SlideShare a Scribd company logo
Securing the Healthcare 
Industry: IMD 
Tandhy Simanjuntak 
Seminar on Practical Security 
08/18/2014
Implantable Medical Devices 
Device inserted into human body for medical purposes
2011 Most implanted medical devices in America[17] 
39% 
8% 11% 
8% 
6% 
6% 
7% 
6% 
4% 
3% 2% 
Artificial Eye Lenses 
Ear Tubes 
Coronary Stents 
Artificial Knees 
Traumatic Fracture Repair 
IUDs 
Spinal Fusion Hardware 
Breast Implants 
Heart Pacemakers 
Artificial Hips 
Implantable Cardioverter Defibrillators
Implantable Medical Devices 
Device inserted into human body for medical purposes 
Small size 
Tiny computing platform with firmware[28] 
Programmable[28] 
Limited Resources[28] 
Limited Power[28] 
Network-connected
Deep Brain 
Neurostimulator[1] 
Deep brain neurostimulator. http://www.synaptix.be 
Use for treatment of movement and affective disorders[6] 
• Parkinson’s disease 
• Essential tremor 
• Dystonia 
• Chronic Pain 
• Major depression 
• OCD
Cochlear Implant[3] 
Cochlear implant. www.medel.com. 
May helps patients with deaf to enable sufficient 
hearing for better understanding of speech[7]
Gastric Stimulator[2] 
• Attached to the surface of the stomach[7] 
• Aimed at obesity management[7] 
Implant Cardiac Defibrillator[4] 
• Implanted in the upper left chest and the lead in the right ventricle of the heart[9] 
• Detect Cardiac Arrhythmia and correct it with brief electrical impulse[9] 
Insulin Pumps[5] 
• Implanted under the skin[10] 
• Administer the insulin for the treatment of diabetes mellitus patient[10]
ACNR. Foot drop. http://www.acnr.co.uk 
Foot Drop Implant 
• Implanted on peroneal nerve, proximal to the knee[11] 
• Gait abnormality, which dropping the forefoot[12]
http://groups.csail.mit.edu/netmit/IMDShield
IMD Data[28] Static Data 
• Device make and model number 
Semi-static Data 
• Physician & Health Center ID 
• Patient Name and DOB 
• Medical Condition 
• Therapy configuration 
Dynamic Data 
• Patient health status history 
• Therapy and dosage history 
• Audit logs
Threats[28] 
Patient data extraction 
Patient data tampering 
Device re-programming 
Repeated access attempts
Threats[28] 
Device shut-off 
Therapy update 
Malicious inputs 
Data flooding
Attacks Pacemakers & ICDs : software radio attacks 
and Zero-Power defenses[26] 
Resource depletion attacks[27] 
pacemaker or ICDs 
Insulin pumps
Attacks Pacemakers & ICDs : software radio attacks and 
Zero-Power defenses[26] 
Pacemakers & ICDs : 
software radio attacks 
and Zero-Power 
defenses[26] 
Resource depletion 
attacks[27] 
pacemaker or ICD 
insulin pumps 
 Non-encrypted sensitive information 
 Reprogramming attack 
 Communicate with unauthenticated device DoS 
 3 adversaries: 
 Adversary with commercial ICD programmer 
 Passive adversary : eavesdrops communication 
 Active adversary : generate arbitrary RF
Attacks 
Resource depletion attacks[27] 
bladeRF. www.nuand.com 
Pacemakers & ICDs : 
software radio attacks 
and Zero-Power 
defenses[26] 
Resource depletion 
attacks[27] 
pacemaker or ICD 
insulin pumps 
Forced authentication attack: 
 software defined radio (bladeRF[29]/hackRF[30]) 
 Communications and computations 
 Security logs
Attacks 
Pacemakers & ICDs : 
software radio attacks 
and Zero-Power 
defenses[26] 
Resource depletion 
attacks[27] 
pacemaker or ICD 
insulin pumps 
Pacemaker or ICD[32] 
• Device shut-off 
• Read and write 
• Deliver electric shock up to 830 Volts 
Insulin Pumps 
• Supply more insulin[33] 
• Hacking Medical Devices for Fun and Insulin: Brea-king 
the Human SCADA System[34] Blackhat 2013
Challenges[28] 
Resource limitations 
Cryptography : ECC[14][15] 
Audit mechanisms
Criteria for 
IMDs[22] Safety and Utility Goals 
Security and Privacy Goals
Criteria for 
IMD 
Safety and Utility 
Goals 
Security and 
Privacy Goals 
Data access 
Data accuracy 
Device identification 
Configurability
Criteria for 
IMD 
Safety and Utility 
Goals 
Security and 
Privacy Goals 
Updatable software 
Multi-device coordination 
Auditable 
Resource efficient
Criteria for 
IMD 
Safety and Utility 
Goals 
Security and 
Privacy Goals 
Authorization 
• Personal 
• Role-based 
• IMD selection 
Availability 
Device software and testing
Criteria for 
IMD 
Safety and Utility 
Goals 
Security and 
Privacy Goals 
Device-existence privacy 
Device-type privacy 
Specific-device ID privacy 
Measurement and log privacy
Criteria for 
IMD 
Safety and Utility 
Goals 
Security and 
Privacy Goals 
Bearer privacy 
Data Integrity
Adversaries 
Type Passive adversaries 
Active adversaries 
Coordinated adversaries 
Insiders
Adversaries 
Equipment Standard equipment 
Custom equipment
Others work MedMon: with wireless monitoring and anomaly 
detection[18] 
• Snoops radio-frequency wireless 
• Multi-layer anomaly detection 
• Identify malicious transactions 
• Response: passive (notify user) or active (jamming 
packets) 
IMDShield[16] 
• Jam IMD’s messages and unauthorized commands
“At this time we believe that the risk is low and the 
benefits of the therapy to people with diabetes outweigh the 
Risk of an individual criminal attack” 
Amanda McNulty Sheldon 
Director of Public Relations for Medtronic Diabetes 
http://www.bloomberg.com/video/87427352-mcafee-s-barnaby-on-medical-device-hacking.html
References 
1. Deep brain neurosimulator. www.virtualworldlets.net. Web. 7 Aug 2014. 
2. Gastric Stimulator. www.medicalexpo.com. Web. 7 Aug 2014. 
3. Cochlear Implant. http://professionals.cochlearamericas.com. Web. 7 Aug 2014. 
4. Implant Cardiac Defribillator. drivetheweb.com. Web. 7 Aug 2014. 
5. Insulin pumps. www.medgadget.com. Web. 7 Aug 2014. 
6. Wikipedia. http://en.wikipedia.org/wiki/Deep_brain_stimulation. Web. 8 Aug 2014. 
7. Wikipedia. http://en.wikipedia.org/wiki/Cochlear_implant. Web. 8 Aug 2014. 
8. Wikipedia. http://en.wikipedia.org/wiki/Implantable_gastric_stimulation. Web. 8 Aug 2014. 
9. Wikipedia. http://en.wikipedia.org/wiki/Implantable_cardioverter-defibrillator. Web. 8 Aug 2014. 
10. Wikipedia. http://en.wikipedia.org/wiki/Insulin_pump. Web. 8 Aug 2014. 
11. Haugland, M., Childs, C., Ladouceur, M., Haase*, J., Sinkjær, T. (2000). An Implantable Foot Drop Stimulator. Proceedings of the 5th Annual IFESS 
Conference, pp. 59-62. 2000. 
12. Wikipedia. http://en.wikipedia.org/wiki/Foot_drop. Web. 8 Aug 214. 
13. T. Buchegger, G. Obberger, A. Reisenzahn, E. Hochmair, A. Stelzer, and A. Springer, ‘‘Ultrawideband transceivers for cochlear implants,EURASIP J. 
Appl. Signal. Process., vol. 2005, no. 18, pp. 3069–3075, 2005. 
14. Fan, J., Reparaz, O., Rozic, V., Verbauwhede, I. (2013). Low-Energy Encryption for Medical Devices: Security Adds an Extra Design Dimension. Design 
Automation Conference (DAC), 2013 50th ACM / EDAC / IEEE. May 29 2013-June 7 2013. 
15. Malasri, K., Wang, L. (2008) Design and Implementation of a Secure Wireless Mote-Based Medical Sensor Network. UbiComp 2008, Sept 21-24, 2008, 
Seoul, Korea. 
16. IMDShield. http://groups.csail.mit.edu/netmit/IMDShield/. Web. 7 Aug 2014.
References 
17. The eleven most implanted medical devices in America. http://247wallst.com/healthcare-economy/2011/07/18/the-eleven-most-implanted-medical-devices-in-america/ 
3/. Web. 12 Aug 2014. 
18. Zhang, M., Raghunathan, A., Jha, N.K. (2013). MedMon : Securing Medical Devices Through Wireless Monitoring and Anomaly Detection. IEEE TRANSACTIONS 
ON BIOMEDICAL CIRCUITS AND SYSTEMS, VOL. 7, NO. 6, DECEMBER 2013 
19. Gollakota, S., Hassanieh, H., Ransford, B., Katabi, D., Fu, K (2011). They Can Hear Your Heartbeats: Non-Invasive Security for Implantable Medical Devices. 
SIGCOMM 2011, Aug 15-19, 2011, Toronto, ON, Canada. 
20. C. Zhan, W. B. Baine, A. Sedrakyan, and S. Claudia. Cardiac device implantation in the US from 1997 through 2004: A population-based analysis. Journal of 
General Internal Medicine, 2007. 
21. Fu, K. (2009) Inside risks: Reducing risks of implantable medical devices. Communications of the ACM - One Laptop Per Child: Vision vs. Reality CACM Homepage 
archive, Volume 52 Issue 6, June 2009 Pages 25-27, ACM New York, NY, USA. 
22. Halperin, D. ; Kohno, T. ; Heydt-Benjamin, T.S. ; Fu, K. ; Maisel, W.H. (2008). Security and Privacy for Implantable Medical Devices. Pervasive Computing, IEEE 
(Volume:7 , Issue: 1 ). Date of Publication: Jan.-March 2008. IEEE 
23. W. H. Maisel. Safety issues involving medical devices: Implications of recent implantable cardioverter-defibrillator malfunctions. Journal of the American Medical 
Association, 2005. 
24. ETSI EN 301 839-1 V 1.3.1 (2009-10). Electromagnetic compatibility and Radio spectrum Matters (ERM); Short Range Devices (SRD); Ultra Low Power Active 
Medical Implants (ULP-AMI) and Peripherals (ULP-AMI-P) operating in the frequency range 402 MHz to 405 MHz; Part 1: Technical characteristics and test 
methods 
25. Medical Implant Communication Service. http://en.wikipedia.org/wiki/Medical_Implant_Communication_Service. Web. 13 Aug 2014. 
26. Halperin, D. ; Heydt-Benjamin, T.S. ; Ransford, B. ; Clark, S.S. ; Defend, B. ; Morgan, W. ; Fu, K. ; Kohno, T. ; Maisel, W.H. (2008) Pacemakers and Implantable 
Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses. Security and Privacy, 2008. SP 2008. IEEE Symposium. Publication Year: 2008 , Page(s): 
129 – 142.
References 
27. Hei, X., Du, X., Wu, J., Hu, F. (2010). Defending Resource Depletion Attacks on Implantable Medical Devices. Global Telecommunications Conference 
(GLOBECOM 2010),IEEE. 
28. Gupta, S.(2012). Implantable Medical Devices-Cyber Risks and Mitigation Approaches. Presentation. NIST Cyber Physical Systems Workshop. April 23- 
24, 2012. 
29. BladeRF, Software defined Radio. www.nuand.com. Web. 17 Aug 2014. 
30. hackRF, open source software defined radio. http://greatscottgadgets.com/hackrf/. Web. 17 Aug 2014. 
31. bladeRF. https://www.kickstarter.com/projects/1085541682/bladerf-usb-30-software-defined-radio. Web. 17 Aug 2014 
32. Hacking implantable medical devices. http://resources.infosecinstitute.com/hcking-implantable-medical-devices/. Web. 17 Aug 2014. 
33. McAfee’s Barnaby on Medical Device Hacking. http://www.bloomberg.com/video/87427352-mcafee-s-barnaby-on-medical-device-hacking.html. 
Video. 17 Aug 2014. 
34. Radcliffe, J. (2011). Hacking Medical Devices for Fun and Insulin: Breaking the Human SCADA System.

