Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can I drop a pacemaker 0day?

blog.erratasec.com

Post reply on HN
Print view View original

161–170 of 174 posts

Re: Can I drop a pacemaker 0day?

#161

Post by fiatmoney »

duaneb wrote: post #110
fiatmoney wrote: post #31

- Contact the FDA, or other regulatory bodies. - Contact the customers. They'll likely have standing to sue (they were sold a defective product). - Class-action attorneys may be interested for this reason. - Did you know you can pay a very, very modest amount of money to file a press release saying anything you want? - Contact some investors. Short sellers will have a vested interest in making sure the information ge…

What is legality regarding the investors shorting?

It's not insider trading; you have no relationship with the company that establishes a responsibility to keep their secrets (might be a different story if you, eg, paid an insider for the information). For that matter the device as it's handed to the public is public information. It's no different than discovering your hamburger is poisoned and shorting McDonald's.

Re: Can I drop a pacemaker 0day?

#162

Post by fiatmoney »

jacquesm wrote: post #128
duaneb wrote: post #110

Earlier quoted context omitted.

What is legality regarding the investors shorting?

Since it's on HN you could technically argue that it is now publicly known. If you short the stock past this point you may well be in the clear.

There's no requirement for information to be "publicly known" to trade on it. You have to be an "insider" for it to be insider trading - ie, there has to be some relationship of trust (eg an employee or officer, or in some circumstances people they "tip off").

Re: Can I drop a pacemaker 0day?

#163

Post by mmcdan »

tptacek wrote: post #28
_mgr wrote: post #25

Earlier quoted context omitted.

I was a Funeral Director in a previous life. I would remove pacemakers if the deceased was to be cremated. We had bags of them. They are cheap and disposable, don't believe anyone that tells you otherwise. Go ask your local Funeral Director for one.

And you're in tech now? That's an interesting career transition. You might write it up sometime; I love stories like that.

I echo this sentiment. Would love to hear about your path to tech.

Re: Can I drop a pacemaker 0day?

#164

Post by redthrowaway »

nl wrote: post #103
redthrowaway wrote: post #14

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

I'd imagine the correct thing to do is use the FDA's "MedWatch Online Voluntary Reporting Form". Use the MedWatch form to report adverse events that you observe or suspect for human medical products, including serious drug side effects, product use errors, product quality problems, and therapeutic failures for:... Medical devices (including in vitro diagnostic products) [1] https://www.accessdata.fda.gov/scripts/medw…

That strikes me as a system that was set up with the best intentions, but which in practice acts as a barrier to, rather than facilitator of, change. The only way I can see it compelling a manufacturer to change is if someone is killed by this exploit and their family uses the existence of a report of that vulnerability to push for massive willful negligence damages in a lawsuit.

Re: Can I drop a pacemaker 0day?

#165

Post by blafunke »

redthrowaway wrote: post #14

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

But first have some skepticism. You can't interface with a PM without direct contact with a patient. Pacemakers are not bluetooth enabled wifi connected internet appliances. Yes, they are programmed remotely, but in this case remote means a reader device that must be physically placed on a person directly over the pacemaker. While there are things to be legitmately concerned about, this article is a wild fantasy.

Re: Can I drop a pacemaker 0day?

#166

Post by blafunke »

tlrobinson wrote: post #29
wheaties wrote: post #16

Earlier quoted context omitted.

Now THAT is how you do it. Grab a "shock of the week" angle and play it for anyone that wants to watch. Only issue is getting a "non-defective" pacemaker. Those things aren't cheap or easy to come by without ordering it from the manufacturer. Whatever profit you could have shorting the stock you'd lose almost immediately by having to purchase the devise.

How did ErrataSec find (or verify) this vulnerability if they didn't have access to the pacemaker? I'm assuming no pacemaker owners were harmed in the finding of this vulnerability.

It seems to me this article is a fantasy. A what if scenario. I don't think this guy really knows pacemakers at all frankly. A bluetooth enabled pacemaker seems far fetched and to my knowledge such a thing does not exist. Pacemakers require the reader device to be in contact with the patient directly over the pacemaker, the range is that limited.

Re: Can I drop a pacemaker 0day?

#167

Post by blafunke »

redthrowaway wrote: post #47
vacri wrote: post #38

Earlier quoted context omitted.

I understand that this isn't the purview of yellow journalism, but to be accurate, the statement should be: "I can now kill your grandmother just by walking past her on the street, and asking her to stand still while I hold an induction wand quite close to her pacemaker"

You got me thinking, so I looked up the protocols used. It's apparently not nearly that complex or limited: http://www.secure-medicine.org/public/publications/icd-study... http://en.wikipedia.org/wiki/Medical_Implant_Communication_S...

No, original commenter is correct. You'd need contact with your victim, you have to hold a reader device directly over the pacemaker. Really you may as well stab them.

Re: Can I drop a pacemaker 0day?

#168

Post by aaronbrethorst »

baddox wrote: post #131
aaronbrethorst wrote: post #56

Earlier quoted context omitted.

I expect that any savvy lawyer would be happy to take this pro bono. Think of how much free publicity they'd get for their practice.

I see a lot of people on the Internet implying that there are plenty of lawyers just sitting around waiting for interesting and potentially high profile cases to take on for free. I've never seen any evidence of this, and I suspect there are very few.

http://www2.nycbar.org/mp3/DoingWellByDoingGood/pbi_business...

    Major pro bono matters, or smaller cases with great
    human interest, are far more likely to receive extensive
    coverage. Holland & Knight, for example, received highly
    favorable and extensive coverage of its work in the
    Rosewood case, including a glowing front page, above the
    fold, article in the Wall Street Journal and People.

    Hogan & Hartson, similarly, received a great deal of
    play in the media concerning its representation of
    African-American plaintiffs alleging that Denny’s
    restaurants had discriminated against them. In both
    instances, the firms undertook these time-consuming,
    controversial cases because it was the right thing to
    do. However, their creative, successful lawyering
    became a front-page story.

Re: Can I drop a pacemaker 0day?

#169

Post by aroch »

Qualman wrote: post #158
mindslight wrote: post #60

Earlier quoted context omitted.

> get a lawyer Because this is the world we should want to live in? Where you must pay a member of the protection racket to mediate publishing knowledge of someone else's extreme wrongdoing? That is terrible advice. Its road ends with TORified disclosures of weaponized automated exploits, because as pure info sec has shown, that's the only way the message ever gets across when you give people the insulation to not li…

Claiming a medical company's life-saving device will kill your family on national news will almost without a doubt land you on the receiving end of a libel lawsuit, warranted or not. Not having to use lawyers would be nice, but it's not happening in this paradigm. This is a naïve response.

That's what anti-SLAPP laws are for.

Re: Can I drop a pacemaker 0day?

#170

Post by blafunke »

vacri wrote: post #38
redthrowaway wrote: post #14

Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…

I understand that this isn't the purview of yellow journalism, but to be accurate, the statement should be: "I can now kill your grandmother just by walking past her on the street, and asking her to stand still while I hold an induction wand quite close to her pacemaker"

I'd like to know how hard (or easy) it would be to fool a PM into causing and unsafe fast heartbeat. I would imagine there are safeguards at a low level against such a fault. The easiest thing for a PM hacker to do, assuming they have close physical contact with the victim, would be to shut off the pacemaker and in most cases that would not do much more than cause dizziness or fainting.
Post reply on HN