Researchers Build App That Kills To Highlight Insulin Pump Exploit

from the remote-fatality dept

By now the half-baked security in most internet of things (IOT) devices has become a bit of a running joke, leading to amusing Twitter accounts like Internet of Shit that highlight the sordid depth of this particular apathy rabbit hole. And while refrigerators leaking your gmail credentials and tea kettles that expose your home networks are entertaining in their own way, it's easy to lose sight of the fact that the same half-assed security in the IOT space also exists on most home routers, your car, your pacemaker, and countless other essential devices and services your life may depend on.

Case in point: just about two years ago, security researchers discovered some major vulnerabilities Medtronic's popular MiniMed and MiniMed Paradigm insulin pumps. At a talk last year, they highlighted how a hacker could trigger the pumps to either withhold insulin doses, or deliver a lethal dose of insulin remotely. But while Medtronic and the FDA warned customers about the vulnerability and issued a recall over time, security researchers Billy Rios and Jonathan Butts found that initially, nobody was doing much to actually fix or replace the existing devices.

So Rios and Butts got creative in attempting to convey the scope and simplicity of the threat: they built an app that could use the pumps to kill a theoretical patient:

"We’ve essentially just created a universal remote for every one of these insulin pumps in the world," Rios says. "I don’t know why Medtronic waits for researchers to create an app that could hurt or kill someone before they actually start to take this seriously. Nothing has changed between when we gave our Black Hat talk and three weeks ago."

To target a specific insulin pump, a hacker would need to know the proper serial number of the device they're targeting. But the app simplifies this process by quickly running through all potential serial numbers until it hits the correct one. The gambit seems to have worked: a week after the team demonstrated its proof of concept app to FDA officials in mid-June of this year, Medtronic announced a voluntary recall program. Years after Medtronic first learned about the flaws in these devices, there's now a structure in place that allows patients to use the devices if they want, and replace them for free if they don't.

That said, the researchers are still quick to point out that this kind of dysfunction (offering potentially fatally compromised products but having no avenue to correct them) is fairly common in the medical sector:

"...the climate for medical device vulnerability disclosures is still clearly fraught if researchers feel that they need to take extreme, and even potentially dangerous, steps like developing a killer app to spur action.

"If you think about it, we shouldn't be telling patients, 'hey, you know what, if you want to you could turn on this feature and get killed by a random person.' That makes no sense," QED Security Solutions' Rios says. "There should be some risk acceptance; this is a medical device. But an insecure feature like that just needs to be gone, and they had no mechanism to remove it."

And of course that's not just a problem in the medical sector, but most internet-connected tech sectors. As security researcher Bruce Schneier often points out, it's part of a cycle of dysfunction where the consumer and the manufacturer of a flawed product have already moved on to the next big purchase, often leaving compromised products, and users, in a lurch. And more often than not, when researchers are forced to get creative to highlight the importance of a particular flaw, the companies in question enjoy shooting the messenger.

Filed Under: insulin pump, iot, minimed, minimed paradigm, security
Companies: medtronic

Supreme Court Overturns CAFC Yet Again; Explains Basic Patent Law To The 'Patent' Court

from the this-is-becoming-a-pandemic dept

Over the last few years, the Supreme Court has taken a renewed interest in patent law. After years of ignoring the issue, and leaving it in the hands of the appeals court for the federal circuit (CAFC -- which was established, in part, to hear all patent appeals), the Supreme Court has taken to regularly smacking down the CAFC, and telling it that it doesn't understand basic patent law. It's now happened again. The court has reversed yet another CAFC decision, this time concerning who has the burden of proving infringement. This was as case involved Medtronic filing for a declaratory judgment that it did not infringe on someone else's patent (Medtronic, it should be noted, has a history of being quite a patent bully itself at times). A district court had noted that the patent holder, in this case the Mirowski Family Ventures, has the burden of proof on showing infringement. CAFC said that since Medtronic brought the declaratory judgment suit that it was actually Medtronic's burden to prove that it did not infringe. The Supreme Court has reversed in an easy unanimous decision.

Simple legal logic, resting upon settled case law, strongly supports our conclusion. It is well established that the burden of proving infringement generally rests upon the patentee....

The ruling notes that a declaratory judgment filing is just a procedural issue, which doesn't change the basic substantive rights. Thus, it should be viewed as if it were the patent holder bringing the claim, leaving the burden on them. The court also points out that it would be kind of ridiculous to put the burden first on the party filing for declaratory judgment that it doesn't infringe if there's no proof that there's infringement in the first place. It would leave the plaintiff trying to prove a negative in the dark...

A patent holder is in a better position than an alleged infringer to know, and to be able to point out, just where, how, and why a product (or process) infringes a claim of that patent. Until he does so, however, the alleged infringer may have to work in the dark, seeking, in his declaratory judgment complaint, to negate every conceivable infringement theory.

