A couple of weeks ago in What The F***? I wrote about the threat of potential hackers attacking insulin pumps, implanted defibrillators, and pacemakers. It seems that some people are taking the threat seriously, because there is an article on line at Technology Review discussing the threat and a potential way to block hacking attempts.
It’s a very interesting concept, but I think that the long term goal would be to build this technology into the devices, not as an add on. Still, for the next several years, there will lots of people walking around with the current generation of implanted devices and they will need protection.
Created by researchers from MIT and the University of Massachusetts, Amherst, the laptop-sized device, called “the shield,” emits a jamming signal whenever it detects an unauthorized wireless link being established between an implant and a remote terminal (which can be out of sight and tens of meters away). Although no attack of this kind is known to have occurred , “it’s important to solve these kinds of problems before the risk becomes a tenable threat,” says Kevin Fu, an associate professor of computer science at UMass and one of the developers of the shield. Fu was Technology Review’s Young Innovator of the Year in 2009 for his work in uncovering the previously unsuspected danger that hackers pose to implant wearers.
I’m confident that Borepatch would say that no attack has occurred YET, but that if someone can think of the possibility then someone else is trying to make it a reality. It will be interesting to see if a wearable device is developed and what the market is for it.
The John Rain novels by Barry Eisler feature an assassin who specializes in killings that look like natural causes — the first book has him taking someone out on a train by modifying their pacemaker settings wirelessly.
I have no doubt that at some point in real life someone will attempt to do this sort of thing.
The question is, will they really work… I work with folks that do anti-jam stuff, but it’s expensive, hard to manage, and requires constant updating because of the bad guys.
It’s a constant back and forth, and unfortunately the good guys are usually behind.
On the upside, the bad guys that are bright enough for this kind of thing are few and far between…
The problem is once one person figures it out, others will figure it out. Or the guy that figured it out will sell the source code to someone else. Hoping no one figures out how to hack something is not the way to go.
The current terminology is “weaponizing exploits”. Not hard to connect those dots.
I expect that this won’t work well, because the jammer will mistake legitimate signals as hostile, and so people who wear this in public will be shunned. Go into Starbuck’s, and everyone gets kicked off the WiFi.
I also expect that the implantable devices have precisely bupkis for security. Overall the patient may be better off (as a real medical condition is riskier than a hypothetical future hack), but this calculation is almost certainly going to change over time,
And it’s worth thinking about “weaponizing”. How many people might have wanted to off Dick Cheney (or put him in the hospital)?
I’d suspect that you are right about no security built into current generation devices. After all it takes a devious mind to come up with this sort of thing and that probably doesn’t describe people who develop devices to help people. As more implantable and remotely controllable devices come to market, this will become a larger problem.
Look up Left Ventricular Assist Device and then think about what sort of mischief you can cause with that.
There was a talk on this topic earlier this month at Defcon 19. It was called Hacking Medical Devices for Fun and Insulin: Breaking the Human SCADA. (SCADA is the control system for power plants and similar industrial devices).
https://media.blackhat.com/bh-us-11/Radcliffe/BH_US_11_Radcliffe_Hacking_Medical_Devices_WP.pdf