More Related Content

What's hot

Artificial intelligence
Artificial intelligenceArtificial intelligence
Artificial intelligence
Rahul Baghla
 
Artificial Intelligence Presentation
Artificial Intelligence PresentationArtificial Intelligence Presentation
Artificial Intelligence Presentation
lpaviglianiti
 

What's hot (20)

Wearable technologies
Wearable technologiesWearable technologies
Wearable technologies
 
Iot ppt
Iot pptIot ppt
Iot ppt
 
Internet of Things (IOT)
Internet of Things (IOT)Internet of Things (IOT)
Internet of Things (IOT)
 
Internet of things (IOT) | Future Trends
Internet of things (IOT) | Future TrendsInternet of things (IOT) | Future Trends
Internet of things (IOT) | Future Trends
 
Digital Twin Technology
Digital Twin TechnologyDigital Twin Technology
Digital Twin Technology
 
Internet of things ppt
Internet of things pptInternet of things ppt
Internet of things ppt
 
IoT on Medical System
IoT on Medical SystemIoT on Medical System
IoT on Medical System
 
The 9 Biggest Technology Trends That Will Transform Medicine And Healthcare I...
The 9 Biggest Technology Trends That Will Transform Medicine And Healthcare I...The 9 Biggest Technology Trends That Will Transform Medicine And Healthcare I...
The 9 Biggest Technology Trends That Will Transform Medicine And Healthcare I...
 
