The Medical Devices Most Vulnerable to Hackers

By Mike Kijewski
September 14, 2017


• Categories: 04-Product Design & Development, Combination Products, RC - Medtech Regulatory Resource Center

Many medical devices aren’t obvious targets for hackers. Scalpels and cardiac stents are just pieces of metal. As computer technology gets smaller and more powerful, however, even these devices are becoming computerized.

An ultrasonic scalpel and “smart stents” are just two of the IoT connected medical devices of the future. What other kinds of devices are easy targets for today’s hackers?

1: Anything running windows

I’m not usually a fan of medical devices running Windows as an operating system. An OS that has something called a “blue screen of death” should immediately be eliminated as suitable technology for medical devices. That said, Windows is ubiquitous and can be found in everything from CT scanners to drug infusion pumps. The recent WannaCry ransomware attack that debilitated the UK’s NHS hospital system was mainly powered by a Windows vulnerability discovered by the NSA. If a medical device runs Windows, the manufacturer needs robust strategies in place to apply the security patches Microsoft releases quickly, and will for many years to come.

2: Devices that are “cloud connected”

Clinicians can provide faster and more effective interventions if the medical devices their patients use actively send data to the cloud, pushing notifications to doctors and nurses. Medical device companies can also do a better job supporting these devices in the field if the device can “phone home” with performance data. The risk here is that any device connected to the internet then becomes a prime target for hackers.

Many implantable medical devices, like pacemakers and ICDs, have companion devices that sit by a patient’s bedside. These devices send data about the patient’s condition to the cloud and then to the patient’s medical team. Last year, security researchers found vulnerabilities in St. Jude’s Merlin at-home device that resulted in a recall.

Most bedside infusion pumps used to deliver everything from IV nutrients to chemotherapy drugs have Ethernet ports enabling remote administration of these devices. In 2015, security researchers discovered a vulnerability that would allow a hacker to deliver a fatal dose of a drug to a patient. While there are arguments about whether this vulnerability required physical access to the device, I don’t think anyone would want to have an infusion pump with this type of vulnerability attached to their arm.

Security vulnerabilities in several medical imaging devices were found in August of 2017, most of which were related to software that enabled remote monitoring of these devices. The device vendor described these vulnerabilities as being “low skill exploits”.

It’s clear that the clinical benefits of internet-enabling medical devices are huge. Many patients are alive because of these tools. Device vendors, however, must begin including features that make devices harder to hack. Unfortunately, this costs vendors money and increases the time it takes to release new, improved versions of these devices.

3: Devices using Bluetooth

Medical devices are frequently designed to send data to other nearby devices. Bluetooth Low Energy (BLE) is a wireless communication protocol that makes it easy for devices within a few feet of each other to share data. The fact that most smartphones are Bluetooth-enabled yields some very compelling use cases.

Caretaker Medical is working on a Bluetooth-enabled patient vital sign monitor, making it easier to detect clinically meaningful changes in a patient’s condition both inside the hospital and after discharge. Vital sign monitoring is such an obvious use case for Bluetooth that the BLE V4.0 engineering specification included data fields specifically for vital sign monitoring.

Patients with diabetes must monitor their blood glucose; being able to do so on their smartphones makes the management of their disease much easier. Most modern glucose monitors have companion smartphone apps allowing patients to log data and receive alerts, all powered by a Bluetooth connection between their phone and their glucose monitor.

BLE can be configured to take advantage of encryption “out of the box”, but researchers have found vulnerabilities that would allow a hacker near the devices to decrypt any future communications. The good news is a hacker would need to be reasonably close to a BLE device in order to hack it. The bad news is addressing some of these security vulnerabilities would require major changes to the software or even a hardware upgrade.

Why do hackers target medical devices, anyways?

In an episode of the hit television show “Homeland”, the vice president has his pacemaker hacked and dies from a heart attack. Now, this is Hollywood, but it’s entirely possible that a “Homeland”-esque scenario of a terrorist wanting to harm a specific person via a medical device hack will happen in the future; however, it is relatively improbable.

There are some non-obvious motivations for someone to target a medical device that are much more likely to happen, such as:

• Hackers could find a widespread vulnerability in a particular model of imaging device, allowing them to simultaneously deactivate thousands of devices until a ransom is paid.
• An unscrupulous drug company could intercept and falsify clinical trial data as it travels between a patient and a regulator.
• A network of connected medical devices could be inadvertently included in a “botnet,” using their computing resources to mine cryptocurrencies or take down a specific website.

In conclusion, as healthcare moves further out of the hospital and into the home, internet connectivity becomes mandatory, making previously un-hackable devices targets to cybersecurity threats. Device vendors need to think proactively about how to keep their devices and patients’ lives safe, all while not compromising clinical functionality.