University:
Boston University
Course:
SAR HP 151 | Introduction to Health Professions
Academic year:

2022
Views:

450

Pages:

21
Author:

Devon Haley

Healthcare + Embedded Technical capabilities vary widely between hospitals ~1350 of 5500 US hospitals are “critical access” in small big mounta hospital Advanced facilities are limited by legacy devices Clinicians have an expectation of device connectivity that is unrealized What do they want? ● ● ● ● ● Patient monitors Anesthesia, OR equipment Ventilators Medication pumps Lab equipment Where do they want it? We will continue to see a shift to more connected devices Where’s the risk to patients (us)? Systematic review of life-sustaining devices Technical Details ● Inherent to architecture? ● 0day? ● Confidentiality, integrity, availability risk Disclosure Methods ● CVE filed? ● FDA involved? Vendor Response ● Bueller? Implantable Cardioverter Defibrillator - 2008 Implantable Cardioverter Defibrillator - 2008 Device 2003 Medtronic Pacemaker Researchers Halperin et al Technical Details ● Unencrypted RF communication with programmer ● Pt data leakage ● Battery drain attack Disclosure Methods Direct to FDA Vendor Response ● “We feel this is an industry-wide issue best handled by the FDA” ● Newer models have “security features” Implantable Cardioverter Defibrillator - 2012 Implantable Cardioverter Defibrillator - 2012 Device Undisclosed ICD Researchers Barnaby Jack Technical Details ● Wireless reprogramming (30-50 ft) 400 MHz ISM band ● Deliver 830V shock Disclosure Methods Public disclosure Vendor Response N/A Implantable Cardioverter Defibrillator - 2016 Implantable Cardioverter Defibrillator - 2016 Device St Jude Pacemaker + Merlin@Home Researchers Medsec Technical Details ● Wireless battery draining attacks ● Remote (IP) reprogramming ● Static keys, unencrypted file systems, etc. etc. etc. Disclosure Methods Coordinated stock short w/hedge firm Vendor Response Issued Merlin@Home firmware updates; “partnered” with FDA, DHS, and ICS-CERT These threats are not unique to old ICDs ● Whitescope (2017): review of four ICDs with encrypted wireless, file systems, no firmware validation ● Jack, Radcliffe (2011): unencrypted communication in wireless insulin pumps ● Radcliffe (2013): Unsafe boot state in Animas insulin pumps ● Rios (2014): Commands issued on same LAN as Hospira IV drug pump interpreted similarly to button presses The threats fall into similar categories ● Inadequate protection of custom RF implementations ● Lack of secure boot, firmware validation ● Lack of adequate network authentication on embedded devices Difficulty in device management and upgrades makes a vulnerability from 2008 still relevant. Where are the regs? The Best practices? The FDA is starting to issue non-binding guidance Content of Premarket Submissions for Management of Cybersecurity in Medical Devices (2014): ● Develop a set of cybersecurity controls ● Consider some key security principles when designing devices (e.g. limiting access through authentication, security update paths, and prevent use of hardcoded passwords) ● Have methods to detect, respond to, and record cybersecurity incidents We may soon have to find a way to locate devices Office of the National Coordinator for Health Information Technology (ONC), requiring tracking implantables by unique device identifier: “to prevent device-related adverse events, enhance clinical decision-making related to devices, improve the ability of clinicians to respond to device recalls and device-related safety information, and achieve other important benefits'' So what does all this mean? We have relied on obscurity for too long - though the barrier is dropping, we need better tools and methods for embedded A college EE TA could do the majority of my job The vulnerabilities fall into common themes that are ripe for best practices to be adopted I write the standards! You write the standards! We all write the standards! We must: ● Build better research tools and methods ● Work to develop standards for embedded security (OWASP top 10) ● Start being more selective with devices coming into our institutions ● Look at our regulatory landscape, especially when it comes to life safety ● Make it cheaper and more valuable for companies to invest in cybersecurity