Artificial Intelligence
Artificial IntelligenceArtificial Intelligence
Artificial Intelligence
 
Internet of Things(IoT) & Applications
Internet of Things(IoT) & ApplicationsInternet of Things(IoT) & Applications
Internet of Things(IoT) & Applications
 
Presentation: Therapeutic Goods Administration: An introduction to the work o...
Presentation: Therapeutic Goods Administration: An introduction to the work o...Presentation: Therapeutic Goods Administration: An introduction to the work o...
Presentation: Therapeutic Goods Administration: An introduction to the work o...
 
CROM Digital Twins and IoT
CROM Digital Twins and IoTCROM Digital Twins and IoT
CROM Digital Twins and IoT
 
Artificial intelligence in software engineering ppt.
Artificial intelligence in software engineering ppt.Artificial intelligence in software engineering ppt.
Artificial intelligence in software engineering ppt.
 
Artificial intelligence
Artificial intelligenceArtificial intelligence
Artificial intelligence
 
Top 10 Applications Of Artificial Intelligence | Edureka
Top 10 Applications Of Artificial Intelligence | EdurekaTop 10 Applications Of Artificial Intelligence | Edureka
Top 10 Applications Of Artificial Intelligence | Edureka
 
Military Robots On The Battlefield
Military Robots On The BattlefieldMilitary Robots On The Battlefield
Military Robots On The Battlefield
 
Bluetooth Slides
Bluetooth SlidesBluetooth Slides
Bluetooth Slides
 
Healthcare Monitoring Using Wireless Sensor Networks
Healthcare Monitoring Using Wireless Sensor NetworksHealthcare Monitoring Using Wireless Sensor Networks
Healthcare Monitoring Using Wireless Sensor Networks
 
AI and Data Science.pdf
AI and Data Science.pdfAI and Data Science.pdf
AI and Data Science.pdf
 
Artificial Intelligence Presentation
Artificial Intelligence PresentationArtificial Intelligence Presentation
Artificial Intelligence Presentation
 

Similar to Securing the Healthcare Industry : Implantable Medical Devices

security and privacy for medical implantable devices
security and privacy for medical implantable devicessecurity and privacy for medical implantable devices
security and privacy for medical implantable devices
Ajay Ohri
 
Exploring Vulnerabilities and Attack Vectors Targeting Pacemaker Devices in H...
Exploring Vulnerabilities and Attack Vectors Targeting Pacemaker Devices in H...Exploring Vulnerabilities and Attack Vectors Targeting Pacemaker Devices in H...
Exploring Vulnerabilities and Attack Vectors Targeting Pacemaker Devices in H...
IJCI JOURNAL
 

Similar to Securing the Healthcare Industry : Implantable Medical Devices (20)

Security for Implantable Medical Devices (IMDs)
Security for Implantable Medical Devices (IMDs)Security for Implantable Medical Devices (IMDs)
Security for Implantable Medical Devices (IMDs)
 
security and privacy for medical implantable devices
security and privacy for medical implantable devicessecurity and privacy for medical implantable devices
security and privacy for medical implantable devices
 
Security and Privacy in Implantable Medical Devices
Security and Privacy in Implantable Medical DevicesSecurity and Privacy in Implantable Medical Devices
Security and Privacy in Implantable Medical Devices
 
Cybersecurity in Medical Devices
Cybersecurity in Medical DevicesCybersecurity in Medical Devices
Cybersecurity in Medical Devices
 
Exploring Vulnerabilities and Attack Vectors Targeting Pacemaker Devices in H...
Exploring Vulnerabilities and Attack Vectors Targeting Pacemaker Devices in H...Exploring Vulnerabilities and Attack Vectors Targeting Pacemaker Devices in H...
Exploring Vulnerabilities and Attack Vectors Targeting Pacemaker Devices in H...
 
IRJET- Hiding Sensitive Medical Data using Encryption
IRJET- Hiding Sensitive Medical Data using EncryptionIRJET- Hiding Sensitive Medical Data using Encryption
IRJET- Hiding Sensitive Medical Data using Encryption
 
Patient Centric Cyber Monitoring with DocBox and Evolver
Patient Centric Cyber Monitoring with DocBox and EvolverPatient Centric Cyber Monitoring with DocBox and Evolver
Patient Centric Cyber Monitoring with DocBox and Evolver
 
Security in Medical Devices using Wireless Monitoring and Detection of Anomalies
Security in Medical Devices using Wireless Monitoring and Detection of AnomaliesSecurity in Medical Devices using Wireless Monitoring and Detection of Anomalies
Security in Medical Devices using Wireless Monitoring and Detection of Anomalies
 
Ijcet 06 06_004
Ijcet 06 06_004Ijcet 06 06_004
Ijcet 06 06_004
 
SECURED FRAMEWORK FOR PERVASIVE HEALTHCARE MONITORING SYSTEMS
SECURED FRAMEWORK FOR PERVASIVE  HEALTHCARE MONITORING SYSTEMS SECURED FRAMEWORK FOR PERVASIVE  HEALTHCARE MONITORING SYSTEMS
SECURED FRAMEWORK FOR PERVASIVE HEALTHCARE MONITORING SYSTEMS
 
Secret key generation
Secret key generationSecret key generation
Secret key generation
 
Killed by code 2015
Killed by code 2015Killed by code 2015
Killed by code 2015
 
Killed by code 2015
Killed by code 2015Killed by code 2015
Killed by code 2015
 
Challenges and-opportunities-in-software-driven-medical-sciences
Challenges and-opportunities-in-software-driven-medical-sciencesChallenges and-opportunities-in-software-driven-medical-sciences
Challenges and-opportunities-in-software-driven-medical-sciences
 
seminar Final ppt-format-1.pptx
seminar  Final ppt-format-1.pptxseminar  Final ppt-format-1.pptx
seminar Final ppt-format-1.pptx
 
Distriburted medical image system
Distriburted medical image system Distriburted medical image system
Distriburted medical image system
 
Killed by code - mobile medical devices
Killed by code - mobile medical devicesKilled by code - mobile medical devices
Killed by code - mobile medical devices
 
Healthcare industry
Healthcare industryHealthcare industry
Healthcare industry
 
Security and Privacy Protection of Medical Sensor Data of Patient using IOT
Security and Privacy Protection of Medical Sensor Data of Patient using IOTSecurity and Privacy Protection of Medical Sensor Data of Patient using IOT
Security and Privacy Protection of Medical Sensor Data of Patient using IOT
 
Accessing Information of Emergency Medical Services through Internet of Things
Accessing Information of Emergency Medical Services through Internet of ThingsAccessing Information of Emergency Medical Services through Internet of Things
Accessing Information of Emergency Medical Services through Internet of Things
 

Recently uploaded

Structuring Teams and Portfolios for Success
Structuring Teams and Portfolios for SuccessStructuring Teams and Portfolios for Success
Structuring Teams and Portfolios for Success
UXDXConf
 
Future Visions: Predictions to Guide and Time Tech Innovation, Peter Udo Diehl
Future Visions: Predictions to Guide and Time Tech Innovation, Peter Udo DiehlFuture Visions: Predictions to Guide and Time Tech Innovation, Peter Udo Diehl
Future Visions: Predictions to Guide and Time Tech Innovation, Peter Udo Diehl
Peter Udo Diehl
 

Recently uploaded (20)

Measures in SQL (a talk at SF Distributed Systems meetup, 2024-05-22)
Measures in SQL (a talk at SF Distributed Systems meetup, 2024-05-22)Measures in SQL (a talk at SF Distributed Systems meetup, 2024-05-22)
Measures in SQL (a talk at SF Distributed Systems meetup, 2024-05-22)
 
AI revolution and Salesforce, Jiří Karpíšek
AI revolution and Salesforce, Jiří KarpíšekAI revolution and Salesforce, Jiří Karpíšek
AI revolution and Salesforce, Jiří Karpíšek
 
IESVE for Early Stage Design and Planning
IESVE for Early Stage Design and PlanningIESVE for Early Stage Design and Planning
IESVE for Early Stage Design and Planning
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
 
Integrating Telephony Systems with Salesforce: Insights and Considerations, B...
Integrating Telephony Systems with Salesforce: Insights and Considerations, B...Integrating Telephony Systems with Salesforce: Insights and Considerations, B...
Integrating Telephony Systems with Salesforce: Insights and Considerations, B...
 
PLAI - Acceleration Program for Generative A.I. Startups
PLAI - Acceleration Program for Generative A.I. StartupsPLAI - Acceleration Program for Generative A.I. Startups
PLAI - Acceleration Program for Generative A.I. Startups
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
 
SOQL 201 for Admins & Developers: Slice & Dice Your Org’s Data With Aggregate...
SOQL 201 for Admins & Developers: Slice & Dice Your Org’s Data With Aggregate...SOQL 201 for Admins & Developers: Slice & Dice Your Org’s Data With Aggregate...
SOQL 201 for Admins & Developers: Slice & Dice Your Org’s Data With Aggregate...
 
Structuring Teams and Portfolios for Success
Structuring Teams and Portfolios for SuccessStructuring Teams and Portfolios for Success
Structuring Teams and Portfolios for Success
 
10 Differences between Sales Cloud and CPQ, Blanka Doktorová
10 Differences between Sales Cloud and CPQ, Blanka Doktorová10 Differences between Sales Cloud and CPQ, Blanka Doktorová
10 Differences between Sales Cloud and CPQ, Blanka Doktorová
 
Free and Effective: Making Flows Publicly Accessible, Yumi Ibrahimzade
Free and Effective: Making Flows Publicly Accessible, Yumi IbrahimzadeFree and Effective: Making Flows Publicly Accessible, Yumi Ibrahimzade
Free and Effective: Making Flows Publicly Accessible, Yumi Ibrahimzade
 
Strategic AI Integration in Engineering Teams
Strategic AI Integration in Engineering TeamsStrategic AI Integration in Engineering Teams
Strategic AI Integration in Engineering Teams
 
In-Depth Performance Testing Guide for IT Professionals
In-Depth Performance Testing Guide for IT ProfessionalsIn-Depth Performance Testing Guide for IT Professionals
In-Depth Performance Testing Guide for IT Professionals
 
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptxIOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
 
Demystifying gRPC in .Net by John Staveley
Demystifying gRPC in .Net by John StaveleyDemystifying gRPC in .Net by John Staveley
Demystifying gRPC in .Net by John Staveley
 
Speed Wins: From Kafka to APIs in Minutes
Speed Wins: From Kafka to APIs in MinutesSpeed Wins: From Kafka to APIs in Minutes
Speed Wins: From Kafka to APIs in Minutes
 
ECS 2024 Teams Premium - Pretty Secure
ECS 2024   Teams Premium - Pretty SecureECS 2024   Teams Premium - Pretty Secure
ECS 2024 Teams Premium - Pretty Secure
 
Future Visions: Predictions to Guide and Time Tech Innovation, Peter Udo Diehl
Future Visions: Predictions to Guide and Time Tech Innovation, Peter Udo DiehlFuture Visions: Predictions to Guide and Time Tech Innovation, Peter Udo Diehl
Future Visions: Predictions to Guide and Time Tech Innovation, Peter Udo Diehl
 

Securing the Healthcare Industry : Implantable Medical Devices

  • 1. Securing the Healthcare Industry: IMD Tandhy Simanjuntak Seminar on Practical Security 08/18/2014
  • 2. Implantable Medical Devices Device inserted into human body for medical purposes
  • 3. 2011 Most implanted medical devices in America[17] 39% 8% 11% 8% 6% 6% 7% 6% 4% 3% 2% Artificial Eye Lenses Ear Tubes Coronary Stents Artificial Knees Traumatic Fracture Repair IUDs Spinal Fusion Hardware Breast Implants Heart Pacemakers Artificial Hips Implantable Cardioverter Defibrillators
  • 4. Implantable Medical Devices Device inserted into human body for medical purposes Small size Tiny computing platform with firmware[28] Programmable[28] Limited Resources[28] Limited Power[28] Network-connected
  • 5. Deep Brain Neurostimulator[1] Deep brain neurostimulator. http://www.synaptix.be Use for treatment of movement and affective disorders[6] • Parkinson’s disease • Essential tremor • Dystonia • Chronic Pain • Major depression • OCD
  • 6. Cochlear Implant[3] Cochlear implant. www.medel.com. May helps patients with deaf to enable sufficient hearing for better understanding of speech[7]
  • 7. Gastric Stimulator[2] • Attached to the surface of the stomach[7] • Aimed at obesity management[7] Implant Cardiac Defibrillator[4] • Implanted in the upper left chest and the lead in the right ventricle of the heart[9] • Detect Cardiac Arrhythmia and correct it with brief electrical impulse[9] Insulin Pumps[5] • Implanted under the skin[10] • Administer the insulin for the treatment of diabetes mellitus patient[10]
  • 8. ACNR. Foot drop. http://www.acnr.co.uk Foot Drop Implant • Implanted on peroneal nerve, proximal to the knee[11] • Gait abnormality, which dropping the forefoot[12]
  • 10. IMD Data[28] Static Data • Device make and model number Semi-static Data • Physician & Health Center ID • Patient Name and DOB • Medical Condition • Therapy configuration Dynamic Data • Patient health status history • Therapy and dosage history • Audit logs
  • 11. Threats[28] Patient data extraction Patient data tampering Device re-programming Repeated access attempts
  • 12. Threats[28] Device shut-off Therapy update Malicious inputs Data flooding
  • 13. Attacks Pacemakers & ICDs : software radio attacks and Zero-Power defenses[26] Resource depletion attacks[27] pacemaker or ICDs Insulin pumps
  • 14. Attacks Pacemakers & ICDs : software radio attacks and Zero-Power defenses[26] Pacemakers & ICDs : software radio attacks and Zero-Power defenses[26] Resource depletion attacks[27] pacemaker or ICD insulin pumps  Non-encrypted sensitive information  Reprogramming attack  Communicate with unauthenticated device DoS  3 adversaries:  Adversary with commercial ICD programmer  Passive adversary : eavesdrops communication  Active adversary : generate arbitrary RF
  • 15. Attacks Resource depletion attacks[27] bladeRF. www.nuand.com Pacemakers & ICDs : software radio attacks and Zero-Power defenses[26] Resource depletion attacks[27] pacemaker or ICD insulin pumps Forced authentication attack:  software defined radio (bladeRF[29]/hackRF[30])  Communications and computations  Security logs
  • 16. Attacks Pacemakers & ICDs : software radio attacks and Zero-Power defenses[26] Resource depletion attacks[27] pacemaker or ICD insulin pumps Pacemaker or ICD[32] • Device shut-off • Read and write • Deliver electric shock up to 830 Volts Insulin Pumps • Supply more insulin[33] • Hacking Medical Devices for Fun and Insulin: Brea-king the Human SCADA System[34] Blackhat 2013
  • 17. Challenges[28] Resource limitations Cryptography : ECC[14][15] Audit mechanisms
  • 18. Criteria for IMDs[22] Safety and Utility Goals Security and Privacy Goals
  • 19. Criteria for IMD Safety and Utility Goals Security and Privacy Goals Data access Data accuracy Device identification Configurability
  • 20. Criteria for IMD Safety and Utility Goals Security and Privacy Goals Updatable software Multi-device coordination Auditable Resource efficient
  • 21. Criteria for IMD Safety and Utility Goals Security and Privacy Goals Authorization • Personal • Role-based • IMD selection Availability Device software and testing
  • 22. Criteria for IMD Safety and Utility Goals Security and Privacy Goals Device-existence privacy Device-type privacy Specific-device ID privacy Measurement and log privacy
  • 23. Criteria for IMD Safety and Utility Goals Security and Privacy Goals Bearer privacy Data Integrity
  • 24. Adversaries Type Passive adversaries Active adversaries Coordinated adversaries Insiders
  • 25. Adversaries Equipment Standard equipment Custom equipment
  • 26. Others work MedMon: with wireless monitoring and anomaly detection[18] • Snoops radio-frequency wireless • Multi-layer anomaly detection • Identify malicious transactions • Response: passive (notify user) or active (jamming packets) IMDShield[16] • Jam IMD’s messages and unauthorized commands
  • 27. “At this time we believe that the risk is low and the benefits of the therapy to people with diabetes outweigh the Risk of an individual criminal attack” Amanda McNulty Sheldon Director of Public Relations for Medtronic Diabetes http://www.bloomberg.com/video/87427352-mcafee-s-barnaby-on-medical-device-hacking.html
