Featured Research

from universities, journals, and other organizations

Implantable Medical Devices May Expose Patients To Security, Privacy Risks

Date:
March 17, 2008
Source:
University of Washington
Summary:
Implantable cardiac defibrillators that are equipped with wireless technology are vulnerable to having private medical information extracted -- and even having the devices reprogrammed -- without the patients' knowledge. Not only does this pose a potential security risk, it could also endanger patients' physical safety.

Tadayoshi Kohno (far right) and doctoral student Daniel Halperin (far left), both in the UW's Department of Computer Science & Engineering, worked with collaborators at the University of Massachusetts Amherst to uncover security flaws in implantable medical devices. A cardiologist at Harvard University (not shown) also participated in the experiment.
Credit: Ben Barnhart

Some medical devices such as implantable cardiac defibrillators and pacemakers are now equipped with wireless technology, allowing for remote device checks and freeing patients from repeated doctor visits. But this convenience may come with unanticipated risks. A team of researchers from three leading universities has demonstrated that patients' private medical information could be extracted and their devices reprogrammed without the patients' authorization or knowledge.

There has never been a reported case of a patient with an implantable cardiac defibrillator or pacemaker being targeted by hackers, and the researchers emphasized that the study was designed to identify and prevent future problems. Undertaking the study required a high level of technical expertise, and the published paper omits certain details in methodology that prevents the findings from being used for anything other than improving patient security and privacy.

The study was led by two computer scientists, Tadayoshi Kohno of the University of Washington and Kevin E. Fu of the University of Massachusetts Amherst, and cardiologist Dr. William H. Maisel of the Beth Israel Deaconess Medical Center and Harvard Medical School.

Dr. Maisel, director of the Medical Device Safety Institute at Beth Israel Deaconess Medical Center in Boston, notes, "One of the purposes of this research is to encourage the medical device industry to think more carefully about the security and privacy of patient information, particularly as wireless communication becomes more common. Fortunately, there are some safeguards already in place, but device manufacturers can do better."

The team expects this issue to take on greater importance as implantable cardiac defibrillators operate wirelessly at greater distances. These devices typically receive short-range wireless signals over several feet, but new technologies are expanding that reach even farther, creating the potential for information to be intercepted en route.

"We hope our research is a wake-up call for the industry," said Kohno, an assistant professor of computer science and engineering at the University of Washington. "In the 1970s, the Bionic Woman was a dream, but modern technology is making it a reality. People will have sophisticated computers with wireless capabilities in their bodies. Our goal is to make sure those devices are secure, private, safe and effective."

Fu, an assistant professor of computer science at UMass Amherst, noted that the study developed several prototype defenses. "One of our primary contributions is the invention of three defense mechanisms that require no battery power, making them potentially easy to incorporate in the devices without extensive redesigning. While there has been much research that explores the biological safety of implantable medical devices, there is limited understanding about the related issues of wireless security and privacy. Understanding the security and privacy of implantable devices is essential for protecting the nation's health and cyber infrastructure."

The researchers' experiments used an implantable cardiac defibrillator, a sophisticated device that automatically regulates the heart beat by sending small electrical signals to the heart to stimulate the heart rate or by delivering a large shock to restore a potentially fatal heart rhythm back to normal. Implantable defibrillators have improved survival in selected patients at risk for sudden cardiac death, and millions of the devices have been implanted worldwide. The model used in the researchers' experiment contained computers and radios that allow health-care practitioners to diagnose patients, read and write private medical information, and adjust the device's therapy settings wirelessly.

In computer laboratory bench tests, the research team used an inexpensive software radio to intercept and capture signals sent from the implantable device. They were able to obtain detailed information about a hypothetical patient, including name, diagnosis, date of birth and medical ID number. Researchers could determine the make and model of the device and access real-time electrocardiogram results as well as data on the hypothetical patient's heart rate and cardiac activity.

