WHEN government officials talk about cyber-attacks, they tend to warn of power stations being shut down, planes falling from the sky or financial markets being unable to function. America’s Food and Drug Administration has just issued a warning that is rather more personal in nature: that cyber-attacks on medical devices and hospital systems could put patients’ lives in danger. Just how vulnerable are medical devices to malicious hackers?
More than half the medical devices sold in America (the world’s largest health-care market) rely on software. A pacemaker may depend on more than 80,000 lines of code to keep it going, and a magnetic-resonance imaging (MRI) scanner more than 7m lines. That makes bugs and security flaws inevitable. In the 1980s a bug in the software of one type of radiotherapy machine caused massive overdoses of radiation to be delivered to several patients, killing at least five of them. In dozens of cases, viruses have infected the computers that control X-ray machines and laboratory equipment, though not as part of a deliberate atttack. And this is not the only evidence that sabotage is a real possibility, particularly in the case of devices that are networked or remotely configurable.
Last year researchers at McAfee, a computer-security firm, said they had found a way to subvert an implanted insulin pump to make it deliver 45 days’ worth of insulin in one go. And a paper published in 2008 by a team led by Kevin Fu, a computer scientist now at the University of Michigan, showed how an implantable defibrillator could be remotely reprogrammed either to withhold therapy or to deliver unnecessary shocks. The underlying problem, according to Dr Fu, is that when it comes to testing their software, device manufacturers lack the safety culture found in other high-risk industries such as avionics. One elementary error, which afflicts many devices, is that they contain hard-coded passwords, according to an alert issued by the Department of Homeland Security on June 13th.
Although there are no known examples of cyber-attacks on medical devices causing harm, in short, such attacks are entirely possible. When it comes improving the security of the software that controls medical devices, however, one difficulty is that the software in most devices is closed and proprietary. This prevents rival manufacturers from copying it, but also means that security researchers cannot scrutinise it for flaws. Greater use of open-source software might be one way to improve reliability and security. The FDA requires manufacturers to report security breaches, and has now called upon them to review and improve their security procedures. But it still leaves it primarily up to manufacturers to check the integrity of their software, rather than delving into the code itself. With a host of new medical devices in the pipeline that are essentially add-ons for smartphones, the need to ensure the security of the software components of medical devices will only become more urgent in the coming years.
Powered by Facebook Comments