FDA isn't doing enough to prevent medical device hacking, HHS report says

https://edition.cnn.com/2018/11/01/health/fda-unprepared-medical-device-hacking/index.html

by rbanffy • 8 years ago

121 47 8 years ago

edition.cnn.com

Has there ever been a case of a medical device being hacked to do realworld physical harm? Considering the billions that will need to be spent to secure future devices, are there not perhaps other areas of healthcare where the same money could save more lives?

bdelay• 8 years ago

My guess is that yes, absolutely, but very few people know about it / a Doctor or nurse was blamed.

Medical system security does not seem very good. When I was operating in the area a while back, one comment I kept seeing was similar to yours. "Yes, the security is bad, but the good these devices do outweighs the bad."

I agree with that, but my follow-up has always been, why can't these devices continue to help patients, but in a secure way? The manufacturers really don't want to spend the money to try and have some form of a security posture?

Rhetorical question. At the end of the day, my pessimistic view is that nothing will happen until some firm finally proves that there has been a high profile attack, there is an ensuing media firestorm, and the regulation process starts happening.

Nasrudith• 8 years ago

The problem with them is the same as DRM essentially - you have to keep it accessible to everyone and not accessible at the exact same time. The key management is a nightmare.

I believe the best compromise would require forward thinking leadership and design. Make medical devices that must or would be served by communication and control short range by design. Ideally it could be turned off by the patient but close range enough that a doctor can access it while the patient is in no position to assist. The added danger is minimal given that anyone that close who wanted them dead could just murder them in other ways.

Have a centralized registry of valid public keys - there are debates about who should have one but that is a whole other topic. The point being that nonrepudiation - an audit trail will be left which means in cases of malfeasance the entity corresponding is the one responsible - either directly or by letting their key get compromised. The practical pain is the logistics of course.

sovietmudkipz2• 8 years ago

I agree with that, but my follow-up has always been, why can't these devices continue to help patients, but in a secure way? The manufacturers really don't want to spend the money to try and have some form of a security posture?

I speculate the truth is benign; security isn't a top feature for many development shops.

HillaryBriss4• 8 years ago

why can't these devices continue to help patients, but in a secure way

my guess is that they are subject to the usual security vs convenience trade off, that more security means more time and money spent gaining access to the devices for legitimate actors (e.g. nurses) which means some additional patient lives will be damaged or even lost.

of course, that may be well justified depending on how much dangerous or malicious hacking there is

apercu2• 8 years ago

Medical device security was pretty decent in 1997 at the company I worked for. Until we ported everything to NT from a variety of *NIX OS's. Then it became non-existent.

sovietmudkipz2• 8 years ago

It could be possible hackers simply haven't turned their attention to exploiting these devices yet.

There is always a time before a vulnerable system gets hacked, and there is always a person doing the hacking. Maybe this article on HN, some tweet, or some other comment on the internet will prompt someone to break into a IOT medical device and cause harm to someone. Who knows when it will happen.

That said, I wouldn't understand the rationale behind someone who knowingly hacks a medical system for malicious intent. What honor is there in turning off someone's pacemaker? That just seems like murder but with a technological twist.

bluGill3• 8 years ago

All nations are interested in the ability to remotely control the pacemaker or the leaders of all other countries. We should assume that Russia, China, and the US are all able to pull it off at will if it is possible.

Would they every use this? It is an act of war, and they risk the replacement leader being "worse". However it is something they would like to have. Of course once someone starts using this all medical device makers will have to take security seriously, which enters an arms race.

The only protection most people have is we are not important enough to target. However if you are a world leader of some sort you are always at risk that some other country will decide the best way to deal with you is kill you. Vulnerabilities in your medical devices is just one possible choice such nations have.

Then again there are lots of other choices for murder. Poison has been used going back thousands of years has the useful property that you can make it look like an ex did it thus avoiding war.

maxxxxx4• 8 years ago

"That said, I wouldn't understand the rationale behind someone who knowingly hacks a medical system for malicious intent. What honor is there in turning off someone's pacemaker? That just seems like murder but with a technological twist.

