Live data from Hacker News

Can I drop a pacemaker 0day?

blog.erratasec.com

31–40 of 174 posts

Re: Can I drop a pacemaker 0day?

#31
- Contact the FDA, or other regulatory bodies.

- Contact the customers. They'll likely have standing to sue (they were sold a defective product).

- Class-action attorneys may be interested for this reason.

- Did you know you can pay a very, very modest amount of money to file a press release saying anything you want?

- Contact some investors. Short sellers will have a vested interest in making sure the information gets widely publicised.

Re: Can I drop a pacemaker 0day?

#33
When there is a flaw in a car seat or child's toy everyone flips shit and recalls start happening. It's covered on the local news and all that. Why doesn't that happen for pace makers? Isn't this a problem for the Consumer Product Safety Commission or the FDA?

It's a product that has a flaw. Seems like it qualifies for a public recall.

Re: Can I drop a pacemaker 0day?

#34
post #26

Wasn't Barnaby Jack going to unveil a Pace Maker 0day last year before he [mysteriously] died?

He didn't mysteriously die. There are several people on HN that knew him personally, and there's been a lot of creepy not-even-wrong speculation about what happened to him. None of his friends appreciate it.

Re: Can I drop a pacemaker 0day?

#35
Ideally, there would be some way to disclose this kind of info to whatever government regulatory agency is responsible for approving these things. In your situation, you have to worry that whoever you disclose this to is going to act irrationally, and governments exist to mediate between irrational actors for the benefit of the public.

Re: Can I drop a pacemaker 0day?

#36
post #7

Absolutely NOT because this could kill people. If you truly have a pacemaker 0day, contact me (joelparkerhenderson) on most major service and I will connect you with my healthcare policy lawyer. She can rapidly open the doors to the vendors who have the risk.

The question isn't whether it could kill people, but whether it would kill fewer people than not releasing the exploit.

(Though even if you were sure fewer people would die it would still be an ethical conundrum)

Re: Can I drop a pacemaker 0day?

#37

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

There's no need to call CNN. We have Youtube now, which would arguably be a more effective medium if the video can achieve any level of virality.

Re: Can I drop a pacemaker 0day?

#38

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

I understand that this isn't the purview of yellow journalism, but to be accurate, the statement should be: "I can now kill your grandmother just by walking past her on the street, and asking her to stand still while I hold an induction wand quite close to her pacemaker"

Re: Can I drop a pacemaker 0day?

#39
post #22

The ONLY people who need to know about this is the manufacturer and their regulatory body FDA, etc. The company can then pull all the inventory that is in and out of the patients and apply fixes or facilitate replacements. If this could kill people, I'd hope the above ideas would be obvious...but well I know they won't be to everyone.

Correct, it's not obvious to me. If there is a flare in my medical device, I want you to tell me about it... It's amazing to me that you think I'm not entitled to know there's a problem. Do you also believe I shouldn't be informed if the lock on my door doesn't work? You must hate those consumer watchdog shows! If someone is capable and willing to kill Mr with a pacemaker bug, they likely already have the skills to f…

You should definitely be informed there is a serious issue. Whether you (and everyone else) should be given instructions how to duplicate that issue is a different matter.

Re: Can I drop a pacemaker 0day?

#40
post #34
post #26

Wasn't Barnaby Jack going to unveil a Pace Maker 0day last year before he [mysteriously] died?

He didn't mysteriously die. There are several people on HN that knew him personally, and there's been a lot of creepy not-even-wrong speculation about what happened to him. None of his friends appreciate it.

I was referring to the timing of things. But yes, I don't disagree. He did some very brilliant work.
Post reply on HN