

The St. Jude Medical Merlin@home Transmitter uses a home monitor to transmit and receive RF signals wirelessly to the pacemaker. But the FDA found that this transmitter was vulnerable to attack, with the press release politely tap dancing around the fact that said vulnerability could be used to kill:
"The FDA has reviewed information concerning potential cybersecurity vulnerabilities associated with St. Jude Medical's Merlin@home Transmitter and has confirmed that these vulnerabilities, if exploited, could allow an unauthorized user, i.e., someone other than the patient's physician, to remotely access a patient's RF-enabled implanted cardiac device by altering the Merlin@home Transmitter. The altered Merlin@home Transmitter could then be used to modify programming commands to the implanted device, which could result in rapid battery depletion and/or administration of inappropriate pacing or shocks."
According to the FDA, they have no evidence of anybody dying because of the vulnerability yet. They're also quick to note that St. Jude Medical issued a patch on January 9 that fixes this vulnerability. St. Jude Medical was quick to issue a statement patting itself on the back for patching its systems against "highly unlikely medical device cyber risks":
"There has been a great deal of attention on medical device security and it’s critical that the entire industry continually enhances and improves security while bringing advanced care to patients,” said cyber security expert Ann Barron DiCamillo, former director of U.S. CERT and advisor to St. Jude Medical’s Cyber Security Medical Advisory Board. “Today’s announcement is another demonstration that St. Jude Medical takes cyber security seriously and is continuously reassessing and updating its devices and systems, as appropriate."
Granted St. Jude Medical had previously received a bit of a nudge, and this isn't the first time the company's name has appeared in lights for the wrong reason. Security startup MedSec resorted to some creative tactics last year when it began shorting St. Jude Medical stock to try and highlight the company's abysmal security, after the traditional vulnerability reporting process failed to get the company's attention. At the time, MedSec Chief Executive Officer Justine Bone stated that the company consistently did little to nothing when vulnerabilities were reported:
"As far as we can tell, St. Jude Medical has done absolutely nothing to even meet minimum cybersecurity standards, in comparison to the other manufacturers we looked at that have made efforts," Bone said. There are steps St. Jude can take relatively quickly to protect patients, including changing the programming of implanted pacemakers and defibrillators through a method that would involve a doctor’s visit, she said."
St. Jude Medical's first response was an outright denial, followed by a lawsuit against MedSec for "trying to frighten patients and caregivers." Fast forward a few months, and St. Jude Medical is now trying to hold itself up as the poster child for proactive security and accountability. But the reality is that publicly shaming companies that can't be bothered to prioritize user security (even when human lives are at risk) appears to pay notable dividends.

Reader Comments

Subscribe: RSS

View by: Time | Thread

  • icon
    Roger Strong (profile), 12 Jan 2017 @ 8:53am

    New Show Coming Soon

    "The IFTTT Murders"

    reply to this | link to this | view in chronology ]

  • icon
    Almost Anonymous (profile), 12 Jan 2017 @ 9:11am

    Not very reassuring

    "According to the FDA, they have no evidence of anybody dying because of the vulnerability yet."

    Maybe because the 'evidence' could just look like someone had a heart attack?!?

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 12 Jan 2017 @ 9:47am

      Re: Not very reassuring

      If I remember MedSec's original report (prior to the stock shorting) correctly, these devices could be reprogrammed such that the communications log got rewritten as part of the reprogramming. This means that someone could reprogram the device, cause a heart attack, restore the transmitter to factory default settings (with a believable log), and there would be NO evidence that it wasn't just either a natural heart event or an unforeseeable failure of the device following an update.

      reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 12 Jan 2017 @ 9:12am

    I really don't understand Saint Jude Medical.

    They were willing to spend money on a lawsuit but NOT on fixing security flaws.

    Did anybody at that company understand that if a malicious attacker killed somebody using a security flaw and it were proven in court, they might be driven to bankruptcy by the settlement?

    Also, there's a little item in the lawbooks called "criminal negligence"...

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 12 Jan 2017 @ 9:20am

    tl;dr: "Please short sell us."

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 12 Jan 2017 @ 9:54am

    Patched Transmitter

    OK so they fixed the transmitter.

    Surely the pacemaker only accepts requests that have the proper cryptographic signature!?!?

    Or can I build a Pringles can death ray that transmits my malicious commands to the pacemaker?

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 12 Jan 2017 @ 12:23pm

    highly unlikely medical device cyber risks

    as in, i can't imagine somebody would actually do that. otherwise, good goddamn luck.

    this smells exactly like the japanese assuring all that a tsunami greater than 10 meters is a virtual impossibility. i wonder if they'd like to run that opportunity past them again with all set back to that point in time.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 12 Jan 2017 @ 1:00pm

    Who do you mean 'we'?

    I NEVER chose to ignore them. I have not been into security to the level of Krebs and friends but I have been into Unix security since ~1980 and Linux since its inception release 0.95.

    I have warned many of my friends and family to avoid anything that can be accessed OVER THE WEB. If they must have it to block telnet, to keep it behind their firewall (which I also advised on keeping it tightly controlled). And I routinely advise store clerks to tell their customers to immediately change the passwords and admin names.

    I am very serious about security. I have backed off on only having one serial line to be able to login as root on my file server. Only because the file server now sits behind me.

    Just this last week I warned a friend about Samsung smart(sic) TV and the always on mic.

    This is a disaster I have known was coming. And voila here it is.


    reply to this | link to this | view in chronology ]

  • icon
    Ryunosuke (profile), 12 Jan 2017 @ 11:51pm

    hey good news: Diane Feinstein's new pacemaker has a backdoor that she wanted in it!

    reply to this | link to this | view in chronology ]

Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Use markdown for basic formatting. HTML is no longer supported.
  Save me a cookie
Follow Techdirt
Techdirt Gear
Shop Now: Copying Is Not Theft
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Report this ad  |  Hide Techdirt ads
Recent Stories


Email This

This feature is only available to registered users. Register or sign in to use it.