Somebody may do this but with current devices it would be difficult to do this on large scale. Usually you need some level of proximity.

informatimago• 8 years ago

So far, bugs in medical devices have been documented that have led to death or physical damage. Bad radiation doses, retina burning laser powers, etc. Given that most of those devices run on MS-Windows, I'm still more worried about bugs than attacks, but indeed it would be trivial for bad guys to target you if you need to be hooked on such devices...

rbanffy3• 8 years ago

Imagine, for instance, manipulating medical images to make a prominent politician (and their doctors) believe they have a dangerous tumor in their amygdala, making them undergo radiotherapy that fries half their amygdala, turning that politician into a liberal.

Moral implications aside, I can see a reason to explore that idea ;-)

Note: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3092984/

maxxxxx4• 8 years ago

We have thought about this in my company a lot but it seems there is no money in hacking devices and it usually doesn't scale well. Some person may try to inflict damage on people just for the heck of it but that will probably be isolated cases. It's potentially much more profitable to hack patient databases but even there there are probably better targets in other industries.

vertexFarm3• 8 years ago

Security should be the default. I don't think it will cost much more to make them secure relative to what medical hardware already costs; adding encryption to the microprocessor in a state-of-the-art implant isn't going to be a hefty line item on that particular BOM.

Think of it this way--any life-critical machine should have at least some consideration payed to security during design. Even non life-critical machines need security, so is it acceptable when we entirely ignore it in the whole field of medicine? If we leave it that that way, then yes, be utterly certain that it will be exploited somewhere by somebody. All information security paranoia is proven correct on a long enough timeline.

Ask any infosec professional--does _____ system really need security? The answer is going to be yes, regardless of what's in the blank. We've learned this many times with many devices which we used to think nobody would ever bother to tamper with or that couldn't be made to do anyone harm. Every time our hubris brightly illustrated and we finally realize that yes, every networked device has the potential to be crucial to somebody and it all needs at least some consideration toward security.

zaroth2• 8 years ago

"Medical Device Hacking" is a large part of how my wife and I slept at night for the last few years, based on the open source Nightscout [1] project which interfaced my kids' Dexcom CGMs to our smartphones. Continuous Glucose Monitors allow T1Ds to track their blood sugar without finger sticks and are particularly useful at night for catching lows.

The Nightscout project was a strong motivator for Dexcom to push harder on developing and improving their remote monitoring solution. A solution which could easily have languished in R&D and FDA approval hell for another 5-10 years got to market much more quickly once users were out there DIY'ing their own remote monitors.

Additionally there are a lot of "mis-features" that are coded into T1D products, presumably foisted on companies by the FDA to avoid liability, but which ultimately are a mild form of torture on end-users day in and day out. Having an option to turn to open source alternatives when the incessant alarms which can't be disabled are driving you mad is better than throwing out the device altogether. For those who haven't used or know anyone who has a pump, pod, or CGM -- the problem is that the devices are subject to dozens of variables which impact their performance, reliability, or accuracy, and alarms are often "lacking context" (to put it mildly) or outright wrong.

E.g. When you've treated a low and double checked with a finger stick that blood sugar is rising, a siren going off every 5 minutes from the CGM at 4am is enough to want to remove the CGM and smash it with a hammer.

Having open source alternatives is a large part of, I believe, forcing Dexcom and even the FDA "to the table" to reconsider hard-coded patient hostile "features". It's easier to appease the lawyers and go into CYA mode, when there's isn't a strong open source competitor with 28,000 Facebook followers and a Github repo with 21,000 forks [2].

[1] http://www.nightscout.info/

[2] https://github.com/nightscout/cgm-remote-monitor/

HillaryBriss4• 8 years ago

really appreciate your comment. want to learn more about this:

...presumably foisted on companies by the FDA to avoid liability...

because I had thought the foisting ran in the other direction. I had been under the impression that the companies want to avoid liability so they nudge the FDA into creating a regulation that supports what they wanted to do anyway. not sure.

seren• 8 years ago

As a medical device sw developer, if doing your risk analysis, you notice that if for some reason the user miss something important, it will create a risk for the patient, the easiest (and cheap and lazy) solution is often to add a blaring alarm or scary pop-up to ask the user to confirm/check.

This way you can say that you have a mitigation, so the FDA is happy, you are happy because you can sell your product.

The downside is that it creates a horrible user experience most of the time.

This is unfortunate but this is a result of incentives of the different actors.

Another slightly related issue is that, you'd rather restrict what you user can do, because you're sure it will be at least safe. So often doctors can be frustrated because the system is not permissive enough. Most of the time, as a vendor, you prefer to sell a clumsy system that facing the risk of having a recall.

speedkills• 8 years ago

A large percentage of Dexcom developers have had their lives impacted by Diabetes in some way. This and plain old competition are the biggest drivers in their features and usability in my experience. You have to keep in mind like most businesses they have a long feature pipeline in development that is not public knowledge. If you release a feature and see it mirrored by someone else shortly after it's as likely that you both thought of it, and you just beat them to it than it is that they were inspired by you. Especially when one of you has a much shorter time to market thanks to no FDA oversight.

akira2501• 8 years ago

Especially when one of you has a much shorter time to market thanks to no FDA oversight.

They're fundamentally different markets, though. The device manufacturer is out to turn a profit on hardware, the open source programmer is out to improve their own individual experience.

Why should the second individual be subject to FDA oversight? I mean, I'm glad the FDA exists, but their function is to regulate the overall market -- not make it harder for me to make my _own_ healthcare decisions.

zaroth2• 8 years ago

I’m sure the Dexcom developers are good people. And just look at their stock price — things are going well for them since they released the G6, which, well, actually works most of the time!

Their software is still doing trivial things badly and they deserve to feel ashamed and embarrassed that Nightscout could relay an integer value over the Internet to a smartphone years sooner than they could.

I’m very thankful for Dexcom. They’ve done great things for T1D management. They could do much, much better. They are only scratching the surface of what a CGM system should do, never mind a closed-loop system of which they will be an integral part, and dare I say, should be in the drivers seat to a dumb-pump following their orders.

reaperducer• 8 years ago

"Medical Device Hacking" is a large part of how my wife and I slept at night for the last few years

I spend a lot of time in places with little to no cellular coverage. One of the medical devices I use downloads prescription changes from the doctor's office via cellular connection. So I had to hack my device so I can make the prescription changes myself.

You do what you have to do.

crankylinuxuser2• 8 years ago

...and a Github repo with 21,000 forks [2].

[2] https://github.com/nightscout/cgm-remote-monitor/

People need to remember that if/when a GH repo is nuked from orbit, it also nukes ALL forks done in GH.

If you download, and then re-upload into your account, then it's not a "fork" per se, and won't disappear if/when the banhammer comes down.

Then again, this is the problem of centralization of a decentralized protocol! You are putting people whom dont have your interests at heart in control.

JDWolf2• 8 years ago

Agreed. I had the G4 but eventually quit because it was sounding false alarms frequently. The later versions are more accurate but I question whether I would participate if their programs get more closed off. Also don't want to use a closed source mobile app without knowing what personal data might be getting sent out.

sithadmin• 8 years ago

Good Defcon talk on this from a few years back: https://www.youtube.com/watch?v=ZusL2BY6_XU

qwerty456127• 8 years ago

Whatever device I buy I want it to be hackable, medical devices included.

rbanffy3• 8 years ago

I want them hackable by me and hardened to anyone else.

bluGill3• 8 years ago

I was nodding in agreement for a few seconds. Then I realized I'm not perfect. If I hack my own device I'm going to make a mistake and kill myself. Since that isn't a desired goal I don't want to be tempted.

I want the device to be perfect so I don't have to think about it. Some devices should just work and not be thought of. (I include the refrigerator in this group)

vertexFarm3• 8 years ago

When an article such as this mentions hacking, they don't mean your version of hacking. They mean the spooky news definition of hacking where there's a stock photo of a guy wearing a hoodie (and a balaclava for some reason??) typing on a laptop with a glowing green matrix waterfall on the screen. They mean there's no precaution taken whatsoever against malicious access, which is certainly a bad thing. Even the most radical FOSS guy who built his own phone out of spare parts and has a bumper sticker which reads "my other computer is your computer" is going to put a password on it.