The team then mounted several attacks. Researchers were able to turn off the therapy settings stored in the implantable device, rendering it incapable of responding to dangerous cardiac events. Additional commands were delivered, resulting in the delivery of a shock that could induce ventricular fibrillation, a potentially lethal arrhythmia.

Three deterrence and prevention mechanisms were developed as part of the study, including a notification device that audibly alerts patients of security sensitive events, a device that authenticates requests for access from outside devices and a vibrating device that patients can sense. All three mechanisms require no power from the battery, and one of them was evaluated for effectiveness in a substance similar to human tissue.

Because the team studied one common model of implantable cardiac defibrillator, the susceptibility of similar devices to privacy and security risks is uncertain. The researchers believe future studies are needed to assess potential risks associated with other implantable devices equipped with wireless technology. The researchers feel strongly that nothing in their report should deter patients from receiving these devices if recommended by their physician. The implantable cardiac defibrillator is a proven, life-saving technology.

The research paper entitled "Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses," will be presented and published at the Institute of Electrical and Electronic Engineers Symposium on Security and Privacy in Oakland, Calif., May 19, 2008. In addition to the three principal investigators, student authors contributing to the paper are Daniel Halperin, Thomas S. Heydt-Benjamin, Benjamin Ransford, Shane S. Clark, Benessa Defend and Will Morgan.


Story Source:

The above story is based on materials provided by University of Washington. Note: Materials may be edited for content and length.


Cite This Page:

University of Washington. "Implantable Medical Devices May Expose Patients To Security, Privacy Risks." ScienceDaily. ScienceDaily, 17 March 2008. <www.sciencedaily.com/releases/2008/03/080312134128.htm>.
University of Washington. (2008, March 17). Implantable Medical Devices May Expose Patients To Security, Privacy Risks. ScienceDaily. Retrieved August 28, 2014 from www.sciencedaily.com/releases/2008/03/080312134128.htm
University of Washington. "Implantable Medical Devices May Expose Patients To Security, Privacy Risks." ScienceDaily. www.sciencedaily.com/releases/2008/03/080312134128.htm (accessed August 28, 2014).

Share This




More Health & Medicine News

Thursday, August 28, 2014

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

CDC Director On Ebola Outbreak: 'It's Worse Than I Feared'

CDC Director On Ebola Outbreak: 'It's Worse Than I Feared'

Newsy (Aug. 28, 2014) CDC director Tom Frieden says the Ebola outbreak is even worse than he feared. But he also said there's still hope to contain it. Video provided by Newsy
Powered by NewsLook.com
Treadmill 'trips' May Reduce Falls for Elderly

Treadmill 'trips' May Reduce Falls for Elderly

AP (Aug. 28, 2014) Scientists are tripping the elderly on purpose in a Chicago lab in an effort to better prevent seniors from falling and injuring themselves in real life. (Aug.28) Video provided by AP
Powered by NewsLook.com
Japan's Golden Generation Shows No Sign of Slowing Down

Japan's Golden Generation Shows No Sign of Slowing Down

AFP (Aug. 27, 2014) For many people in the autumn of their lives, walking up stairs is the biggest physical challenge they face. But in Japan, race tracks, hammer or pole vault await competitors at the Kyoto Masters, some of them more than 100 years old. Duration: 02:32 Video provided by AFP
Powered by NewsLook.com
Mini Pacemaker Has No Wires

Mini Pacemaker Has No Wires

Ivanhoe (Aug. 27, 2014) Cardiac experts are testing a new experimental device designed to eliminate major surgery and still keep the heart on track. Video provided by Ivanhoe
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:

Breaking News:
from the past week

In Other News

... from NewsDaily.com

Science News

Health News

Environment News

Technology News



Save/Print:
Share:

Free Subscriptions


Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

Get Social & Mobile


Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

Have Feedback?


Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
Mobile: iPhone Android Web
Follow: Facebook Twitter Google+
Subscribe: RSS Feeds Email Newsletters
Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins