Can You Remotely Hack a Pacemaker?
According to a VentureBeat article, the world�s largest hacker convention, have �figured out how to turn off someone�s pacemaker via remote control.�
An article posted August 8 on the tech-and-finance news website VentureBeat raised some potentially troubling concerns regarding medical device security and safety. According to the article, a team of academics and tech security professionals presenting at Defcon, the world’s largest hacker convention, have “figured out how to turn off someone’s pacemaker via remote control.”
The team, led by Kevin Fu, an associate professor at the University of Massachusetts at Amherst and director of the Medical Device Security Center, reverse engineered a Medtronic Maximo DR VVEDDDR model #7278 implantable cardioverter defibrillator (ICD), a model introduced to the US market in 2003.
According to researcher Daniel Halperin, a graduate student at the University of Washington, this model of ICD has “a built-in test mechanism which turns out to be a bug that can be exploited by hackers. There is no cryptographic key used to secure the wireless communication between the control device and the pacemaker.”
Once Fu and his team figured out how the ICD’s processes worked, they used a software radio, GNU radio software, and less than $1,000 worth of other electronics to build a system that mimicked the ICD’s control mechanism, enabling them to “eavesdrop on private data such as the identity of the patient, the doctor, the diagnosis, and the pacemaker instructions.” The device also allowed them to control the pacemaker.
Halperin said the device constructed by the research team could be used to “induce the test mode, drain the device battery, and turn off therapies.”
In May 2008 the team published “Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses,” which provides a detailed account of their research and conclusions.
The paper’s abstract explained the team’s reasons for conducting and revealing their findings:
“We implemented several software radio-based attacks that could compromise patient safety and patient privacy. Motivated by our desire to improve patient safety, and mindful of conventional trade-offs between security and power consumption for resource constrained devices, we introduce three new zero-power defenses based on RF power harvesting. Two of these defenses are humancentric, bringing patients into the loop with respect to the security and privacy of their implantable medical devices (IMDs). Our contributions provide a scientific baseline for understanding the potential security and privacy risks of current and future IMDs, and introduce human-perceptible and zero-power mitigation techniques that address those risks. To the best of our knowledge, this paper is the first in our community to use general-purpose software radios to analyze and attack previously unknown radio communications protocols.
Additional Resources
A joint effort by the Association for the Advancement of Medical Instrumentation (AAMI), the American College of Clinical Engineering (AACE), and the Healthcare Information Management Systems Society (HIMSS), CE-IT represents “thousands of biomedical equipment technicians, clinical engineers, IT professionals, clinicians, and other medical technology professionals around the world” and was formed to “foster a united voice for IT and clinical engineering concerns; and develop important resources, best practices, and networking opportunities to advance the interests of CE-IT issues in healthcare.”
