Hacking medical devices: A review

Biomedical Sciences Instrumentation

Volumn 49, Issue , 2013, Pages 40-47

  Frenger, Paul ^a  

^a A WORKING HYPOTHESIS INC   (United States)

Author keywords

Defibrillator; Hacking; Implant; Insulin pump; Medical device; Pacemaker; Vagus nerve stimulator

Indexed keywords

BIOMEDICAL ENGINEERING; FORTH (PROGRAMMING LANGUAGE); HARDWARE; HEALTH HAZARDS; HEALTH RISKS; HOSPITAL DATA PROCESSING; IMPLANTS (SURGICAL); INSULIN; MANUFACTURE; PACEMAKERS; PERSONAL COMPUTING; PUMPS;

GOVERNMENTAL AGENCY; IMPLANTABLE DEFIBRILLATORS; INSULIN PUMPS; MEDICAL DEVICE DESIGN; MEDICAL DEVICES; PROFESSIONAL GROUPS; UNAUTHORIZED ACCESS; VAGUS NERVE;

DEFIBRILLATORS;

BIOMEDICAL ENGINEERING; COMPUTER; COMPUTER PROGRAM; GOVERNMENT; HUMAN; IMPLANTABLE CARDIOVERTER DEFIBRILLATOR; INSULIN PUMP; MEDICAL DEVICE; MEDICAL DEVICE REGULATION; REVIEW;

EID: 84897097823     PISSN: 00678856     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Review

References (54)

1. "Software weaknesses can cause loss of lives in medical industry." Associated Press, 2012 June 26. Available: http://www.mdtmag.com/news/2012/06/software-weaknesses-can-cause-loss-lives-medical-industry.
2. Arney D, Venkatasubramanian KK, Sokolsky O, Lee I, "Biomedical devices and systems security." Conf Proc IEEE Eng Med Biol Soc, 2011: pg.2376-2379.
3. Wirth A, "Cybercrimes pose growing threat to medical devices." Biomed Instrum Technol, 2011 Jan-Feb; 45 (1): pg.26-34.
4. Grossklos M, "Wireless power solutions for medical technology." Medical Design Briefs, 2012 Nov: pg.14-16.
5. Deffree S, "Hacker exposes pacemaker security flaws that allow deadly shock." EDN Magazine, 2012 Oct 18. Available: http://www.edn.com/electronics-blogs/now-hear-this/4398923/Hacker-exposes-pacemaker-securityflaws- that-allows-deadly-shock.
6. Benedict B, Keyes R and Sauls FC, "The insulin pump as murder weapon: a case report." Am J Forensic Med Pathol, 2004 Jun; 25 (2): pg.159-160.
7. Robertson J, "Hacker Shows Off Lethal Attack By Controlling Wireless Medical Device." 2012 Feb 29. Bloomberg Tech Weblog. Available: http://go.bloomberg.com/tech-blog/2012-02-29-hacker-shows-off-lethalattack- by-controlling-wireless-medical-device.
8. Feder BJ, "A Heart Device Is Found Vulnerable to Hacker Attacks." New York Times Archive, 2008 Mar 12. Available: http://www.nytimes.com/2008/03/12/business/12heart-web.html?ref=business&_r=0.
9. IEEE 11073 Family Standards. Available: http://standards.ieee.org.
10. ISO 13485. Available: http://en.wikipedia.org/wiki/ISO_13485.
11. "Medical devices -- Application of risk management to medical devices." ISO 14971:2007. Available: http://www.iso.org.
12. "Medical device software -- Software life cycle processes." IEC 62304:2006. Available: http://www.iso.org.
13. Stein T and Dupree D, "Achieving medical device software compliance under IEC 62304." Business Performance Associates Webinar, 2012 May 24.
14. "Application of risk management for IT-networks incorporating medical devices -- Part 1: Roles, responsibilities and activities." IEC 80001-1:2010. Available: http://www.iso.org.
15. Mense A, Sauermann S, Gerbovic G, Frohner M, Pohn B, Bruckner R, Urbauer P, Eckkrammer F, Wahl H, "Usage of international standards for integrating extramural monitoring and personal health device data into medical information infrastructure." Stud Health Technol Inform, 2010; 160 (Pt 1): pg.550-553.
16. "Medical Devices: Overview of Device Regulation." FDA. Available: http://www.fda.gov/MedicalDevices/ DeviceRegulationandGuidance/Overview/default.htm.
17. "Medical Devices: Medical Device Data Systems, Dept of Health and Human Services, