Ohio Arsonist Gets Busted By His Own Pacemaker

from the betrayed-by-my-robot-parts dept

When we talk about pacemakers here at Techdirt, the focus is usually on how the devices have paper-mache grade security, allowing anybody to assassinate the cardiac-challenged with relative ease. In fact we've reached the point where the FTC had to recently issue its first ever warning against a pacemaker vendor when it announced that hackers could comprmise pacemakers made by St. Jude Medical, sending "commands to the implanted device, which could result in rapid battery depletion and/or administration of inappropriate pacing or shocks."

But your pacemaker may just betray you in other ways, too. In Ohio a man was indicted this week on arson and insurance fraud charges after his Pacemaker data contradicted the story he was telling authorities. When the man's home burned down on September 19, Middletown resident Ross Compton told authorities he quickly packed some belongings in a suitcase and some bags, broke a window with his cane, and quickly fled through the window before carrying his belongings back to the car. The man also acknowledged at the time that he had a pacemaker.

So police obtained a warrant for the data stored on the device, and doctors quickly concluded that the story the man's heart was telling didn't match the narrative coming out of his mouth:

"A cardiologist determined that it was "highly improbable," due to his medical conditions, that Compton could do all the collecting, packing and removal of items from his house and then carry them in the short period of time he indicated, according to court records. Police have said statements they received from Compton were "inconsistent" with the evidence they gathered. They also have said that he gave statements conflicting with what he had told a dispatcher, the Hamilton-Middletown Journal-News reported."

Obviously there are numerous privacy questions at play here, since we're living in an era when your car, home, phone, and implant data can not only be used to support criminal charges, but will increasingly be used by giant corporations to determine everything from your insurance rates to your qualification for health care. As such, the Electronic Freedom Foundation was quick to warn the AP about the slippery slope of having your own body's data used against you in such a fashion:

"Stephanie Lacambra, a criminal defense staff attorney with the San Francisco-based foundation, said in an email Tuesday that Americans shouldn't have to make a choice between health and privacy. "We as a society value our rights to maintain privacy over personal and medical information, and compelling citizens to turn over protected health data to law enforcement erodes those rights," Lacambra said."

Internet-of-things devices are not only poorly secured, the privacy policies affixed to most of them are a dumpster fire. So remember folks: the next time you intend to commit a crime or apply for health coverage with a pre-existing condition, remember to wipe the data from all of your cybernetic implants -- and get the latest firmware update for your cerebral and coronary firewalls and intrusion detection systems.

Filed Under: arson, iot, pacemaker, privacy, security, tracking

After Lawsuits And Denial, Pacemaker Vendor Finally Admits Its Product Is Hackable

from the digital-wetworks dept

So we've noted how the lack of security in the Internet of Things is a bit of a problem. Initially, many of us thought that easily hacked smart tea kettles and smart refrigerators were kind of cute. Then we realized that this same, paper-mache grade security is also apparently embedded in everything from automobiles to medical gear. Then, more recently, we realized that all of these poorly-secured devices were being quickly compromised and used in botnets to help fuel massive, historically unprecedented, new DDoS attacks. The warnings were there all along, we just chose to ignore them.

For more than a decade people had been warning that the security on pacemakers simply wasn't very good. Despite these warnings, many of these devices are still vulnerable to attack. This week the FDA was forced to issue a warning, noting that security vulnerabilities in the St. Jude Medical implantable cardiac device and corresponding Merlin@home Transmitter could be a serious problem. It's notable as it's the first time we've seen the government publicly acknowledge this specific type of threat.

The St. Jude Medical Merlin@home Transmitter uses a home monitor to transmit and receive RF signals wirelessly to the pacemaker. But the FDA found that this transmitter was vulnerable to attack, with the press release politely tap dancing around the fact that said vulnerability could be used to kill:

"The FDA has reviewed information concerning potential cybersecurity vulnerabilities associated with St. Jude Medical's Merlin@home Transmitter and has confirmed that these vulnerabilities, if exploited, could allow an unauthorized user, i.e., someone other than the patient's physician, to remotely access a patient's RF-enabled implanted cardiac device by altering the Merlin@home Transmitter. The altered Merlin@home Transmitter could then be used to modify programming commands to the implanted device, which could result in rapid battery depletion and/or administration of inappropriate pacing or shocks."

According to the FDA, they have no evidence of anybody dying because of the vulnerability yet. They're also quick to note that St. Jude Medical issued a patch on January 9 that fixes this vulnerability. St. Jude Medical was quick to issue a statement patting itself on the back for patching its systems against "highly unlikely medical device cyber risks":

"There has been a great deal of attention on medical device security and it’s critical that the entire industry continually enhances and improves security while bringing advanced care to patients,” said cyber security expert Ann Barron DiCamillo, former director of U.S. CERT and advisor to St. Jude Medical’s Cyber Security Medical Advisory Board. “Today’s announcement is another demonstration that St. Jude Medical takes cyber security seriously and is continuously reassessing and updating its devices and systems, as appropriate."

Granted St. Jude Medical had previously received a bit of a nudge, and this isn't the first time the company's name has appeared in lights for the wrong reason. Security startup MedSec resorted to some creative tactics last year when it began shorting St. Jude Medical stock to try and highlight the company's abysmal security, after the traditional vulnerability reporting process failed to get the company's attention. At the time, MedSec Chief Executive Officer Justine Bone stated that the company consistently did little to nothing when vulnerabilities were reported:

"As far as we can tell, St. Jude Medical has done absolutely nothing to even meet minimum cybersecurity standards, in comparison to the other manufacturers we looked at that have made efforts," Bone said. There are steps St. Jude can take relatively quickly to protect patients, including changing the programming of implanted pacemakers and defibrillators through a method that would involve a doctor’s visit, she said."

