Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Interoperable Telesurgery Protocol Plaintext Unauthenticated MitM Hijacking

osvdb.org

Post reply on HN
Print view View original

21–30 of 33 posts

Re: Interoperable Telesurgery Protocol Plaintext Unauthenticated MitM Hijacking

#21

Post by tedunangst »

jasonjei wrote: post #20
tedunangst wrote: post #19

Earlier quoted context omitted.

Are you confident that telesurgery developers are better at encryption and authentication than VPN developers?

No, did I imply so? Just saying that I have very little confidence in the bot. I'm saying the intrinsic security flaw of the robot allows me to believe there are more serious defects. These do not need to be security related. The test cases not passing could lead to death. I've made no commentary on VPN. Just commenting the communication protocol without augmentations (VPN, TLS, certificate, or otherwise) instills li…

I'm afraid I don't see the connection between the decision not to implement encryption and the presence of death causing defects.

Re: Interoperable Telesurgery Protocol Plaintext Unauthenticated MitM Hijacking

#22

Post by jasonjei »

tedunangst wrote: post #21
jasonjei wrote: post #20

Earlier quoted context omitted.

No, did I imply so? Just saying that I have very little confidence in the bot. I'm saying the intrinsic security flaw of the robot allows me to believe there are more serious defects. These do not need to be security related. The test cases not passing could lead to death. I've made no commentary on VPN. Just commenting the communication protocol without augmentations (VPN, TLS, certificate, or otherwise) instills li…

I'm afraid I don't see the connection between the decision not to implement encryption and the presence of death causing defects.

> I'm afraid I don't see the connection between the decision not to implement encryption and the presence of death causing defects.

That's fine. Everyone is entitled to his/her opinion. I view the failure to implement encryption as a fatal error and an indication the code audit hasn't been thorough. Given that this is a telesurgery product, I'm quite confident encryption, trust, and authenticity are central to safe medical procedures carried over network. Otherwise, why would we bother with TLS when we access our online banking?

I'm just not confident I would want to undergo a surgery with a telesurgery robot with the "decision not to implement encryption."

Re: Interoperable Telesurgery Protocol Plaintext Unauthenticated MitM Hijacking

#23

Post by virgil_disgr4ce »

Did some digging on this. Basically: 1) Some researchers wrote a paper called "Preliminary protocol for interoperable telesurgery" in 2009. (http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.160...) 2) At the end of the paper, they write: "Also, security is an obvious requirement for real world adoption of this kind of service." 3) Last month, some other people showed that you could hax0r this unprotected protocol: http://www.technologyreview.com/view/537001/security-experts...

So in other words, somebody demonstrated that a preliminary protocol that admitted it didn't have any security was insecure. Woo!

Re: Interoperable Telesurgery Protocol Plaintext Unauthenticated MitM Hijacking

#24

Post by jasonjei »

thirsteh wrote: post #13
tptacek wrote: post #8

Earlier quoted context omitted.

Why is that a "temporary" fix? Segregating insecure protocols to VPNs, encrypted tunnels, and backchannel networks is one of the oldest most time-honored tools in the security design toolbox. Not only is it a real fix, but it's probably the right fix.

You must not have gotten the memo: Google exposed some of their corporate systems to everyone, therefore VPNs are now useless and have always been useless. :)

Agreed. Trusting VPNs to be totally secure, especially on a big organization like a hospital, seems insane. At the surgery level, you want to make sure the malware infected laptop or some open wireless access point doesn't come up with more creative surgeries.

Re: Interoperable Telesurgery Protocol Plaintext Unauthenticated MitM Hijacking

#25

Post by tedunangst »

pavel_lishin wrote: post #18
jasonjei wrote: post #15

Earlier quoted context omitted.

You are right, but I'm alluding to the intrinsic security flaw of the robot. What other flaws could exist? They need not be security related.

Yeah, I sure would hate for a cosmic ray to flip a bit while an instruction is en route, and instead of gently cutting out my appendix, having the robot suddenly deprive me of a kidney.