  • 28. References 1. Deep brain neurosimulator. www.virtualworldlets.net. Web. 7 Aug 2014. 2. Gastric Stimulator. www.medicalexpo.com. Web. 7 Aug 2014. 3. Cochlear Implant. http://professionals.cochlearamericas.com. Web. 7 Aug 2014. 4. Implant Cardiac Defribillator. drivetheweb.com. Web. 7 Aug 2014. 5. Insulin pumps. www.medgadget.com. Web. 7 Aug 2014. 6. Wikipedia. http://en.wikipedia.org/wiki/Deep_brain_stimulation. Web. 8 Aug 2014. 7. Wikipedia. http://en.wikipedia.org/wiki/Cochlear_implant. Web. 8 Aug 2014. 8. Wikipedia. http://en.wikipedia.org/wiki/Implantable_gastric_stimulation. Web. 8 Aug 2014. 9. Wikipedia. http://en.wikipedia.org/wiki/Implantable_cardioverter-defibrillator. Web. 8 Aug 2014. 10. Wikipedia. http://en.wikipedia.org/wiki/Insulin_pump. Web. 8 Aug 2014. 11. Haugland, M., Childs, C., Ladouceur, M., Haase*, J., Sinkjær, T. (2000). An Implantable Foot Drop Stimulator. Proceedings of the 5th Annual IFESS Conference, pp. 59-62. 2000. 12. Wikipedia. http://en.wikipedia.org/wiki/Foot_drop. Web. 8 Aug 214. 13. T. Buchegger, G. Obberger, A. Reisenzahn, E. Hochmair, A. Stelzer, and A. Springer, ‘‘Ultrawideband transceivers for cochlear implants,EURASIP J. Appl. Signal. Process., vol. 2005, no. 18, pp. 3069–3075, 2005. 14. Fan, J., Reparaz, O., Rozic, V., Verbauwhede, I. (2013). Low-Energy Encryption for Medical Devices: Security Adds an Extra Design Dimension. Design Automation Conference (DAC), 2013 50th ACM / EDAC / IEEE. May 29 2013-June 7 2013. 15. Malasri, K., Wang, L. (2008) Design and Implementation of a Secure Wireless Mote-Based Medical Sensor Network. UbiComp 2008, Sept 21-24, 2008, Seoul, Korea. 16. IMDShield. http://groups.csail.mit.edu/netmit/IMDShield/. Web. 7 Aug 2014.
  • 29. References 17. The eleven most implanted medical devices in America. http://247wallst.com/healthcare-economy/2011/07/18/the-eleven-most-implanted-medical-devices-in-america/ 3/. Web. 12 Aug 2014. 18. Zhang, M., Raghunathan, A., Jha, N.K. (2013). MedMon : Securing Medical Devices Through Wireless Monitoring and Anomaly Detection. IEEE TRANSACTIONS ON BIOMEDICAL CIRCUITS AND SYSTEMS, VOL. 7, NO. 6, DECEMBER 2013 19. Gollakota, S., Hassanieh, H., Ransford, B., Katabi, D., Fu, K (2011). They Can Hear Your Heartbeats: Non-Invasive Security for Implantable Medical Devices. SIGCOMM 2011, Aug 15-19, 2011, Toronto, ON, Canada. 20. C. Zhan, W. B. Baine, A. Sedrakyan, and S. Claudia. Cardiac device implantation in the US from 1997 through 2004: A population-based analysis. Journal of General Internal Medicine, 2007. 21. Fu, K. (2009) Inside risks: Reducing risks of implantable medical devices. Communications of the ACM - One Laptop Per Child: Vision vs. Reality CACM Homepage archive, Volume 52 Issue 6, June 2009 Pages 25-27, ACM New York, NY, USA. 22. Halperin, D. ; Kohno, T. ; Heydt-Benjamin, T.S. ; Fu, K. ; Maisel, W.H. (2008). Security and Privacy for Implantable Medical Devices. Pervasive Computing, IEEE (Volume:7 , Issue: 1 ). Date of Publication: Jan.-March 2008. IEEE 23. W. H. Maisel. Safety issues involving medical devices: Implications of recent implantable cardioverter-defibrillator malfunctions. Journal of the American Medical Association, 2005. 24. ETSI EN 301 839-1 V 1.3.1 (2009-10). Electromagnetic compatibility and Radio spectrum Matters (ERM); Short Range Devices (SRD); Ultra Low Power Active Medical Implants (ULP-AMI) and Peripherals (ULP-AMI-P) operating in the frequency range 402 MHz to 405 MHz; Part 1: Technical characteristics and test methods 25. Medical Implant Communication Service. http://en.wikipedia.org/wiki/Medical_Implant_Communication_Service. Web. 13 Aug 2014. 26. Halperin, D. ; Heydt-Benjamin, T.S. ; Ransford, B. ; Clark, S.S. ; Defend, B. ; Morgan, W. ; Fu, K. ; Kohno, T. ; Maisel, W.H. (2008) Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses. Security and Privacy, 2008. SP 2008. IEEE Symposium. Publication Year: 2008 , Page(s): 129 – 142.
  • 30. References 27. Hei, X., Du, X., Wu, J., Hu, F. (2010). Defending Resource Depletion Attacks on Implantable Medical Devices. Global Telecommunications Conference (GLOBECOM 2010),IEEE. 28. Gupta, S.(2012). Implantable Medical Devices-Cyber Risks and Mitigation Approaches. Presentation. NIST Cyber Physical Systems Workshop. April 23- 24, 2012. 29. BladeRF, Software defined Radio. www.nuand.com. Web. 17 Aug 2014. 30. hackRF, open source software defined radio. http://greatscottgadgets.com/hackrf/. Web. 17 Aug 2014. 31. bladeRF. https://www.kickstarter.com/projects/1085541682/bladerf-usb-30-software-defined-radio. Web. 17 Aug 2014 32. Hacking implantable medical devices. http://resources.infosecinstitute.com/hcking-implantable-medical-devices/. Web. 17 Aug 2014. 33. McAfee’s Barnaby on Medical Device Hacking. http://www.bloomberg.com/video/87427352-mcafee-s-barnaby-on-medical-device-hacking.html. Video. 17 Aug 2014. 34. Radcliffe, J. (2011). Hacking Medical Devices for Fun and Insulin: Breaking the Human SCADA System.