St. Jude Medical's first response was an outright denial, followed by a lawsuit against MedSec for "trying to frighten patients and caregivers." Fast forward a few months, and St. Jude Medical is now trying to hold itself up as the poster child for proactive security and accountability. But the reality is that publicly shaming companies that can't be bothered to prioritize user security (even when human lives are at risk) appears to pay notable dividends.

Filed Under: fda, iot, merlin@home, pacemaker, security
Companies: st. jude medical

Security Startup MedSec Shorts St. Jude Medical Stock To Punish It For Flimsy Pacemaker Security

from the broken-workarounds-for-a-broken-system dept

The one-two punch of incompetent IT administrators and botched connected device security has resulted in an unsurprising spike in ransomeware attacks across the medical industry. And while the rise in easily hacked "smart" TVs, tea kettles, and kids toys is superficially funny in the consumer internet of things space, it's less amusing when you're a patient relying on poorly secured pace makers and essential medical equipment. But much like the internet of things space these devices are not only poorly secured, they're supported by companies that aren't very good at releasing timely security updates.

Case in point: a team of hackers working for cybersecurity startup MedSec found a bevy of flaws in medical devices sold by St. Jude Medical Inc, ranging from a lack of overall encryption to vulnerabilities letting unauthorized devices communicate with the company's pacemakers and defibrillators. And while we've talked about the threat of hackable pacemakers for more than a decade, hackers are increasingly worming their way into poorly secured radiology equipment, blood gas analyzers and other hospital and nursing home equipment to steal data for identity theft, giving the threat an added dimension.

According to MedSec Chief Executive Officer Justine Bone, St. Jude has a long history of implementing sub-standard security, and then doing little to nothing once these vulnerabilities are pointed out:

"As far as we can tell, St. Jude Medical has done absolutely nothing to even meet minimum cybersecurity standards, in comparison to the other manufacturers we looked at that have made efforts," Bone said. There are steps St. Jude can take relatively quickly to protect patients, including changing the programming of implanted pacemakers and defibrillators through a method that would involve a doctor’s visit, she said.

So MedSec tried something relatively unique. Historically, many hackers and security firms either contact companies to alert them to vulnerabilities, or try to sell the not-yet-public vulnerabilities to corporate espionage and security firms or government agencies, who then happily exploit any impacted, unpatched systems (in this case, with potentially fatal results). But MedSec did something notably different. It reached out to the Muddy Waters Capital LLC investment firm, suggesting a partnership to short sell St. Jude stock before reporting the vulnerabilities to the FDA. Under the deal, MedSec makes more money the further shares fall.

The report has been posted to the Muddy Waters website (pdf), with both companies standing to profit should the company's stock price take a tumble (which has already begun, with the stock dropping 12% before trading being halted). The timing is trouble for St. Jude, which is in the process of finalizing a potential $25 billion acquisition by Abbott Laboratories. MedSec, for what it's worth, says they only took this route because they believed St. Jude would either ignore the vulnerabilities or engage in legal hostilities:

"We were worried that they would sweep this under the rug or we would find ourselves in some sort of a hush litigation situation where patients were unaware of the risks they were facing," said Bone, an experienced security researcher and the former head of risk management for Bloomberg LP, the parent of Bloomberg News. "We partnered with Muddy Waters because they have a great history of holding large corporations accountable."

Unsurprisingly, the decision to punish St. Jude in this fashion immediately triggered an ethics debate in the hacker and security community. Some were quick to argue that failing to update necessary medical equipment was the real ethics violation. Some believe both St. Jude and Muddy Waters are being intentionally misleading for the sake of profit and marketing, and others are solely appalled by the short selling tactic itself. In the latter category sits security researcher Kenn White, who called the moved little more than "pure naked greed":Not too surprisingly, St. Jude was quick to issue a statement claiming MedSEC used "flawed test methodology on outdated software," demonstrating "lack of understanding of medical device technology.":

"We have examined the allegations made by Capital and MedSec on August 25, 2016 regarding the safety and security of our pacemakers and defibrillators, and while we would have preferred the opportunity to review a detailed account of the information, based on available information, we conclude that the report is false and misleading. Our top priority is to reassure our patients, caregivers and physicians that our devices are secure and to ensure ongoing access to the proven clinical benefits of remote monitoring. St. Jude Medical stands behind the security and safety of our devices as confirmed by independent third parties and supported through our regulatory submissions."

MedSec says it found two 0 day exploits opening pacemakers to attack, either by draining the battery or crashing the device software (both require being relatively close to the target). But the group also found that the company's pacemakers often use no encryption nor authentication over wireless, and the devices all use the same password to connect to the St Jude network, opening the door to a reverse engineering hack on the network at large. MedSec and Muddy Waters continue to insist the company's history indicates it would not have fixed the vulnerabilities in a timely fashion using traditional reporting methods and bounties.

Regardless of which side you believe is being more or less self-serving, punishing companies for their security incompetence using the only language they truly understand adds a massive and interesting new wrinkle in the never-ending debate over hacking ethics, and the over-arching quest to bring some accountability to companies still treating life-protecting security like an annoying afterthought.

Filed Under: cybersecurity, internet of things, pacemaker, security, short selling
Companies: medsec, muddy waters, st. jude medical