Pacemakers and implantable cardiac defibrillators: Software radio - - PowerPoint PPT Presentation

▶
pacemakers and implantable cardiac defibrillators
SMART_READER_LITE
LIVE PREVIEW

Pacemakers and implantable cardiac defibrillators: Software radio - - PowerPoint PPT Presentation

Aug 05, 2023 47 likes •507 views

Pacemakers and implantable cardiac defibrillators: Software radio attacks and zero-power defenses Ben Ransford ransford@cs.umass.edu U. Washington: UMass Amherst: BIDMC/ D. Halperin T. S. Heydt-Benjamin Harvard: T. Kohno S. Clark B.

slide-1
SLIDE 1
  • U. Washington:
  • D. Halperin
  • T. Kohno

UMass Amherst:

  • T. S. Heydt-Benjamin
  • S. Clark B. Defend
  • W. Morgan K. Fu

BIDMC/ Harvard:

  • W. H. Maisel, MD

Pacemakers and implantable cardiac defibrillators: Software radio attacks and zero-power defenses

Ben Ransford

ransford@cs.umass.edu

http://secure-medicine.org/

Ben Ransford, IEEE Security & Privacy ’08

slide-2
SLIDE 2

Ben Ransford, IEEE Security & Privacy ’08

Neurostimulator Drug pump Prosthetic limb Pharmacy

  • n a chip

Photos: Medtronic, Hearing Loss Assoc. of WA, St. Jude Medical, Otto Bock

2

Cardiac Device

slide-3
SLIDE 3

Ben Ransford, IEEE Security & Privacy ’08

Neurostimulator Drug pump Prosthetic limb Pharmacy

  • n a chip

Photos: Medtronic, Hearing Loss Assoc. of WA, St. Jude Medical, Otto Bock

2

Cardiac Device

slide-4
SLIDE 4

Ben Ransford, IEEE Security & Privacy ’08

Why Care About IMDs?

  • Common devices
  • Sophisticated devices with radios
  • Perform vital functions inside people
  • Are they secure?

3

slide-5
SLIDE 5

Ben Ransford, IEEE Security & Privacy ’08

Trends in Cardiac Devices

Implantable defibrillator, 2003

  • Complex therapies
  • Radio interfaces
  • Monitoring over Internet
  • Algorithms for problem detection
  • More storage, better CPU, ...

4

slide-6
SLIDE 6

Ben Ransford, IEEE Security & Privacy ’08

An Implanted Computer

... which is wirelessly reprogrammable ... and contains personal data.

1990–2002: ~2.6 million (US) [JAMA 2006]

5

Photos: oldcomputers.net, Wikipedia (“Heart”)

slide-7
SLIDE 7

Ben Ransford, IEEE Security & Privacy ’08

Contributions

  • Study of a real implantable device
  • Attacks with software radio
  • Prototype energy harvesting defenses

6

slide-8
SLIDE 8

Ben Ransford, IEEE Security & Privacy ’08

The Next 20 Minutes

  • 1. How secure is a real device?
  • 2. Why is this non-trivial to get right?
  • 3. Where should we go from here?

7

slide-9
SLIDE 9

http://secure-medicine.org/

Ben Ransford, IEEE Security & Privacy ’08

#1: Analysis of a Real Device

8

slide-10
SLIDE 10

Ben Ransford, IEEE Security & Privacy ’08

We analyzed an ICD.

Heart

  • Implantable

Cardiac Defibrillator

  • Related to pacemaker
  • Large shock: resync heart
  • Monitors heart waveforms

9

slide-11
SLIDE 11

Ben Ransford, IEEE Security & Privacy ’08

Implantation Scenario

  • 1. Doctor sets patient info
  • 2. Surgically implants
  • 3. Tests defibrillation
  • 4. Ongoing monitoring

10

Photos: Medtronic; Video: or-live.com

slide-12
SLIDE 12

Ben Ransford, IEEE Security & Privacy ’08

Device Programmer

Implantation Scenario

  • 1. Doctor sets patient info
  • 2. Surgically implants
  • 3. Tests defibrillation
  • 4. Ongoing monitoring

10

Photos: Medtronic; Video: or-live.com

slide-13
SLIDE 13

Ben Ransford, IEEE Security & Privacy ’08

Implantation Scenario

  • 1. Doctor sets patient info
  • 2. Surgically implants
  • 3. Tests defibrillation
  • 4. Ongoing monitoring

10

Photos: Medtronic; Video: or-live.com

slide-14
SLIDE 14

Ben Ransford, IEEE Security & Privacy ’08

Implantation Scenario

  • 1. Doctor sets patient info
  • 2. Surgically implants
  • 3. Tests defibrillation
  • 4. Ongoing monitoring

Home monitor

10

Photos: Medtronic; Video: or-live.com

slide-15
SLIDE 15

Ben Ransford, IEEE Security & Privacy ’08

Attack #1: Steal Device Programmer

  • Insider attack
  • Thief can reverse engineer, modify...
  • Risk: get “root” on many implants

11

Issue: ICD’s trusted computing base is large.

