Gradually we are all becoming more and more dependent on machines, we will be able to live longer with an increased quality of life due to machines integrated into our body. However, our dependence on technology grows faster than our ability to secure it, and a security failure of a medical device can have fatal consequences. This talk is about my personal experience with being the host of an unpatchable medical implant, and how this has forced me to become a human part of the "Internet-of-Things”.

1. Unpatchable
Living with a vulnerable implanted device
@MarieGMoe
@SINTEF_Infosec
Marie Moe, PhD, Research Scientist at SINTEF

2. Hack to save lives!

3. How the heart works
3https://www.youtube.com/watch?v=d6RbN5lPqIU

4. Electrical system of the heart
4

5. Pacemaker
5
https://www.youtube.com/watch?v=-f2FKmMneXY

6. Leadless pacemaker

7. The future?

8. The Internet of Medical ”Things” is real,
and my heart is wired into it…

9. Pacemaker/ICD
Programmer
Home monitoring
unit
Cellular or
Telephone Network Web portal
Inductive
near field
communicationMICS/
ISM
POTS/SMS
Remote monitoring

10. With connectivity comes vulnerability…
10

11. Potential threats
Device is vulnerable?
Access point is vulnerable?
Mobile network is compromised?
Server at vendor is compromised?
Web site that doctor logs in to is vulnerable?

13. Personal Infrastructure
Your reliance on an infrastructure is inversely
proportional to how invisible it is to you.
We all rely on oxygen, our lungs, and our hearts, but
how often to we think about them?
How often do we do maintenance or debug them?

14. “Tech is not neutral nor value-free.”
Ben Zevenbergen, Troopers16

15. The stairs that almost killed me

16. Debugging me

17. ”We need to be able to verify the software that
controls our lives”
Bruce Schneier on “Volkswagen and Cheating Software”

18. Reflections on trusting machines

19. When trust is broken
http://www.startribune.com/guidant-to-pay-a-fine-of-296m/113367264/

20. Previous work
• Kevin Fu et al:
– Pacemakers and implantable cardiac defibrillators: Software radio attacks and
zero-power defenses (2008)
– Mitigating EMI signal injection attacks against analog sensors (2013)
• Barnaby Jack
• Hardcoded credentials
• Medical device honeypots
• Drug infusion pumps
20

21. Hacking can save lives!
21
http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm456815.htm

22. WTF are you doing with my data?
22

25. 25

26. Research needed
• Open source medical devices
• Medical device cryptography
• Personal area network monitoring
• Jamming protection
• Forensics evidence capture

27. The benefit outweighs the risk

28. Credits
Éireann Leverett (@blackswanburst)
Tony Naggs (@xa329)
Gunnar Alendal (@gradoisageek)
Hugo Campos (@HugoOC)
Scott Erven (@scotterven)
Alexandre Dulaunoy (@adulau)
Claus Cramon Houmann (@ClausHoumann)
Joshua Corman (@joshcorman)
Beau Woods (@beauwoods)
Suzanne Schwartz (US FDA)
Family & Friends

29. Thank you!
marie.moe @ sintef.no
www.infosec.sintef.no
www.iamthecavalry.org
@MarieGMoe
@SINTEF_Infosec