Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can I drop a pacemaker 0day?

blog.erratasec.com

Post reply on HN
Print view View original

101–110 of 174 posts

Re: Can I drop a pacemaker 0day?

#101

Post by eitally »

droopyEyelids wrote: post #86
fiatmoney wrote: post #31

- Contact the FDA, or other regulatory bodies. - Contact the customers. They'll likely have standing to sue (they were sold a defective product). - Class-action attorneys may be interested for this reason. - Did you know you can pay a very, very modest amount of money to file a press release saying anything you want? - Contact some investors. Short sellers will have a vested interest in making sure the information ge…

I believe this comes closest to the proper answer. Eventually, we need technology literate courts, and a law that criminalizes failure to fix disclosed vulnerabilities. Until that day, the process you describe best achieves the same result.

I agree, and -- generally speaking -- OEMs take FDA compliance for Class III medical devices very seriously. If there is a regulation violation that could put patients at risk, the FDA would not hesitate to shut down production and force a fix, whether it's hardware or software.

(Speaking from the perspective of an IT guy at an electronics manufacturing company who is well versed in CFR 11 and medical validation.)

Re: Can I drop a pacemaker 0day?

#102

Post by brianpgordon »

mindslight wrote: post #60
jph wrote: post #41

Earlier quoted context omitted.

Terrible advice to pull a media stunt. First, you have no idea what the manufacturer needs to do to fix the problem, alert customers, do recalls and recertifications, and the like. Second, you put yourself directly in the line of fire unnecessarily and for all the wrong reasons. You could find yourself on the end of all kinds of legal trouble, and on top of that you would be morally culpable for any harm. Do it the r…

> get a lawyer Because this is the world we should want to live in? Where you must pay a member of the protection racket to mediate publishing knowledge of someone else's extreme wrongdoing? That is terrible advice. Its road ends with TORified disclosures of weaponized automated exploits, because as pure info sec has shown, that's the only way the message ever gets across when you give people the insulation to not li…

People say that because a lawyer can really, really help you in your cause. The law is byzantine and someone who can navigate it and act as an advisor could make a big difference.

Re: Can I drop a pacemaker 0day?

#103

Post by nl »

redthrowaway wrote: post #14

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

I'd imagine the correct thing to do is use the FDA's "MedWatch Online Voluntary Reporting Form".

Use the MedWatch form to report adverse events that you observe or suspect for human medical products, including serious drug side effects, product use errors, product quality problems, and therapeutic failures for:... Medical devices (including in vitro diagnostic products)

[1] https://www.accessdata.fda.gov/scripts/medwatch/

Re: Can I drop a pacemaker 0day?

#104

Post by nl »

redthrowaway wrote: post #14

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

I'd suggest contacting Andrea Peterson at the Washington Post, and letting her know you have a follow up story for her piece on how Dick Cheneys had the wireless on his pacemaker disabled[1].

[1] http://www.washingtonpost.com/blogs/the-switch/wp/2013/10/21...

Re: Can I drop a pacemaker 0day?

#105

Post by qbrass »

redthrowaway wrote: post #14

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

This might sound pedantic, but don't say "I can now kill your grandmother," it makes you look evil instead of the company you're trying to shame.

BIOTRONIC releasing the patch they should have released anyway, just to stop your evil scheme of murdering the elderly, turns into a PR win for them.

Re: Can I drop a pacemaker 0day?

#106

Post by psychometry »

kevinchen wrote: post #57
psychometry wrote: post #37

Earlier quoted context omitted.

There's no need to call CNN. We have Youtube now, which would arguably be a more effective medium if the video can achieve any level of virality.

I'd guess the demographic that cares about this does not go on YouTube enough to make it more effective.

Is there a demographic left that doesn't go on YouTube?

Re: Can I drop a pacemaker 0day?

#107

Post by chaostheory »

firloop wrote: post #4

This is the most important problem that the internet of things faces. How can we network everything while maintaining at least some scrap of security, especially in the long term? How can we convince people that their toaster is worth patching, and, more importantly, how to we convince vendors that toasters are worth releasing patches for? What if appliance makers go bankrupt and your dishwasher no longer receives pa…

Yeah you can't trust Belkin's WeMo line for light switches, and yet they are coming out with integration with things like crock posts and humidifiers soon. This is very scary.

Re: Can I drop a pacemaker 0day?

#108

Post by hackuser »

Of course, don't publicize it.

But consider a though experiment: From a security perspective, does it really increase risk? There are many ways to kill someone that are much simpler than figuring out what pacemaker they have, finding a 0day, designing an attack and implementing it. This vulnerability doesn't necessarily increase the risk that someone will be murdered.

EDIT: Or if you want to attack the pacemaker, use radiation from microwaves or similar devices. At least according to signs posted in many places, they are dangerous to users of pacemakers.

Re: Can I drop a pacemaker 0day?

#109

Post by duaneb »

croggle wrote: post #12
david_shaw wrote: post #5

Here's an idea: 1.) Responsible disclosure to vendor. Allow reasonable amount of time for a fix to be created and deployed. 2.) (If fix is deployed, release details) 3.) If no fix is deployed in a reasonable amount of time and the vendor is unresponsive, release a PoC that demonstrates exploitability without giving away details. eg: "Here is a pacemaker. Look, I did magic and it stopped!" This is the same idea as rel…

What does 'fix deployed' mean? How do you actually update pacemaker software? Are you going to wait for 100% of the deployed pacemakers are fixed? What is an acceptable fix rate before you release the exploit?

I think you should assume people will reverse engineer patches as soon as they are public. People should treat this like any urgent medical care and address it within hours or days of the patch being available. I don't know much about that area of the industry, but I don't envy it at all. Imagining being the person responsible for a) enabling remote communication, b) allowing updates via remote communication, and c) securing it. What a nightmare situation.

Re: Can I drop a pacemaker 0day?

#110

Post by duaneb »

fiatmoney wrote: post #31

- Contact the FDA, or other regulatory bodies. - Contact the customers. They'll likely have standing to sue (they were sold a defective product). - Class-action attorneys may be interested for this reason. - Did you know you can pay a very, very modest amount of money to file a press release saying anything you want? - Contact some investors. Short sellers will have a vested interest in making sure the information ge…

What is legality regarding the investors shorting?
Post reply on HN