Photo: Medtronic

slide-16
SLIDE 16

Ben Ransford, IEEE Security & Privacy ’08

Why Steal When You Can Build?

  • Software radio
  • GNU Radio software, $0
  • USRP board, $700
  • Daughterboards, antennas: $100

~10 cm (un-optimized)

12

slide-17
SLIDE 17

Ben Ransford, IEEE Security & Privacy ’08

Attack #2: Eavesdrop Private Info

13 Ben Ransford, IEEE Security & Privacy ’08

slide-18
SLIDE 18

Ben Ransford, IEEE Security & Privacy ’08

Attack #2: Eavesdrop Private Info

Diagnosis

13 Ben Ransford, IEEE Security & Privacy ’08

slide-19
SLIDE 19

Ben Ransford, IEEE Security & Privacy ’08

Attack #2: Eavesdrop Private Info

Diagnosis Hospital

13 Ben Ransford, IEEE Security & Privacy ’08

slide-20
SLIDE 20

Ben Ransford, IEEE Security & Privacy ’08

Attack #2: Eavesdrop Private Info

Diagnosis Implanting physician Hospital

13 Ben Ransford, IEEE Security & Privacy ’08

slide-21
SLIDE 21

Ben Ransford, IEEE Security & Privacy ’08

Attack #2: Eavesdrop Private Info

Diagnosis Implanting physician Hospital

Also: Device state Patient name Date of birth Make & model Serial no. ... and more

13 Ben Ransford, IEEE Security & Privacy ’08

slide-22
SLIDE 22

Ben Ransford, IEEE Security & Privacy ’08

Attack #2: Eavesdrop Private Info

In the future: Sophisticated devices may divulge a lot more data.

Challenge: Can we add encryption?

14

Photo: Medtronic

slide-23
SLIDE 23

Ben Ransford, IEEE Security & Privacy ’08

Attack #3: Sniff Vital Signs

500 1000 1500 2000 2500 3000 −1 −0.5 0.5 1

ICD emits reconstructible vital signs Issue: Vital signs can say plenty.

15

Eavesdropping setup

slide-24
SLIDE 24

Ben Ransford, IEEE Security & Privacy ’08

Attack #4: Drain Energy

  • Implant designed for infrequent radio use
  • Radio decreases battery lifetime

“Are you sleeping?” “No!”

16

slide-25
SLIDE 25

Ben Ransford, IEEE Security & Privacy ’08

Simple Replay Attacks

  • Ours: “Deaf” (transmit-only) attacks
  • Caveats: Close range; only one ICD model tested;

attacks not optimized; takes many seconds

~10 cm

17 Photo: Medtronic

slide-26
SLIDE 26

Ben Ransford, IEEE Security & Privacy ’08

Attack #5: Turn Off Therapies

  • “Stop detecting fibrillation.”
  • Device programmer would warn here

Issue: Can quietly change device state.

18

slide-27
SLIDE 27

Ben Ransford, IEEE Security & Privacy ’08

Attack #6: Affect Patient’s Physiology

  • Induce fibrillation which implant ignores
  • Again, at close range
  • In other kinds of implant:
  • Flood patient with drugs
  • Overstimulate nerves, ...

19

Issue: Puts patient safety at risk.

slide-28
SLIDE 28

http://secure-medicine.org/

Ben Ransford, IEEE Security & Privacy ’08

#2: Fundamental Challenges

20

slide-29
SLIDE 29

Ben Ransford, IEEE Security & Privacy ’08

Conventional Solutions?

How about... Non-trivial problem Authenticate device programmers? Key management is hard. Revocation? Encrypt all transmissions? Under what key? Must fail open!

21

slide-30
SLIDE 30

Ben Ransford, IEEE Security & Privacy ’08

Cannot fail closed

  • Closed: Don’t know the password? No admission!
  • Medical personnel need emergency access.
  • Challenge: design to fail open.

22

slide-31
SLIDE 31

Ben Ransford, IEEE Security & Privacy ’08

Security vs. Safety?

  • Tensions discussed in [IEEE Pervasive ’08]
  • Patient’s health is the top priority
  • We seek the sweet spots

23

slide-32
SLIDE 32

http://secure-medicine.org/

Ben Ransford, IEEE Security & Privacy ’08

  • 3. Defensive Directions

24

slide-33
SLIDE 33

Ben Ransford, IEEE Security & Privacy ’08

Prototype defenses against some of the attacks.

Main idea: defend without using battery.

25

slide-34
SLIDE 34

Ben Ransford, IEEE Security & Privacy ’08

B.Y.O.P.

  • WISP = RFID + computation [Ubicomp ’06]
  • WISPer = WISP + our code
  • “Maximalist” crypto [RFIDSEC ’07]
  • Prototype: 913 MHz RFID band

Goal: External party pays for power.

26

slide-35
SLIDE 35

Ben Ransford, IEEE Security & Privacy ’08

WISPer as Gatekeeper

  • Authenticate against WISPer
  • WISPer to ICD: “OK to use radio”
  • Acoustic patient notification
  • How to deter enemies? (Open question!)

27

External party WISPer Implant

1 2 3

slide-36
SLIDE 36

Ben Ransford, IEEE Security & Privacy ’08

How WISPer Could Work

  • Auxiliary device (possibly integrated)
  • Audible or tactile patient alert
  • Patient detects activity: am I in a clinic?
  • Fail open: sensible, tactile key exchange

28

slide-37
SLIDE 37

Ben Ransford, IEEE Security & Privacy ’08

Energy harvesting through tissue is possible.

Testing WISPer: Simulated Torso

29

1 cm bacon 6 cm chuck WISPer

slide-38
SLIDE 38

http://secure-medicine.org/

Ben Ransford, IEEE Security & Privacy ’08

Medical Devices Need Continued Attention!

30

slide-39
SLIDE 39

Ben Ransford, IEEE Security & Privacy ’08

Medical Device Trends

  • Further computerization of care
  • Longer-range communication
  • Cooperation among devices

31

Issue: All of these bring risks.

slide-40
SLIDE 40

Ben Ransford, IEEE Security & Privacy ’08

Related Work

  • [IEEE Pervasive ’08] D.

Halperin, T. S. Heydt- Benjamin, K. Fu, T. Kohno, and W. H. Maisel: Security and privacy for implantable medical devices. (January 2008)

  • [JAMA ’06] W. H. Maisel, M.

Moynahan, B. D. Zuckerman, T.

  • P. Gross, O. H. Tovar, D.-B.

Tillman, and D. B. Schultz: Pacemaker and ICD generator malfunctions: Analysis of Food and Drug Administration annual

  • reports. (JAMA 295(16))
  • [Ubicomp ’06] J. R. Smith, A. P.

Sample, P. S. Powledge, S. Roy, and A. Mamishev: A wirelessly- powered platform for sensing and computation.

  • [RFIDSEC ’07] H.-J. Chae, D. J.

Yeager, J. R. Smith, and K. Fu: Maximalist cryptography and computation on the WISP UHF RFID tag.

  • More in paper

32

slide-41
SLIDE 41

Ben Ransford, IEEE Security & Privacy ’08

Conclusions

  • Analysis of wirelessly controlled IMD
  • Methodologies & defensive directions
  • Software radio
  • Energy harvesting gatekeeper
  • Patient notification (deterrence)
  • Many open problems

http://secure-medicine.org/

33

slide-42
SLIDE 42

Ben Ransford, IEEE Security & Privacy ’08

Conclusions

  • Many open problems:
  • Balance safety & security
  • Key management
  • Attacks can be improved
  • Defenses can be improved

http://secure-medicine.org/

34

slide-43
SLIDE 43

Ben Ransford, IEEE Security & Privacy ’08

Non-Technical Challenges

  • Manufacturers beholden only to regulators
  • No security regulation
  • Safety & effectiveness are FDA’s mandate
  • No major interface between FDA & FCC

35

slide-44
SLIDE 44

Ben Ransford, IEEE Security & Privacy ’08 36

Yet some remarkable changes are on the horizon, said Dr. Larry Wolff, a UC Davis Medical School professor who specializes in implanting defibrillators. "I believe over time we could make programming changes on the telephone," he said, although that's not possible now.

Sacramento Bee, May 17, 2008

slide-45
SLIDE 45

Ben Ransford, IEEE Security & Privacy ’08 37

slide-46
SLIDE 46

Ben Ransford, IEEE Security & Privacy ’08 37