After Lawsuits And Denial, Pacemaker Vendor Finally Admits Its Product Is Hackable
from the digital-wetworks dept
So we've noted how the lack of security in the Internet of Things is a bit of a problem. Initially, many of us thought that easily hacked smart tea kettles and smart refrigerators were kind of cute. Then we realized that this same, paper-mache grade security is also apparently embedded in everything from automobiles to medical gear. Then, more recently, we realized that all of these poorly-secured devices were being quickly compromised and used in botnets to help fuel massive, historically unprecedented, new DDoS attacks. The warnings were there all along, we just chose to ignore them.For more than a decade people had been warning that the security on pacemakers simply wasn't very good. Despite these warnings, many of these devices are still vulnerable to attack. This week the FDA was forced to issue a warning, noting that security vulnerabilities in the St. Jude Medical implantable cardiac device and corresponding Merlin@home Transmitter could be a serious problem. It's notable as it's the first time we've seen the government publicly acknowledge this specific type of threat.
The St. Jude Medical Merlin@home Transmitter uses a home monitor to transmit and receive RF signals wirelessly to the pacemaker. But the FDA found that this transmitter was vulnerable to attack, with the press release politely tap dancing around the fact that said vulnerability could be used to kill:
"The FDA has reviewed information concerning potential cybersecurity vulnerabilities associated with St. Jude Medical's Merlin@home Transmitter and has confirmed that these vulnerabilities, if exploited, could allow an unauthorized user, i.e., someone other than the patient's physician, to remotely access a patient's RF-enabled implanted cardiac device by altering the Merlin@home Transmitter. The altered Merlin@home Transmitter could then be used to modify programming commands to the implanted device, which could result in rapid battery depletion and/or administration of inappropriate pacing or shocks."According to the FDA, they have no evidence of anybody dying because of the vulnerability yet. They're also quick to note that St. Jude Medical issued a patch on January 9 that fixes this vulnerability. St. Jude Medical was quick to issue a statement patting itself on the back for patching its systems against "highly unlikely medical device cyber risks":
"There has been a great deal of attention on medical device security and it’s critical that the entire industry continually enhances and improves security while bringing advanced care to patients,” said cyber security expert Ann Barron DiCamillo, former director of U.S. CERT and advisor to St. Jude Medical’s Cyber Security Medical Advisory Board. “Today’s announcement is another demonstration that St. Jude Medical takes cyber security seriously and is continuously reassessing and updating its devices and systems, as appropriate."Granted St. Jude Medical had previously received a bit of a nudge, and this isn't the first time the company's name has appeared in lights for the wrong reason. Security startup MedSec resorted to some creative tactics last year when it began shorting St. Jude Medical stock to try and highlight the company's abysmal security, after the traditional vulnerability reporting process failed to get the company's attention. At the time, MedSec Chief Executive Officer Justine Bone stated that the company consistently did little to nothing when vulnerabilities were reported:
"As far as we can tell, St. Jude Medical has done absolutely nothing to even meet minimum cybersecurity standards, in comparison to the other manufacturers we looked at that have made efforts," Bone said. There are steps St. Jude can take relatively quickly to protect patients, including changing the programming of implanted pacemakers and defibrillators through a method that would involve a doctor’s visit, she said."St. Jude Medical's first response was an outright denial, followed by a lawsuit against MedSec for "trying to frighten patients and caregivers." Fast forward a few months, and St. Jude Medical is now trying to hold itself up as the poster child for proactive security and accountability. But the reality is that publicly shaming companies that can't be bothered to prioritize user security (even when human lives are at risk) appears to pay notable dividends.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: fda, iot, merlin@home, pacemaker, security
Companies: st. jude medical
Reader Comments
Subscribe: RSS
View by: Time | Thread
New Show Coming Soon
[ link to this | view in chronology ]
Re: "The IFTTT Murders"
Well, maybe IFT-something-something...
[ link to this | view in chronology ]
Not very reassuring
Maybe because the 'evidence' could just look like someone had a heart attack?!?
[ link to this | view in chronology ]
Re: Not very reassuring
[ link to this | view in chronology ]
Re: Not very reassuring
my mother had a merlin home transmitter in her home, For what i dont know, I went to go check on her causee I hadnt heard from her and found her dead. Paperwork says she had a hear attack. I thought this machine regulated any
abnormal functions regarding the pacemaker. Im so upset..she passed this yr in august, I dont know where to start.
[ link to this | view in chronology ]
I really don't understand Saint Jude Medical.
Did anybody at that company understand that if a malicious attacker killed somebody using a security flaw and it were proven in court, they might be driven to bankruptcy by the settlement?
Also, there's a little item in the lawbooks called "criminal negligence"...
[ link to this | view in chronology ]
Re: They were willing to spend money on a lawsuit but NOT on fixing security flaws.
Probably, all things considered, a sound business decision ...
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Patched Transmitter
Surely the pacemaker only accepts requests that have the proper cryptographic signature!?!?
Or can I build a Pringles can death ray that transmits my malicious commands to the pacemaker?
[ link to this | view in chronology ]
highly unlikely medical device cyber risks
as in, i can't imagine somebody would actually do that. otherwise, good goddamn luck.
this smells exactly like the japanese assuring all that a tsunami greater than 10 meters is a virtual impossibility. i wonder if they'd like to run that opportunity past them again with all set back to that point in time.
[ link to this | view in chronology ]
Who do you mean 'we'?
I have warned many of my friends and family to avoid anything that can be accessed OVER THE WEB. If they must have it to block telnet, to keep it behind their firewall (which I also advised on keeping it tightly controlled). And I routinely advise store clerks to tell their customers to immediately change the passwords and admin names.
I am very serious about security. I have backed off on only having one serial line to be able to login as root on my file server. Only because the file server now sits behind me.
Just this last week I warned a friend about Samsung smart(sic) TV and the always on mic.
This is a disaster I have known was coming. And voila here it is.
/rant
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]