Researchers devise new way to hack-proof implantable medical devices
Concerned about the vulnerability of wireless medical devices to mischievous or ill-intentioned hackers, researchers have produced a prototype firewall.
Anand Raghunathan, PhD, a professor of electrical and computer engineering at Purdue University in West Lafayette, Ind., worked with peer Niraj K. Jha, PhD, of Princeton University in New Jersey and two Princeton electrical engineering grad students to create a system for protecting heart patients’ pacemakers and diabetics’ glucose monitoring and insulin delivery systems. The system, MedMon, also could be used to safeguard such devices in development as brain implants to control epilepsy and “smart prosthetics” operated using electronic chips, the researchers said in prepared remarks.
The prototype firewall can monitor communications going into and coming out of any implantable or wearable medical device equipped with wireless transmitters and receivers for performing diagnostics and downloading data. If it detects anomalous activity, it can alert the user or block “malicious packets” from reaching the medical device by using electronic jamming similar to technology used in military systems, the researchers explained.
“It’s an additional device that you could wear, so you wouldn’t need to change any of the existing implantable devices,” Raghunathan said. “This could be worn as a necklace, or it could be integrated into your cell phone, for example.”
MedMon is a proof-of-concept device, which would need to be miniaturized, the research team said, adding that they have filed a provisional patent application on their concept.
The team previously had demonstrated how medical devices could be hacked. “What motivated us to work on this problem was the ease with which we were able to break into wireless medical systems,” said Raghunathan, who is a member of the Center for Implantable Devices, part of Purdue’s Weldon School of Biomedical Engineering.
The potential problem drew wide attention twice last year—first when diabetic Jerome Radcliffe tweaked the dosage levels on his own pump at the Defcon hacking conference, prompting a call to action from federal lawmakers, then again when professional hacker Barnaby Jack of ATM-hacking fame showed how easy it is to deliver a lethal dose of insulin at the Hacker Halted security conference.
Threat Post, the online news service of security-software vendor Kaspersky, reported in October that Radcliffe’s hack had required the attacker to know the unique numeric device number of the targeted implantable pump, while Barnaby’s technique upped the ante by allowing an attacker to compromise any vulnerable device within 300 feet even without knowing its unique device ID.
Raghunathan said MedMon cannot solve privacy issues. “Someone could still learn that you have a medical device, but hopefully they are not going to be able to do anything bad to you,” he added. “It is extremely difficult to make a system completely impregnable.”
The researchers previously described two other potential solutions in a paper presented at last year’s IEEE Healthcom conference. One approach is based on a cryptographic technique now seen in automotive keyless entry systems and the other would use “body-coupled communication,” which involves transmitting signals on a patient’s skin.
The MedMon research is funded by the National Science Foundation.
Anand Raghunathan, PhD, a professor of electrical and computer engineering at Purdue University in West Lafayette, Ind., worked with peer Niraj K. Jha, PhD, of Princeton University in New Jersey and two Princeton electrical engineering grad students to create a system for protecting heart patients’ pacemakers and diabetics’ glucose monitoring and insulin delivery systems. The system, MedMon, also could be used to safeguard such devices in development as brain implants to control epilepsy and “smart prosthetics” operated using electronic chips, the researchers said in prepared remarks.
The prototype firewall can monitor communications going into and coming out of any implantable or wearable medical device equipped with wireless transmitters and receivers for performing diagnostics and downloading data. If it detects anomalous activity, it can alert the user or block “malicious packets” from reaching the medical device by using electronic jamming similar to technology used in military systems, the researchers explained.
“It’s an additional device that you could wear, so you wouldn’t need to change any of the existing implantable devices,” Raghunathan said. “This could be worn as a necklace, or it could be integrated into your cell phone, for example.”
MedMon is a proof-of-concept device, which would need to be miniaturized, the research team said, adding that they have filed a provisional patent application on their concept.
The team previously had demonstrated how medical devices could be hacked. “What motivated us to work on this problem was the ease with which we were able to break into wireless medical systems,” said Raghunathan, who is a member of the Center for Implantable Devices, part of Purdue’s Weldon School of Biomedical Engineering.
The potential problem drew wide attention twice last year—first when diabetic Jerome Radcliffe tweaked the dosage levels on his own pump at the Defcon hacking conference, prompting a call to action from federal lawmakers, then again when professional hacker Barnaby Jack of ATM-hacking fame showed how easy it is to deliver a lethal dose of insulin at the Hacker Halted security conference.
Threat Post, the online news service of security-software vendor Kaspersky, reported in October that Radcliffe’s hack had required the attacker to know the unique numeric device number of the targeted implantable pump, while Barnaby’s technique upped the ante by allowing an attacker to compromise any vulnerable device within 300 feet even without knowing its unique device ID.
Raghunathan said MedMon cannot solve privacy issues. “Someone could still learn that you have a medical device, but hopefully they are not going to be able to do anything bad to you,” he added. “It is extremely difficult to make a system completely impregnable.”
The researchers previously described two other potential solutions in a paper presented at last year’s IEEE Healthcom conference. One approach is based on a cryptographic technique now seen in automotive keyless entry systems and the other would use “body-coupled communication,” which involves transmitting signals on a patient’s skin.
The MedMon research is funded by the National Science Foundation.
Dave P. has worked in journalism, marketing and public relations for more than 30 years, frequently concentrating on hospitals, healthcare technology and Catholic communications. He has also specialized in fundraising communications, ghostwriting for CEOs of local, national and global charities, nonprofits and foundations.