How serious are security concerns of wireless healthcare devices?

Question

Back in 2008 a wireless defibrillator was shown to be hackable. At this year's Black Hat conference a presenter showed exactly how to hack into a wireless insulin pump. Both of these demonstrated the ability for the potentially lethal hacking of wireless medical devices.

(Here's a shameless plug.) I and a couple other authors put together a book chapter that mentioned our concerns about security of various wireless medical devices available at http://www.intechopen.com/articles/show/title/wireless-telemedicine-system-an-accurate-reliable-and-secure-real-time-health-care.

While no known lethal viruses exist at this point, manual hacks becoming available brings the concept of such viruses one step closer. Perhaps I'm a pessimist, but it seems to me that assassination attempts between countries or companies would have the potential for producing such a virus... or just dumb chance that another virus on wireless networks may trigger serious problems with such a devices.

Do you have similar concerns or am I being overly concerned? Has anyone else seen or discovered lethal security issues with other wireless medical devices?

Answer 1

Consider this from the insulin pump story:

in true hacker fashion, he has spent the last two years trying to hack it himself.

Given two years of dedicated effort, I suspect you could hack a whole lot of things. Does that mean they are inherently unsafe or that we should take an alarmist approach? I don't think so. (btw, I'm not saying your question is an alarmist approach)

Any medical device must conduct a risk analysis. Any risk analysis must take into account forseeable misuse. In this day and age, network intrusion, viruses, etc. most assuredly falls under the category of forseeable, and will need to be mitigated.

I think the real question is how much mitigation is enough? That can only be answered in the context of a particular device.

Answer 2

There's always going to be hackers that do these type of things because they can. The extent to which that pool overlaps with those with malicious intent is the magnitude of the concern, I think.

Like anything else in medicine, there is a tradeoff between costs and benefits, so if the convenience to the patient and power to control dosing and other parameters outweighs the risks of an attack by a hacker, then we should continue to provide such devices. I'm not familiar with the design of such an insulin system, but the firmware should provide some sort of a check to prevent a lethal dose from being given under any circumstances.

Answer 3

Recently, there's been growing interest from computer security researchers in the security of medical devices, and there's started to build a literature on the subject. Here are some research papers you could read, if interested:

• Security and Privacy for Implantable Medical Devices. Daniel Halperin, Thomas S. Heydt-Benjamin, Kevin Fu, Tadayoshi Kohno, and William H. Maisel. IEEE Pervasive Computing, 2008.

• Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses. Daniel Halperin, Thomas S. Heydt-Benjamin, Benjamin Ransford, Shane S. Clark, Benessa Defend, Will Morgan, Kevin Fu, Tadayoshi Kohno, William H. Maisel. IEEE Security & Privacy, 2008.

• Trustworthy Medical Device Software. Kevin Fu. Public Health Effectiveness of the FDA 510(k) Clearance Process, 2010.

• A Review of the Security of Insulin Pump Infusion Systems. Nathanael Paul, Tadayoshi Kohno, David C. Klonoff. To appear in Journal of Diabetes Science and Technology, 2012.

• Improving the Security and Privacy of Implantable Medical Devices. William H. Maisel and Tadayoshi Kohno. New England Journal of Medicine, 2010.

• Neurosecurity: Security and Privacy for Neural Devices. Tamara Denning, Yoky Matsuoka, Tadayoshi Kohno. Neurosurgical Focus, 2009.

• Take Two Software Updates and See Me in the Morning: The Case for Software Security Evaluations of Medical Devices. Steven Hanna, Rolf Rolles, Andres Molina-Markham, Pongsin Poosankam, Kevin Fu, Dawn Song. HealthSec 2011.

• Software Issues for the Medical Device Approval Process. Kevin Fu. Testimony before the US Senate.

• Inside Risks: Reducing Risks of Implantable Medical Devices. Kevin Fu. Communication of the ACM, 2009.

For more research in this area, see also HealthSec 2010, HeathSec 2011, HealthSec 2012, the Medical Device Security Center, and the SHARPS project.

A short summary would be that researchers have found many security vulnerabilities in a wide variety of medical devices. It appears that the devices have not been built with security in mind, have not followed good secure development practices, and the medical certification process does not ensure that medical devices are secure.

However, that said, I think you have to keep the risks in perspective. The leading researchers in this field repeatedly emphasize the lifesaving value of these devices, and are careful to state that their medical benefits outweigh the security risks. One of them has publicly stated that if he needed one of these implantable devices, he'd get it, no question.

I think talking about remote assassination is... a movie theater risk. Sure, in principle it may be technologically feasible, but it feels far-fetched and far from the most severe risk for the average every-day person. Instead, I think at present the greater risk is the potential for accidental or unintentional compromise or interference with medical devices. With the growth in the use of software in medical devices, what if a software virus unintentionally ends up infecting medical equipment and interferes with their operation? That's the sort of thing that I think is worth greater attention.

In addition, I would caution you that medical issues are sensitive and personal for many people. I know that security researchers sometimes get enthusiastic talking about potential worst-case scenario and awe-inspiring exploits, but there's a very real risk here: if security researchers scare the public into avoiding these devices, then the cure would be far worse than the disease. The security community could end up being indirectly responsible for avoidable deaths if it overstates or dramaticizes the risks before the public. So, when talking to potential patients, I think it is our responsibility to be extremely careful and professional about how we discuss the issue.