There are pacemakers out there using NFC or some similar tech to talk to an external processor and battery pack. I bet the security on those is utterly tragic. The relevant regulatory bodies are absolutely not going to do a damn thing about it until there's a body count--of that much I am 100% certain.

Murder via medical device malware sounds like the plot of a rejected Gibsonian short story, but stuff like that will happen in our world. Somebody is eventually going to think that might be just the way to off grandpa so they can hurry up and get that inheritance.

JDWolf2• 8 years ago

Could there be a key model where you could unlock access and then control via chosen (hopefully reliable) software?

peterwwillis• 8 years ago

There are still medical devices found on the internet. I don't think the FDA can regulate that away, we need active efforts to locate and secure holes in critical systems.

Cerium• 8 years ago

As someone working in medical devices, the FDA has really stepped up their game. They have issued a draft guidence on cybersecurity expectations[1] and are now rejecting submissions that don't adequately address security for internet connected devices. There is still a long way to go, but I think change is happening in the field.

[1] https://www.fda.gov/downloads/MedicalDevices/DeviceRegulatio...

RanjoUnchained• 8 years ago

Unfortunately, many large and traditional medical device companies did not incorporate security practices in their design and development phases nor did they stay vigilant in the post market phase with regard to the latest and greatest security updates. It is only in recent years and due to many embarrassing news article reporting on vulnerabilities in pacemakers and and infusion pumps that forced these companies to take more actions. But even then they are still tailing behind other industries especially in the consumer and financial sectors.

It's also worth to mention that FDA's focus is different from HHS or other agencies. While other agencies care about consumer data integrity and patient health information (PHI) in the case of HHS and HIPAA regulations, FDA is focused solely on patient safety and clinical efficacy. FDA hold medical device companies accountable only if vulnerabilities lead to patient safety issues within the risk management framework. If medical device companies show in their hazard analysis and risk management file, that it's unlikely for vulnerability to be exploited where patient safety is compromised, given the clinical controls and intended use environment, then they don't have to act on them.

You can see that in the FDA Post market guidance on Cybersecurity where they show a chart for Controlled vs Uncontrolled vulnerabilities. So its not uncommon to see scenario where you see a high CVSS score for a vulnerability, but for a medical device intended use in a hospital the manufacturer claims that according to their risk management file, the same vulnerability is controlled and thus its ok not to take any additional measures.

https://www.google.com/search?biw=1516&bih=947&tbm=isch&sa=1...:

bpp• 8 years ago

Your point about FDA's mission is paramount, but in this case it extends to HHS (its parent) as well. It'd be foolish to expect large (calcified) government agencies to, of their own accord, take on tasks so far outside of their core competency. The FDA primarily deals with substances that we put in our mouthes (although of course they do have responsibility for medical devices). Security engineering just isn't at the core of their mission; this is the kind of thing that ideally could be outsourced to a better-equipped agency.

apercu2• 8 years ago

So many years ago I started my career at a biomedical manufacturer that sold EEG, EMG, polysomnography and transcranial doppler devices. Most of these were built on some variant of UNIX (SunOS, Unixware, QNX) and were locked down to be pretty secure once networking within hospitals became more common.

The new CEO listened to what medical departments wanted, and that was a PC that could perform the clinical functions but also run MS office. So the entire engineering department spent a couple years porting everything to NT.

Then you had viruses taking out diagnostic devices. So virus scanners were installed. Now you had latency issues between the amplifier and ADC conversion and display or other issues (I don't remember all of them to be fair).

Keep in mind that some of these devices were used in the OR. Now, I'm not saying that Windows was 100% the problem, certainly the idea of multi-use contributed, but we never had any of these issues when we rolled out operating systems that locked down what you could do on the device (technicians couldn't even access the OS unless we told them how) and that we could easily secure.

FDA isn't doing enough to prevent medical device hacking, HHS report says

Related Stories