Medical Device Hacking; Final Blog Post

Introduction

Our project focused on the hacking of medical devices and the positive and negative factors associated with having vulnerable health technology. We focused on simple devices, such as insulin pumps and pacemakers, but also touched briefly on how entire hospitals can be infected and all of the larger and more complex machines that can be included in these attacks.

In addition, we also took a look into patient data to see how they could be compromised by using vulnerable health devices. By exploring all of these entities, we hoped to expose the level of  vulnerability for various medical devices and hope to provide information that improves the health of a defined population.

Research Summary

Our research spanned multiple stakeholders and parties, offering us a unique perspective of the current state of things concerning the digital security of medical devices and the future of what we can expect to find. The following is a summary of each of the categories we researched.

Patients

Patients are interested in the well being of themselves and their loved ones and making sure that their medical devices are working and providing them with accurate data. They have personal incentive to provide themselves with the device/treatment that provides them with the best possible level of care. If patients are using devices that are vulnerable to attacks then it is possible we can see an incredible amount of harm done to a large number of people in the near future.

From our presentation, we discussed examples such as Dick Cheney’s security configuration on his pacemaker as well as the Dexcom hacking situation where hacking is used for a positive purpose. Jeremy Radcliffe’s research on hacking his own insulin pump was very informative as well.

Research & Manufacturers

The researchers are interested in the progress and implication of security breaches. They are also interested in understanding how these devices can be corrupted and how they can prevent that from happening. The manufacturers on the other hand are interested in pushing out a monumental product that saves lives and brings in significant revenue. The issue lies in the idea that manufacturers have not had to consider the unintentional and intentional consequences of a device vulnerable to hacking.

From our presentation we referenced the 2008 Harvard study which provided a valuable insight into how accessible medical device hacking is. We also touched on the research from the Oak Ridge National library as well as the various methods researchers are looking to implement into devices in the future. Some of these examples include encryption, zero power defense and password protected devices.

Hospitals

Hospitals are at risk to security breaches and are just as vulnerable as medical devices. However, a security hack at a hospital can have catastrophic effects as it only takes one device to infect an entire hospital. That one device can be hacked with malware on a single USB. In response to this potential threat, many hospitals are employing white cap hackers who are essentially hired to hack hospitals and identify the vulnerabilities within the devices, the network and the systems.

Government   

The main concern of the government is that they have not really dealt with security breaches for medical devices. As a result, this makes it much more difficult to implement a process of laws and regulation going forward. Currently, the FDA does not require a security assessment during the pre-market submission process for a device. However, the FDA has been more active in this space by issuing warnings to the public and providing frameworks for device manufacturing companies to follow.  

What Did We Learn

Throughout this project and our research, we learned that it is not very hard to hack into a medical device such as an insulin pump or implantable cardiac defibrillator as long as you understand how the device works and you have the right software to do so. We also realized that it’s not just about the device being hacked, there are many other multiple issues surrounding security breaches with medical devices.

We must consider topics such as data security to protect patient data stored on medical devices, but we must also consider device security to protect the manufacturer’s code that is driving the functionality of the device. Overall, we realized that medical device hacking is much closer of a reality than we think as we look into the future with ideas such as IoT, data management and security.

Future Research & Next Steps

Our future research on this project would be to consider the following topics & ideas:

1. What is the perspective and impact of the doctor and the US healthcare system within the medical device hacking space? Do doctors influence patients to select a certain medical device similar because of monetary incentives similar to how some doctors prescribe drugs from specific pharma companies? How does our healthcare system treat the expense and maintenance of medical devices
2. IoT: How does the internet of things affect medical devices. What other types of security and software are built on medical devices that prevent data being stolen from the patient  
3. Are medical devices hacked not to harm the patient, but to steal the code in order to produce a device that is cheaper, thus taking away market share from competitors and reaping the benefits.