Live data from Hacker News

Can I drop a pacemaker 0day?

blog.erratasec.com

121–130 of 174 posts

Re: Can I drop a pacemaker 0day?

#121
post #28
post #25

Earlier quoted context omitted.

I was a Funeral Director in a previous life. I would remove pacemakers if the deceased was to be cremated. We had bags of them. They are cheap and disposable, don't believe anyone that tells you otherwise. Go ask your local Funeral Director for one.

And you're in tech now? That's an interesting career transition. You might write it up sometime; I love stories like that.

Agreed. I'm intrigued.

Re: Can I drop a pacemaker 0day?

#122
post #41

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

Terrible advice to pull a media stunt. First, you have no idea what the manufacturer needs to do to fix the problem, alert customers, do recalls and recertifications, and the like. Second, you put yourself directly in the line of fire unnecessarily and for all the wrong reasons. You could find yourself on the end of all kinds of legal trouble, and on top of that you would be morally culpable for any harm. Do it the r…

> you would be morally culpable for any harm

Guns don't kill people...

Re: Can I drop a pacemaker 0day?

#123
post #41

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

Terrible advice to pull a media stunt. First, you have no idea what the manufacturer needs to do to fix the problem, alert customers, do recalls and recertifications, and the like. Second, you put yourself directly in the line of fire unnecessarily and for all the wrong reasons. You could find yourself on the end of all kinds of legal trouble, and on top of that you would be morally culpable for any harm. Do it the r…

I wonder if a lawyer really caring about his client wouldn't straight up say "just forget about it".

If the company you're criticising doesn't like critics, doesn't care about bad PR, and has to feed their lawyers, you won't have a good time any way you do it.

Some rare occasions you might be better off with a strong public opinion supporting you and people coming out of the bush to help your case, than trying to do it the sneaky way and still get caught in a hell of legal troubles that not much people really heard of, and you get cast as the little guy trying too pull money from the big corp because of the narrative sold to the media by your opponent.

Re: Can I drop a pacemaker 0day?

#124
Pacemakers have a remote exploit bug ? If you can get this close to my heart, you might as well stick a knife in it. The only difference is the one will look like a failed pacemaker and the other will look like murder.

Re: Can I drop a pacemaker 0day?

#126

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

No need to involve the media. Call the police, and make an anonymous death threat towards a well-known person with a pacemaker. They will have to investigate. Then send them your POC anonymously.

Re: Can I drop a pacemaker 0day?

#127
Solution I find is relatively simple from a moral standpoint. Exhaust all options. Instead of saying 'ah it won't work', just do it anyway, contact anyone and everyone , privately related to this, about this and do everything you possibly can before press exposure. With the press you can demonstrate but not release the actual steps to how it's done. If it is still denied as fake or ignored despite all of that, release it if you feel the moral obligation to do so. 'You must do what you think is right, of course'.

Re: Can I drop a pacemaker 0day?

#128
post #110

- Contact the FDA, or other regulatory bodies. - Contact the customers. They'll likely have standing to sue (they were sold a defective product). - Class-action attorneys may be interested for this reason. - Did you know you can pay a very, very modest amount of money to file a press release saying anything you want? - Contact some investors. Short sellers will have a vested interest in making sure the information ge…

What is legality regarding the investors shorting?

Since it's on HN you could technically argue that it is now publicly known. If you short the stock past this point you may well be in the clear.

Re: Can I drop a pacemaker 0day?

#129

Earlier quoted context omitted.

The oft-recommended prudence of having a lawyer's advice for most any action in the public realm indicates a de facto protection racket. Specifically, the above comment references having a lawyer handle (and moderate) what should be open technical communication with the manufacturer and regulatory agencies, the implication being that simply disclosing facts put you at grave risk from an endlessly complex legal system…

1) You really shouldn't have an open conversation about knowledge that can easily kill people. 2) I'm pretty sure that communication isn't the problem, the problem is that he want's to pressure them into fixing their mess, and that is exactly the point where things get messy from a legal perspective. I can hardly imagine a legal system in which a situation like this would be unproblematic.

> 1) You really shouldn't have an open conversation about knowledge that can easily kill people.

You mean like guns, toxins, and martial arts?

Re: Can I drop a pacemaker 0day?

#130
post #123
post #41

Earlier quoted context omitted.

Terrible advice to pull a media stunt. First, you have no idea what the manufacturer needs to do to fix the problem, alert customers, do recalls and recertifications, and the like. Second, you put yourself directly in the line of fire unnecessarily and for all the wrong reasons. You could find yourself on the end of all kinds of legal trouble, and on top of that you would be morally culpable for any harm. Do it the r…

I wonder if a lawyer really caring about his client wouldn't straight up say "just forget about it". If the company you're criticising doesn't like critics, doesn't care about bad PR, and has to feed their lawyers, you won't have a good time any way you do it. Some rare occasions you might be better off with a strong public opinion supporting you and people coming out of the bush to help your case, than trying to do…

[deleted]
Post reply on HN