GIF89a̙fffff33333!,I8ͻ`(dihlp,tmx|pH,Ȥrl:ШtJZجvzxL.zn|N~@8V8 a%(T@  bĆJhȱcGnXH20dĉDTp2Lqi@I,*D$̣.Qit!|*4QB^TP@.jD FIBLmĺUHBک8jv&ֹC[C[v* $5zG[kpc<[W{.)HWњ> Jmםi!L/ V5&s mjdO ʓh(л˅"ݥ!Ye% QS 2xĀ{,4aUb$$'Ԅh\t C}enpc!z%g"E,=!IE% 85 gSS9VtS7UDԌSquImyC ȇ{]6g 1*l\3tfYۭPCXxOB=>RcP0Xפ^'9t]*\]O ,$1ex}{m9` :s[kfMhfL/'mmsQ){ PV@GQ.Ap[ws,:% oq^ f8!!|AE&Ƒx:ǿd)0 <]g:٭!PD۔z䁾du% FXv HDE%^xaULkF䈧 ix#c22L#ǶaF??T! :#{A!MPcJ>*rk$b١~:" ƞy/dF(HPNJ,SDK\eiL&ʯ ⢣0uD fy@i:N>#!xKeS@Y4,shyl6g&IRT,S πiAFz0ldP2iQxdk֣aw}O dW&}`GO̯ڔDYD {G"פW&)~w_T3A|_ΰv>Vmo{Q^{~|I:cFDa~Ok+D(y<ͨU/D m-,ؗi5"'vb#noҀ  &#7a(6؁ "8$X&x(*,؂.0284X6x8:<؃>@B8DXFxHJp6p00P(pSx^(U\(^XaQ؆ 0rZx`^hH=pȇ}Xp pH"`؈0i8px(`((؈g(Xx[؋V8~NxxxhfHH`xfHhx8X#؍"pe(Ũ ؈0˘XxqobvX昏:Hن)YI!iH&*#و'yh647lXؑs3)6)hF ؆<[M%ЈM\Kۚ ّ=f ]Cz9:0vXݜ <x+Aܾ,-? ڵ-:ߺm>=-]^Pι=ކKiн=a|}%omͬ\}MdMވ͝؋X|۬>n 1ۼߝ:C=xIĽ2( KN]D-Q-T>\l3,:ʪ ͈zm7+iI@ʚ=ms]\F N$톍౎ A^*$>W~(~n,ݞN|띭'!Rm>{=6@~X؍ˎ@ڶ՜ +©̎ŽH" pWmΉN ϑ=5(m︭⯞㘻Nϔu@~_=n>ۍo\OI~亮D-kI4 `ޮ'|+Т`-+9_1);ɲ.\Mi_}/,+)b1|Ժ:M}WH|_?*ƋǍ>m隖/yw?nv* SӦ_'UȌ-Wyc{ޏ# /Sdž*˯/U f&_5@ INYR}:6qԺ".q``shP>: {N? 0 *Ԣ 78KQ0ACVk 1;"Bh"1̏(A(r4Dɯ[rdQ̚oBb)ѡ(o''2qчNLL(۠.\Ql,Ϝ <(O<LgEHb*4\Q`)DosV0U^etawTbZH6ZijsRtjlUT;-JaD#hs=3ZST^>Mw= |?WWlZ}V Wށ8a?9dG&dOF9eWfe_9fgfo9gwg:h&hF:ifi:jj:kk;l&lF;mfm߆;n离n;oox'xG>ygy矇>z駧z>{{?|'|G?}g}߇?~秿~?`8@ЀD`@6Ё`%8A VЂ`5Av(0 $"$@@(B@ @ &< BЃP@81ЁbBD"BD* 07V;TA*E,cи hшM<D3N'v3:t#S%‐Cǒ)RrDr1͑!XI@VQȣK"҉A$!p3~MDDv24m#YfRԘ8g8w~-.QMRG)Ѕ ?SCbPhyKG5XcP I.$pAI7B&3Ae$,EVke!L+6-3@Z-}0+TA8i(3ظ46e+c!63Pb@%ZZlD;ϴ"(%#)Y.+)8gdyT"#QEj 1߸MҀ$EyY $f9UG/nLmiMs=x}d _R%;̡u7[qKevmkdʒ:fiΙOΖh`m5=4yl2(@>$$%kbav~,=JчEu[m2oWߑerOg|Nh7S;us[5x q-j|3tі)r~y}[d#%Qƣ6v?>9ͩzm^<.Δ:ͫtO9oAӛX~ziF}~ܙ޷:7;s.y1v:vz$Gi'z3oUu y'Qݸ j?>ͯg}y_COϙ⛞_~@oG ZjOlyk'Ĩӿ3Y-c@#k:;{@D#[=Ż@_A2A?18C>9R83LӴփ7+)ۺKKq#B=J"@9$%\t!/8BBк/$@8A1-ϻ71ԂC l:,@@6t>k>*8,ړ맢BBH۩LӲJC0 $yK695 C#@Ck6B;I~*3N0F~:*,HBԵ#d/L;4EL*$lt9>$dEm>AD>WdU26ƛk<|GRܤbBo$@I@ GLJ%FC|ES0)):/iCoy\0CI|=w,I:s5W򥉫!lVşܙ2cJ& pJ*X9Yȧ<Z jİc8 G QT_;&k%Bh$BKCdozsCAƍ!qDǿ4\DADBry!ċGDȫ R˛K:2̉Qj0Œ~J4*Z&RIpL̏ 0͌۲dNB2̽5T-M@A#ܜ@HrMT<C#:[-+ν:NKW#ALLl&+PMDTPL̻9:$OF,DzO&-JS O 8ǤIѾf#>J# , 'M;"e3'<p*όPSZ/EC\UD*}EP[P8mQnPěBtS[m2XiVGq ˬM!L$@V]%H 'vC]ҖDЀeTA=Y#3T#Wye0(}-P|6.mS'MXdY&eMZ:0|%,yRZE"*Z#dNZژų$mIXE@Dm(8;YBK[O3S*uCGY`F&`ۼہfIdm#luB[l[T+\@QR$\[|ۇ5Eř)/Sݱ]Rr%U5b݈֕U%]kN]U\*YE:1K8%^٥ŞFpMQ$SPp]WAU_ *_z0BE_&6FVfv `‚_`C`=,EY!J{ݶ\LC ̚]¥PKX9VdŋeRJٱS1ӫIf ε+Ël LDmE#;؄j!$cݤUUM`7<6c,cqx$*3?K3^KO@. / I~G#E~hp t deLJݨv1K1h&GiR,vឭ\)3r,.⠤VUSbB";ElCc4FӰ:m&nE4ޮWmc>Lǫi T{Y0Qdv\L:BX.B=Xf\,*Eh/E\lo~, dTZ.FqjL..BDŽLklmײiMXiudR'SrRvXKaoŇk";e WUk˽r*vJQo*K޺>j-Jԋ%beFDM@(T̝b8Ϟqad$Q1n ĝї>"&n*\'\[eO#[VyNcH^y}<0/vzNfvUg=T ^R) NrVgbS%8C;_^sOUl%ORiK?TxaGuM&)-Z ˾V'zXtumO(> [HO*s&K2fWe+oVtBrIoovPz.VTOV5[ˣfs"~rfog3#mz{s->,p_%/VĔMj-u{2 婗ժOgeXI[dYJKaΨ++,@^B[F_@[`B^O% 'hhJ# Mœ ٭$ WT,)-Ei*ȳ١0ͩ`$qq`rr/H+pyh=z*\fB$R< 4җ"A(7x&#L^ `@Z E0lo&q@Р4zqG"ǒóL,KkPcTb^(KZW;Lx5MTyԔW3+~~MDYvIk5%bM-m ,͏%j\IM&\8퉊ZO^JVc":L@tn:Hc3 0 pF: Tkn08̱r̫(Kh"`A4h.+:4gyWC4 g_ШUĠ#[_}$a~<_HA]gbK{!WhWPgݍEb4rߎFj,JatɜW#{0E;\D$j t%Ywya -0\Xdz/963N>9qډ(7]Y7dYmhMlyjt*pW|#%諆nmXX!;Ԓ֧)~AhyİjaxrDh8Ydm**!81j)L##ZçWnhH,jZ[(*`)+畳{q5AO 8DEK ;,ԹA !&l*{šq O$|A ",BpO紤\hHDK9Iclء>]c1joq6mfku ν$M6yҦ"Gi'5;N"ۏK>9[~9kNy{9衋>:饋ҹ驫:뭻:(>;~;˞;;<<<;<1o[=={0?>>髿>>?????(< 2| #( R 3 r C(&!(!F<"%P2N|"()RV"-r^"(1f<#Ө5n|#(9ұv#=~# )A/;
Monday, August 11th 2008