How likely is that, versus the possibility that the surgeon operator has an aneurysm or seizure mid procedure. Or the nurse hands the surgeon the wrong chart?

Re: Interoperable Telesurgery Protocol Plaintext Unauthenticated MitM Hijacking

#26

Post by jasonjei »

tedunangst wrote: post #25
pavel_lishin wrote: post #18

Earlier quoted context omitted.

Yeah, I sure would hate for a cosmic ray to flip a bit while an instruction is en route, and instead of gently cutting out my appendix, having the robot suddenly deprive me of a kidney.

How likely is that, versus the possibility that the surgeon operator has an aneurysm or seizure mid procedure. Or the nurse hands the surgeon the wrong chart?

I think the point is that no additional software/hardware error is added on top of the human error. Human error + software/hardware error should come as close as possible to an operation using human hands (only human error). Ideally, the benefit of a hardware/software product should produce lower human error too.

Without knowing anything about the hardware/software and transport messaging layer, it could be very likely or unlikely depending on how well or poorly the product is implemented.

Re: Interoperable Telesurgery Protocol Plaintext Unauthenticated MitM Hijacking

#27

Post by athenot »

andrewstuart2 wrote: post #3

So, run it over a VPN. I'm not saying that they shouldn't add security to their protocol, but I can think of several ways off the top of my head to stay secure. The application-layer protocol doesn't have to be the one to implement it, network-level encapsulation can help you there. I'm not sure how old the protocol is, but perhaps it was more important to get it working and wrap it in a VPN and then iterate on that…

VPN may sound archaic to those outside of health, but there are quite a few intra- and inter-hospital links that rely on VPN. Even with hospital SaaS vendors, it's not uncommon.

It's not like surgery robots move around the network and come online at unexpected locations. Those installations are planned ahead and the IT considerations are part of that deployment. Also, encryption is important but so is available bandwidth and bandwidth quality: a jittery link could be as dangerous as a compromised one.

Re: Interoperable Telesurgery Protocol Plaintext Unauthenticated MitM Hijacking

#28

Post by tedunangst »

virgil_disgr4ce wrote: post #23

Did some digging on this. Basically: 1) Some researchers wrote a paper called "Preliminary protocol for interoperable telesurgery" in 2009. ( http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.160... ) 2) At the end of the paper, they write: "Also, security is an obvious requirement for real world adoption of this kind of service." 3) Last month, some other people showed that you could hax0r this unprotected pr…

> And video encryption probably isn’t practical over the kind of network links envisaged for remote surgery in extreme locations. That may not be a security concern but it does raise important issues of privacy.

That's a curious statement. How does encrypting video increase its bandwidth requirements?

Re: Interoperable Telesurgery Protocol Plaintext Unauthenticated MitM Hijacking

#29

Post by DyslexicAtheist »

I access the site and get:

Checking your browser before accessing osvdb.org.

This process is automatic. Your browser will redirect to your requested content shortly.

Please allow up to 5 seconds… DDoS protection by CloudFlare Ray ID: 1eaaa26e86870920

have I gone back in time to 1995?

Re: Interoperable Telesurgery Protocol Plaintext Unauthenticated MitM Hijacking

#30

Post by jauer »

jasonjei wrote: post #22
tedunangst wrote: post #21

Earlier quoted context omitted.

I'm afraid I don't see the connection between the decision not to implement encryption and the presence of death causing defects.

> I'm afraid I don't see the connection between the decision not to implement encryption and the presence of death causing defects. That's fine. Everyone is entitled to his/her opinion. I view the failure to implement encryption as a fatal error and an indication the code audit hasn't been thorough. Given that this is a telesurgery product, I'm quite confident encryption, trust, and authenticity are central to safe m…

We bother with TLS for accessing online banking because we don't manually build site-to-site VPNs between our house and our bank, unlike hospitals which have dedicated IT staff, a ton of security appliances of all types and, if they are in the same metro, often have dedicated waves or dark fiber between them.
Post reply on HN