Drop the 0day. I'd say Anonymously, but not necessarily. If its an obvious bug, this isn't a moral issue at all. Had it been a multi stage, complicated exploit (hard to find and implement), I would suggest otherwise. In this case its a no brainer IMHO.
Can I drop a pacemaker 0day?
111–120 of 174 posts
Re: Can I drop a pacemaker 0day?
#112Earlier quoted context omitted.
Can you elaborate on how lawyers are "member[s] of the protection racket"?
The oft-recommended prudence of having a lawyer's advice for most any action in the public realm indicates a de facto protection racket. Specifically, the above comment references having a lawyer handle (and moderate) what should be open technical communication with the manufacturer and regulatory agencies, the implication being that simply disclosing facts put you at grave risk from an endlessly complex legal system…
1) You really shouldn't have an open conversation about knowledge that can easily kill people.
2) I'm pretty sure that communication isn't the problem, the problem is that he want's to pressure them into fixing their mess, and that is exactly the point where things get messy from a legal perspective. I can hardly imagine a legal system in which a situation like this would be unproblematic.
Re: Can I drop a pacemaker 0day?
#113Of course you can. Executing this type of attack would be more technically complex then executing a plain old murder, with say a simple gun.
Re: Can I drop a pacemaker 0day?
#114It's not quite "this could kill people" but rather "this could be used to kill someone." But there are a lot of things that one person could use against another person to kill them, ethically, what does adding this thing to the list change? If you discovered / disclosed a particular way the unit could malfunction and kill someone it seems like that's put in a different class; in that case you're a hero saving lives.…
This is a way to kill someone at a distance, with no obvious trace leading to you, and using nothing but an off the shelf laptop or phone. It's significantly more dangerous than any of the other known methods of murder because of the reduced risk to the murderer.
Re: Can I drop a pacemaker 0day?
#115Earlier quoted context omitted.
Then this is where the pressure needs to be applied - at the certification process. It needs to be made a legal requirement to attain certification (if not already), and the certifiers need to follow best practices for vulnerability detection. And it needs to be an ongoing, open process.
Yes, the FDA certification should include something along the lines of "Manufacturer has an ongoing process to evaluate new vulnerabilities and push updates to affected individuals."
It does, at least for new approvals post ~2012. Doesn't help existing devices in the field though.
Re: Can I drop a pacemaker 0day?
#116Earlier quoted context omitted.
And who pays the lawyer?
I expect that any savvy lawyer would be happy to take this pro bono. Think of how much free publicity they'd get for their practice.
Ah, excellent plan. That's a variation of a good old "you should write us an app / design a logo / sketch a website for free, just for all the exposure you get".
Re: Can I drop a pacemaker 0day?
#117@fiatmoney's comment seems like very good advice. Here's a link since it's very far below the fold:
Re: Can I drop a pacemaker 0day?
#118Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…
isn't that what weev did? he sure got arrested and prosecuted for it
Re: Can I drop a pacemaker 0day?
#119I call BS. How does an ECM (or anti-lock brake controller) "slam on the brakes"?
All cars produced for US sale after 2011 have mandatory traction control systems that work by modulating the brakes on a corner by corner basis. It's not inconceivable that this could be hacked.
Re: Can I drop a pacemaker 0day?
#120Earlier quoted context omitted.
I was a Funeral Director in a previous life. I would remove pacemakers if the deceased was to be cremated. We had bags of them. They are cheap and disposable, don't believe anyone that tells you otherwise. Go ask your local Funeral Director for one.
And you're in tech now? That's an interesting career transition. You might write it up sometime; I love stories like that.
[deleted]