Live data from Hacker News

Can I drop a pacemaker 0day?

blog.erratasec.com

131–140 of 174 posts

Re: Can I drop a pacemaker 0day?

#131
post #48

Earlier quoted context omitted.

And who pays the lawyer?

I expect that any savvy lawyer would be happy to take this pro bono. Think of how much free publicity they'd get for their practice.

I see a lot of people on the Internet implying that there are plenty of lawyers just sitting around waiting for interesting and potentially high profile cases to take on for free. I've never seen any evidence of this, and I suspect there are very few.

Re: Can I drop a pacemaker 0day?

#132

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

If you attempt a stunt like this, please first consider the people who have these pacemakers in their bodies. Put yourself in their shoes as they're watching the news broadcast or getting a frantic call from a family member. Let's say one of them panics out of fear, has a heart attack, and dies. The family reports this to the media. Now the news media is hunting you down. The authorities want to have a word with you,…

> If you attempt a stunt like this, please first consider the people who have these pacemakers in their bodies. Put yourself in their shoes as they're watching the news broadcast or getting a frantic call from a family member.

The whole idea is to handle this knowledge in the way that leads to the least hardship/pain/death. It's quite possible that a "stunt" like this is the best way, especially considering that there will likely be other less virtuous people making this discovery on their own soon.

Re: Can I drop a pacemaker 0day?

#136

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

If you attempt a stunt like this, please first consider the people who have these pacemakers in their bodies. Put yourself in their shoes as they're watching the news broadcast or getting a frantic call from a family member. Let's say one of them panics out of fear, has a heart attack, and dies. The family reports this to the media. Now the news media is hunting you down. The authorities want to have a word with you,…

> Technically speaking, the device manufacturer hasn't hurt anyone at this point. But you've contributed to the death of a person. Is that really what you're after?

I agree that this could happen, but the obvious argument is that technically the device manufacturer did just kill their customers by 1) selling them a defective product; and 2) failing to take the opportunity to fix it when notified.

Re: Can I drop a pacemaker 0day?

#137
post #129

Earlier quoted context omitted.

1) You really shouldn't have an open conversation about knowledge that can easily kill people. 2) I'm pretty sure that communication isn't the problem, the problem is that he want's to pressure them into fixing their mess, and that is exactly the point where things get messy from a legal perspective. I can hardly imagine a legal system in which a situation like this would be unproblematic.

> 1) You really shouldn't have an open conversation about knowledge that can easily kill people. You mean like guns, toxins, and martial arts?

Don't forget vehicles, diseases, sudden deceleration, falls, drops and darwin award winning behaviour.

It's important that people be aware of the risks they face, and seeking to silence that conversation is not helpful. If anything, it will create an environment where any perpetators might go unpunished because it's just implausible they did what they did.

Re: Can I drop a pacemaker 0day?

#138
post #131

Earlier quoted context omitted.

I expect that any savvy lawyer would be happy to take this pro bono. Think of how much free publicity they'd get for their practice.

I see a lot of people on the Internet implying that there are plenty of lawyers just sitting around waiting for interesting and potentially high profile cases to take on for free. I've never seen any evidence of this, and I suspect there are very few.

[deleted]

Re: Can I drop a pacemaker 0day?

#139
There seems to be this idea embedded in human minds that there is a group of people who are just waiting to kill someone, and the fact that they have not yet found a way of doing it is the only thing preventing them from doing so. As soon as you show them that you can do it by hacking a pacemaker, they will go ahead and do it.

There is no shortage of methods of killing someone or inflicting bodily harm. As far as moral culpability, showing how a 0day exploit can be used to kill a person is akin to saying that you can use arsenic to kill grandma.

Re: Can I drop a pacemaker 0day?

#140

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

That will land him in prison. Have you learned nothing?! Think AT&T - and that's just frigging phone info. For this, they'll tar him a terrorist and throw him in a hole to die.
Post reply on HN