Can I drop a pacemaker 0day? • Hacker News Board

Re: Can I drop a pacemaker 0day?

#41

Post by jph » Thu, Jun 05, 2014, 2:01 AM UTC

redthrowaway wrote: post #14

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

Terrible advice to pull a media stunt.

First, you have no idea what the manufacturer needs to do to fix the problem, alert customers, do recalls and recertifications, and the like.

Second, you put yourself directly in the line of fire unnecessarily and for all the wrong reasons. You could find yourself on the end of all kinds of legal trouble, and on top of that you would be morally culpable for any harm.

Do it the right way: get a lawyer. The lawyer will know how to contact the vendors, the regulatory agencies, media if necessary, and customers if necessary.

Re: Can I drop a pacemaker 0day?

#42

Post by tuaz » Thu, Jun 05, 2014, 2:01 AM UTC

I would snap insta do it for the fame and future business opportunities alone.

Re: Can I drop a pacemaker 0day?

#43

Post by BorisMelnik » Thu, Jun 05, 2014, 2:01 AM UTC

was really sketchy when it happened on homeland

http://vimeo.com/63176830

Re: Can I drop a pacemaker 0day?

#44

Post by rmcpherson » Thu, Jun 05, 2014, 2:04 AM UTC

croggle wrote: post #12

david_shaw wrote: post #5

Here's an idea: 1.) Responsible disclosure to vendor. Allow reasonable amount of time for a fix to be created and deployed. 2.) (If fix is deployed, release details) 3.) If no fix is deployed in a reasonable amount of time and the vendor is unresponsive, release a PoC that demonstrates exploitability without giving away details. eg: "Here is a pacemaker. Look, I did magic and it stopped!" This is the same idea as rel…

What does 'fix deployed' mean? How do you actually update pacemaker software? Are you going to wait for 100% of the deployed pacemakers are fixed? What is an acceptable fix rate before you release the exploit?

Pacemaker firmware can almost always be updated using inductive or rf telemetry. In most cases it still requires an appointment with a cardiologist or similar physician though.

Re: Can I drop a pacemaker 0day?

#45

Post by kennywinker » Thu, Jun 05, 2014, 2:06 AM UTC

jph wrote: post #41

redthrowaway wrote: post #14

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

Terrible advice to pull a media stunt. First, you have no idea what the manufacturer needs to do to fix the problem, alert customers, do recalls and recertifications, and the like. Second, you put yourself directly in the line of fire unnecessarily and for all the wrong reasons. You could find yourself on the end of all kinds of legal trouble, and on top of that you would be morally culpable for any harm. Do it the r…

I think OP is suggesting reveal the effect, but don't reveal the cause. That's what makes the suggestion different from releasing an 0day

Re: Can I drop a pacemaker 0day?

#46

Post by dsuth » Thu, Jun 05, 2014, 2:08 AM UTC

seehafer wrote: post #21

iandanforth wrote: post #9

Earlier quoted context omitted.

Do most medical device manufacturers carry insurance against lawsuits? If so, historically, how high has the bar been before the insurers pay out? If there is a strong relationship between a device manufacturer getting sued and an insurer losing money then this could be a great contact to try.

Yes, but more importantly, medical device makers have broad immunity when their devices go through the PMA process (the most stringent type of FDA approval). Basically, the argument is "hey, the FDA said it was safe".

Then this is where the pressure needs to be applied - at the certification process. It needs to be made a legal requirement to attain certification (if not already), and the certifiers need to follow best practices for vulnerability detection. And it needs to be an ongoing, open process.

Re: Can I drop a pacemaker 0day?

#47

Post by redthrowaway » Thu, Jun 05, 2014, 2:13 AM UTC

vacri wrote: post #38

redthrowaway wrote: post #14

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

I understand that this isn't the purview of yellow journalism, but to be accurate, the statement should be: "I can now kill your grandmother just by walking past her on the street, and asking her to stand still while I hold an induction wand quite close to her pacemaker"

You got me thinking, so I looked up the protocols used. It's apparently not nearly that complex or limited:

http://www.secure-medicine.org/public/publications/icd-study...

http://en.wikipedia.org/wiki/Medical_Implant_Communication_S...

Re: Can I drop a pacemaker 0day?

#48

Post by polarix » Thu, Jun 05, 2014, 2:14 AM UTC

jph wrote: post #41

redthrowaway wrote: post #14

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

Terrible advice to pull a media stunt. First, you have no idea what the manufacturer needs to do to fix the problem, alert customers, do recalls and recertifications, and the like. Second, you put yourself directly in the line of fire unnecessarily and for all the wrong reasons. You could find yourself on the end of all kinds of legal trouble, and on top of that you would be morally culpable for any harm. Do it the r…

And who pays the lawyer?

Re: Can I drop a pacemaker 0day?

#49

Post by JunkDNA » Thu, Jun 05, 2014, 2:15 AM UTC

In the case of medical devices, this is squarely in the FDA's wheelhouse in the USA. The FDA likely lacks the people with appropriate expertise to evaluate these kinds of safety issues because their traditional focus has been on the more typical kinds of medical device risk. A concerted effort at dialog with them could turn that around. Particularly if it were done through a series of academic workshops with key people.

Re: Can I drop a pacemaker 0day?

#50

Post by pbhjpbhj » Thu, Jun 05, 2014, 2:19 AM UTC

ntrepid8 wrote: post #6

What pacemaker communicates via blue tooth? Last I checked they all used induction telemetry (which requires the telemetry wand to be within several inches of the device) or MICS band radio for distance telemetry. I think some Boston Scientific devices used 900MHz at one time, but how many of those are still in the wild? The only instances of "hacking" a pacemaker (or ICD) have been when researchers used a programmer…

>The only instances of "hacking" a pacemaker [...] //

Someone has linked a PDF of an "ICD study" upthread that shows your contention to be at least partially false.