Someone Hacked Your Pacemaker

Norton & McAfee Are Pending Release of a ‘Warning’

Implantable medical devices are often programed by radio frequency from outside the body. We’re talking about things like pacemakers, internal defibrillators, spinal cord simulators amongst other devices.

The example devices I cited above send little electrical shocks to various parts of your body (the heart in the case of the first two and the cord in the case of the latter). The generators that send the electricity can be programed to send various energy levels or to send at various frequencies or to send to various electrodes. There are a whole host of ‘options’ which can be customized. When you need to customize those options you don’t want to have to open up the patient and physically fiddle with the implanted generator.

Instead, these devices come with little (often wand shaped) computers, which you can put over the site of the generator on the external skin. The computer sends radio signals to reprogram (or even turn on or off) the generator.

Turns out that communication between the computer and the generator for the pacemaker or defibrillator or SCS is in no way encrypted.

Hopefully you see where this is leading. A team of computer scientists from the University of Massachusetts – Amherst and the University of Washington built their own little computer to talk to a commercial pacemaker and successfully reprogrammed it (including turning it on and off) inside a simulated human body. They hacked a pacemaker.

Fu and Halperin said they used a cheap $1,000 system to mimic the control mechanism. It included a software radio, GNU radio software, and other electronics. They could use that to eavesdrop on private data such as the identity of the patient, the doctor, the diagnosis, and the pacemaker instructions. They figured out how to control the pacemaker with their device.

“You can induce the test mode, drain the device battery, and turn off therapies,” Halperin said.

This type of disclosure of ‘security holes’ by computer scientists on the good side of the aisle is common practice. The idea being they want to discover it, disclose it, force someone to fix it before someone malicious discovers the hack and does something bad with it.

Although they disclose the details of their endeavor entirely in their published paper and make their feat reproducible, it isn’t time to freak out. The hack is a complex and limited thing. It isn’t like someone on a NYC subway is going to have their pacemaker turned off tomorrow from across the car. Still, it is something serious which poses a small but real risk for patients and a liability for device makers.