Perhaps most interesting is, at the very end of the decision, Justice Breyer clearly notes that the purpose of the patent system is to benefit the public interest -- and that requires a "well-functioning" patent system, rather than a broken down patent system. As it notes, "patent monopolies" need to be "kept within their legitimate scope."

Filed Under: cafc, declaratory judgment, patents, supreme court
Companies: medtronic

Live By The Patent, Die By The Patent: Extreme Patent Aggressor Medtronic Loses Patent Lawsuit

from the schadenfreude dept

It's always slightly amusing to watch extreme patent aggressors get hoisted by their own petard and lose a patent lawsuit. Medical device maker, Medtronic, is somewhat famous for its aggressive pursuit of patent infringement claims against others. In one case, a few years ago, a judge overturned a ruling that Medtronic had actually won and then scolded the company's lawyers, noting that their "conduct was in disregard for the duty of candor, reflecting an attitude of 'what can I get away with?'" The judge also noted that they knew "with full awareness that their case was without merit" yet they pressed ahead and "created an illusion of infringement." And this wasn't a one off. Just a few weeks later, in a totally different patent lawsuit a completely different judge scolded another set of Medtronic lawyers for doing essentially the same thing.

So it's difficult to get to worked up in hearing that Medtronic is getting a taste of its own medicine, losing an appeal in a case brought against it by Edwards Lifescience, saying that Medtronic needs to pay $74 million. The appeals court also sent it back to the lower court to see if there needs to be an injunction issued.

Filed Under: medical devices, patents
Companies: edwards lifescience, medtronic

Patent Battles Make It That Much More Difficult To Keep People Healthy

from the what-a-shame dept

The problem with the view that patents should be given out for every little improvement (most of which would have come about naturally thanks to market demand) is that you end up with "patent thickets" where a ton of different companies all claim patents on some small part of a larger offering. This isn't just an argument about "ownership" or "rights" in some cases. It can also have direct impact on keeping people alive.

For example, just witness the patent battle going on in the medical device market concerning Boston Scientific, Johnson & Johnson, Medtronic and... famed patent hoarder Acacia. Boston Scientific, Johnson & Johnson and Medtronic have all been suing each other concerning various patents used in stent and catheter technology. Acacia has now jumped into the fray by acquiring patents from Datascope and setting up yet another shell company called Cardio Access.

In all of these cases, everyone is claiming ownership over some piece of the technology used in stents and catheters, basically suggesting that others can't use that part of the technology without paying them. The end result is that we're all put at greater risk. Either stents and catheters won't be able to be as useful as they should be because they can't use the best possible technology -- or if they do use that technology, they get priced much higher to pay for all of these licenses from everyone else. And, of course, with all of these patent lawsuits (and rewards -- since Boston Scientific has already had to pay out the two largest patent fines this year, totaling $750 million), money that could have been spent on making a better product is instead going into lawsuits.

Filed Under: catheters, health care, patent thicket, patents, stents
Companies: acacia, boston scientific, johnson & johnson, medtronic

Another Judge Slaps Down Another Set Of Medtronic Patent Attorneys

from the uppity-judges dept

We noted recently that a judge was so fed up with a pair of well-known patent attorneys that he not only overturned the verdict, but he made the attorneys pay the opposing side's legal bills. Now, in a totally separate patent battle, yet another judge has done the same exact thing. And, in what may (or may not) be a coincidence, both sets of lawyers were representing Medtronic. In both cases, they ignored the earlier parameters set on how the patent claims could be portrayed in court. It's good to see judges pushing back, though it really does say something that patent attorneys felt they could get away with this.

Filed Under: attorney's fees, patent abuse, patents
Companies: medtronic

Looks Like Judges Are Getting Fed Up With Bogus Patent Lawsuits Too

from the about-time dept

While patent attorneys seem to love filing suits in East Texas, I'm guessing they may try to start avoiding filing suits in Colorado. Slashdot alerts us to the news that a District Court Judge in Colorado didn't just overturn a jury's ruling of patent infringement by BrainLAB against Medtronic, he also scolded Medtronic's lawyers for "abusive" behavior and demanded those lawyers pay BrainLAB's legal bills. Specifically, the judge, Richard P. Matsch, found that the two litigators who argued the case on Medtronic's behalf ignored the limitations and misled the jury. As Matsch noted:

"At trial, [McDermott]'s conduct was in disregard for the duty of candor, reflecting an attitude of 'what can I get away with?' Throughout the trial, the [McDermott] lawyers artfully avoided the limitations of the patent claims and created an illusion of infringement. They did so with full awareness that their case was without merit."

It's also worth pointing out that the two lawyers in question are generally well-respected (and expensive) IP litigators, rather than just random lawyers (as you might otherwise assume from the judge's comments). Yet, given how freely the court system has allowed patent litigation to run rampant, it's no surprise to see some patent attorneys push the envelope. However, it really is great to see a judge smack them down in such a strong manner, as it may wake up some other patent attorneys.

Filed Under: bogus lawsuits, patents
Companies: brainlab, medtronic