Over-8.600 security blanks were found on pacemaker systems

WhiteScope security researchers have discovered over 8.600 security blanks in third-party pacemaker systems and routines used in their various subsystems.

security gaps

These security gaps are of various kinds ranging from simple code errors to misconceived design choices that endanger the lives of patients.

The they discovered these defects in seven different products from four different manufacturers. All research is presented in detail in one report released by the team this week.

The emphasis on their research was on implantable devices such as pacemakers, implantable cardiac-defibrillators (ICDs), pulse generators, and heart rate monitors (CRMs). We will collectively refer to this article as "pacemaker systems" and we should know that all these systems are remotely controlled by special devices (pacemaker programmer) and under the instructions of the physician monitoring the patient.

What researchers have found is that most of these pacemaker systems are working on a similar architecture that includes a real implanted medical device, a home monitoring device, a cloud-based infrastructure from which data is transmitted to a doctor and a pacemaker programmer, and the physician uses these data for implant settings.

The execution of all this infrastructure led to the discovery of more than 8.600 vulnerabilities, most linked to an outdated library used for software owned by pacemaker developers.

In addition, there are also basic design issues that pacemakers have to deal with.

For example, pacemaker programmers and the implanted pacemaker though must be from the same manufacturer. δεν επικυρώνουν ο ένας το άλλο, επιτρέποντας ένα a third programmer who can get close enough to the victim to be able to change the implant settings.

Similarly, pacemaker developers do not need the doctor's authentication, which means if a third one steals one of these devices can use them to do bad.

Last but not least, the data of the pacemaker systems are stored in unencrypted file systems on removable media, meaning that anyone can get one of these systems and read secret medical information.

Naturally the team did not mention the names of the manufacturers. Nevertheless, the researchers said they had contacted ICS-CERT and transmitted their findings so that organizations could address security gaps, at least privately.

The fact that pacemakers and other implantable medical devices have blatant safety holes is already known. From 2013 there have been many warnings from both ICS-CERT as well as by FDA. The FDA also issued a guide on how to ensure medical devices.

Nevertheless, security researchers have still found vulnerabilities in these devices in the years that followed, including in addition to pacemakers and insulin pumps.

iGuRu.gr The Best Technology Site in Greecefgns

Written by Dimitris

Dimitris hates on Mondays .....

Leave a reply

Your email address is not published. Required fields are mentioned with *

Your message will not be published if:
1. Contains insulting, defamatory, racist, offensive or inappropriate comments.
2. Causes harm to minors.
3. It interferes with the privacy and individual and social rights of other users.
4. Advertises products or services or websites.
5. Contains personal information (address, phone, etc.).