Heart Device Hacked to Prove Point
Eric Bland, Discovery News
March 27, 2008 -- Scientists from three universities recently hacked into an implantable biomedical device through a wireless connection, stole information about a hypothetical patient's health and personal history and changed the cardiac defibrillator's settings.
Had the patient been real, he could have been killed.
The researchers say it was the first time anyone has hacked into a biomedical device.
"We were able to show how to retrieve and program info from the device," said Kevin Fu, a study author from University of Massachusetts, Amherst. "The ramifications of this are still being worked out."
The scientists used an implantable cardiac defibrillator that can either send small bursts of electricity to ensure a regular heart beat or large amounts if the wearer experiences a heart attack.
Wireless technology was originally added to the device to allow physicians to check and reprogram the device without resorting to surgery. But could it put patients at risk?
Don't start worrying about wireless assassination just yet, say the researchers who conducted the test.
"In my opinion, it would be highly unlikely to use to use standard wireless communication devices" to reprogram a biomedical device, said Fu.
The programmer must be within a few inches of the device to obtain information or to change settings. While the information is transmitted wirelessly though radio waves which easily extend over large distances, a strong magnetic field -- much harder to extend -- must also be present.
"If you were trying to generate that kind of field to reach 10 to 20 feet, you would probably kill them with radiation before you could hack it into their device," said Avi Rubin, a professor of computer science at the University of Maryland who was not involved in the research. Rubin's commercial company was the first group to hack the iPhone.
A special device is also required to program the defibrillator, and while such a device can be manufactured, it took the researchers well over a year to assemble one.
"I think it's interesting that they looked at this problem," said Rubin. "Too often industries look at devices without looking at security."
The researchers urge device manufacturers to consider how to prevent the hacking of biomedical devices in their designs.
For now, "I don't think people need to be worried," said Fu. "It's much better to have one of these devices than not. But we do need to asses how these devices will be used in the next 15 to 20 years."
All the usual copyrights apply
Had the patient been real, he could have been killed.
The researchers say it was the first time anyone has hacked into a biomedical device.
"We were able to show how to retrieve and program info from the device," said Kevin Fu, a study author from University of Massachusetts, Amherst. "The ramifications of this are still being worked out."
The scientists used an implantable cardiac defibrillator that can either send small bursts of electricity to ensure a regular heart beat or large amounts if the wearer experiences a heart attack.
Wireless technology was originally added to the device to allow physicians to check and reprogram the device without resorting to surgery. But could it put patients at risk?
Don't start worrying about wireless assassination just yet, say the researchers who conducted the test.
"In my opinion, it would be highly unlikely to use to use standard wireless communication devices" to reprogram a biomedical device, said Fu.
The programmer must be within a few inches of the device to obtain information or to change settings. While the information is transmitted wirelessly though radio waves which easily extend over large distances, a strong magnetic field -- much harder to extend -- must also be present.
"If you were trying to generate that kind of field to reach 10 to 20 feet, you would probably kill them with radiation before you could hack it into their device," said Avi Rubin, a professor of computer science at the University of Maryland who was not involved in the research. Rubin's commercial company was the first group to hack the iPhone.
A special device is also required to program the defibrillator, and while such a device can be manufactured, it took the researchers well over a year to assemble one.
"I think it's interesting that they looked at this problem," said Rubin. "Too often industries look at devices without looking at security."
The researchers urge device manufacturers to consider how to prevent the hacking of biomedical devices in their designs.
For now, "I don't think people need to be worried," said Fu. "It's much better to have one of these devices than not. But we do need to asses how these devices will be used in the next 15 to 20 years."
All the usual copyrights apply