Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
8/30/2017
08:15 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

St. Jude Pacemaker Gets Firmware Update 'Intended as a Recall'

The devices that were the subject of a vulnerability disclosure debate last summer now have an FDA-approved fix.

Abbott Laboratories, the new owner of St. Jude Medical (STM), has issued a firmware update for STM pacemaker devices that addresses vulnerabilities exposed one year ago by security research firm MedSec.  

As the US Food & Drug Administration (FDA) stated in a safety communication Tuesday, the FDA approved last week "a firmware update that is now available and is intended as a recall, specifically a corrective action, to reduce the risk of patient harm due to potential exploitation of cybersecurity vulnerabilities for certain Abbott (formerly St. Jude Medical) pacemakers." 

The fix is largely to shore up weak RF protocol security that left RF-enabled pacemakers vulnerable to remote unauthorized access. According to Abbott, the firmware update is part of a software release for the [email protected] monitoring device that also includes "data encryption, operating system patches, and disabling network connectivity features." As of Monday, all new devices manufactured will have the new firmware installed already.

This is not exactly a call for emergency rips-and-replaces of all patients' pacemakers, though. According to the FDA safety communication Tuesday, "The FDA and Abbott do NOT recommend prophylactic removal and replacement of affected devices."

Patients must visit their healthcare provider in person to receive the firmware update. Abbott Laboratories advises healthcare providers discuss the potential risks with patients first — both the security risks of attackers exploiting vulnerable firmware and potential complications that could be caused during the firmware update process.

The advisory cites these rates of malfunctioning during the process:

  • "reloading of previous firmware version due to incomplete update (0.161%)
  • loss of currently programmed device settings (0.023%),
  • complete loss of device functionality (0.003%),
  • and loss of diagnostic data (not reported)."

Roughly 465,000 devices are affected by this firmware update, according to the FDA. Joshua Corman, director of the Atlantic Council's Cyber Statecraft Initiative and member of the US Department of Health and Human Service's Health Care Industry Cybersecurity Task Force, took to Twitter to show how those malfunction rates could look in human numbers:   

"[Tuesday's] safety communication is part of the FDA's ongoing work with Abbott to ensure they are properly addressing identified cybersecurity risks and adequately protecting their devices against potential future cybersecurity vulnerabilities," said William Maisel, acting director of the Office of Device Evaluation and chief scientist in the FDA's Center for Devices and Radiological Health, in a statement. "Because all networked medical devices are potentially vulnerable to cybersecurity threats, the FDA has been working diligently with device manufacturers and other stakeholders to ensure the benefits of medical devices to patients continue to outweigh any potential cybersecurity risks."

"Earlier in the year, the FDA acknowledged that there were real vulnerabilities in the devices but didn't recommend doing anything because there was no firmware fix and the device benefits far outweighed swapping the device for something more secure," says Veracode CTO Chris Wysopal. "Now that there is a fix from the manufacturer, they are recommending a firmware update on the patient's next visit to their doctor.  

"What we are seeing," says Wysopal, "is the same type of risk calculus around safety that goes into a motor vehicle recall being used in a medical device recall. If there was a more serious risk to the medical device, we might see the FDA advising patients to immediately visit their doctor. This situation shows with IoT safety and security are becoming synonymous in many cases."

The product recall is a tangible result one year after MedSec chose a controversial method of vulnerability disclosure. Rather than full public disclosure or cooperative disclosure, MedSec partnered with Muddy Waters to release only part of the vulnerability information and then short-sell St. Jude Medical, allowing them to profit off a drop in the manufacturer's stock. (MedSec CEO Justine Bone has since said she thought it was the right move but would not plan to do it again.)

There was debate about whether MedSec's decision had been wise both ethically and strategically. Had it released too much information, or not enough? Would other medical device manufacturers be scared into improving security after this example, or would the event simply jeopardize trusted relationships built with other security researchers? Would this create an entirely new, expensive trend in vulnerability disclosure? MedSec said St. Jude put profits over patients, but critics thought MedSec had done the same itself.

One year later, the questions remain. The vulnerability now has an FDA-approved fix, but that might also have been the case if MedSec had gone through the FDA to begin with last summer.

"Consumers are just waking up to the fact that medical devices can get recalls," says Wysopal, who recently co-presented a session with Bone at Black Hat USA 2017 about using the market to create better security. "This Abbott event will cause medical device manufacturers to get ahead of security problems and put more effort into designing and testing their products to be free from security issues. This is the market working. It is unfortunate that patients have to be at risk before many businesses learn this lesson."

Related Content:

 

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Click for more info and to register.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
9/5/2017 | 3:06:12 PM
Unsettling
This writer has an implanted BOSTON SCIENTIFIC Defibulator - wireless access point at home to report data to Emory Hospital.  This particularly strikes home for me.  Vast implications in some ways. 
Duncan Jones
50%
50%
Duncan Jones,
User Rank: Author
8/31/2017 | 3:05:14 AM
If you think it's bad now...
Things will get even more interested in a post-quantum world, where we could see attacks on individuals who otherwise believed they had secure medical implants. Devices are being inserted now that won't see the light of day again for 15-20 years. I'd be amazed if they are being designed with the security challenges of two decades hence in mind.
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.