-
Website
http://venturebeat.com/ -
Original page
http://venturebeat.com/2008/08/08/defcon-excuse-me-while-i-turn-off-your-pacemaker/ -
Subscribe
All Comments -
Community
-
-
Top Commenters
-
Popular Threads
All Comments
Come on, you have a family member with one of these, of course you should be concerned that there is a flaw that went (relatively) undetected and was certainly not locked up by the manufacturers.
Wouldn't you rather the "good guys" know about it than the bad ones?
It works well that the companies didn't hand over their specs freely; that the researcher (Kevin Fu) was up front and honest [and managed to get some help from Harvard] made it better.
It shows it can be done by someone with skill and access, both of which are likely to be low enough all around to prevent your average russian hackers from pulling off "Heart Stop USA 2010."
In any case, I am the type of person that considers biomechanical integration something to be weary of. I would opt to die or have some other surgery than have a pacemaker. Straight up.
I am also aware that most things that are mechanical are up to receive interference...
Not interested in letting the man implant and then zap me at their will...
It isn't ignorance is bliss. You see now both sides know. Is it worth telling the bad guys to keep the good guys informed?
To put it into a metaphor, it would be like telling everyone in town that your door's unlocked. Not everyone is a killer, sure, but it only takes one.
As far as the "skill and access" thing goes. They may be low, but one person can do a lot of damage. Especially if this attack can be done remotely to more than one pacemaker at a time.
Modern garage door openers defeat this problem using pairs of random numbers keyed into each remote control. You have to get up on a step ladder and hold a button on the opener while holding the remote controls button simultaneously for them to "pair" and exchange random numbers. The numbers use public/private key exchange, so even if a cracker uses software to guess one number, he still can't open the door.
Fast forward to pacemakers: it's a similar problem. The wireless controller and the pacemaker need to use secure communication to authenticate each other, or else anyone could send the pacemaker commands. The greatest is not evil hackers murdering pacemaker-wearers remotely but accidental reprogramming sent to the pacemaker. Imagine if some other device, like a child's toy walkie-talkie, sent a radio signal that matched one of the pacemakers command sequences exactly. Since the pacemakers today seem to accept commands with no security the child's toy could accidently adjust the pacemaker rate faster, slower, off, into test mode, whatever. At the hospital, the doctor might never figure out that it was accidental radio interference that caused her pacemaker to malfunction. Similar problems have happened with computer networks, where packets for one protocol (AppleTalk) are mistaken by the router for other packets (like RIP, BGP, or DECNET) causing weird network problems.
So, while it's easy to crack jokes, these guys have found a serious flaw with these medical devices and the manufacturer needs to fix it. Over on consumerist.com, there's another story of apathetic radio device design:
http://consumerist.com/5034950/fisher+price-wal...
Now that the vulnerability is demonstrated, manufacturers will hopefully phase strong encryption into their control protocols.
Most companies will be thick headed and rebuff a hacker that says "I have found a flaw here here and here, I can exploit it in this fashion, I can do this within your systems, help me help you and we can solve it and close it together."
Others will integrate them into R + D for their software
Never heard of this exploit... Hair spoofing?
Jt
www.FireMe.to/udi
They gotta be newer than 2002 or something...
@-)
One of my Granddads had a clock in his stomach (according to Grandma). But he was an old navy man - so it must have been very early-on research. :D
Nobody likes the government anymore though, and coffins are already overpriced, so yeah, I'll go with what everyone else is saying; what an evil freak. (if he actually uses it)
Also must people don't know that patients with pacemakers have devices that will send medical data back to there doctor via telephone. Place you phone on the machine, wear wrist bracelets to detect electrical activity, place provided magnet over pacemaker, and it will 'chirp' your data back to the 800 service and your doctor. I hope all this is done with read-only privileges to the pacemaker...
Man, reading comments like yours always make me think there's a chance that the companies themselves are sending someone around to draw attention away from the importance of the article, so they don't have to do anything...
Without research that pushes boundaries and questions accepted norms then there would be no progress: the manufacturers would continue to build sub-standard equipment if it meant protecting their bottom line (profits).
Ignorance of a problem doesn't mean the problem doesn't exist and research that highlights such problems isn't irresponsible. The researchers involved attempted to work together with the manufacturers but they refused to help (because by doing so they would expose the flaws in their equipment and hurt company profits).
Problem solved. This is not that big a problem and can be solved for 20 dollars worth of electronics and 2 hours of work.
Simple answer is they are going to become famous because the press exaggerates to sell papers, and the researchers don't have the intelligence, or the morals, to correct them.
http://www.uggboots365.co.uk
I think I will try to recommend this post to my friends and family, cuz it’s really helpful.
Ugg Boots Sale