Live data from Hacker News

Can I drop a pacemaker 0day?

blog.erratasec.com

21–30 of 174 posts

Re: Can I drop a pacemaker 0day?

#21
post #7

Absolutely NOT because this could kill people. If you truly have a pacemaker 0day, contact me (joelparkerhenderson) on most major service and I will connect you with my healthcare policy lawyer. She can rapidly open the doors to the vendors who have the risk.

Do most medical device manufacturers carry insurance against lawsuits? If so, historically, how high has the bar been before the insurers pay out? If there is a strong relationship between a device manufacturer getting sued and an insurer losing money then this could be a great contact to try.

Yes, but more importantly, medical device makers have broad immunity when their devices go through the PMA process (the most stringent type of FDA approval). Basically, the argument is "hey, the FDA said it was safe".

Re: Can I drop a pacemaker 0day?

#22

The ONLY people who need to know about this is the manufacturer and their regulatory body FDA, etc. The company can then pull all the inventory that is in and out of the patients and apply fixes or facilitate replacements. If this could kill people, I'd hope the above ideas would be obvious...but well I know they won't be to everyone.

Correct, it's not obvious to me. If there is a flare in my medical device, I want you to tell me about it...

It's amazing to me that you think I'm not entitled to know there's a problem. Do you also believe I shouldn't be informed if the lock on my door doesn't work? You must hate those consumer watchdog shows!

If someone is capable and willing to kill Mr with a pacemaker bug, they likely already have the skills to find the bug. Not telling me just withholds the opportunity for me to protect myself (stay indoors? Contact doctor, etc).

Re: Can I drop a pacemaker 0day?

#23
post #6

What pacemaker communicates via blue tooth? Last I checked they all used induction telemetry (which requires the telemetry wand to be within several inches of the device) or MICS band radio for distance telemetry. I think some Boston Scientific devices used 900MHz at one time, but how many of those are still in the wild? The only instances of "hacking" a pacemaker (or ICD) have been when researchers used a programmer…

Indeed, all pacers I know of don't have Bluetooth comms precisely because of the potential for vulnerabilities.

(I used to work for a pacer company)

Re: Can I drop a pacemaker 0day?

#25

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

Now THAT is how you do it. Grab a "shock of the week" angle and play it for anyone that wants to watch. Only issue is getting a "non-defective" pacemaker. Those things aren't cheap or easy to come by without ordering it from the manufacturer. Whatever profit you could have shorting the stock you'd lose almost immediately by having to purchase the devise.

I was a Funeral Director in a previous life. I would remove pacemakers if the deceased was to be cremated. We had bags of them. They are cheap and disposable, don't believe anyone that tells you otherwise. Go ask your local Funeral Director for one.

Re: Can I drop a pacemaker 0day?

#27

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

Also, be prepared to be labeled a murderous hacker.

Re: Can I drop a pacemaker 0day?

#28
post #25

Earlier quoted context omitted.

Now THAT is how you do it. Grab a "shock of the week" angle and play it for anyone that wants to watch. Only issue is getting a "non-defective" pacemaker. Those things aren't cheap or easy to come by without ordering it from the manufacturer. Whatever profit you could have shorting the stock you'd lose almost immediately by having to purchase the devise.

I was a Funeral Director in a previous life. I would remove pacemakers if the deceased was to be cremated. We had bags of them. They are cheap and disposable, don't believe anyone that tells you otherwise. Go ask your local Funeral Director for one.

And you're in tech now? That's an interesting career transition. You might write it up sometime; I love stories like that.

Re: Can I drop a pacemaker 0day?

#29

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

Now THAT is how you do it. Grab a "shock of the week" angle and play it for anyone that wants to watch. Only issue is getting a "non-defective" pacemaker. Those things aren't cheap or easy to come by without ordering it from the manufacturer. Whatever profit you could have shorting the stock you'd lose almost immediately by having to purchase the devise.

How did ErrataSec find (or verify) this vulnerability if they didn't have access to the pacemaker?

I'm assuming no pacemaker owners were harmed in the finding of this vulnerability.

Re: Can I drop a pacemaker 0day?

#30

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

Don't you need surgery to fix it?
Post reply on HN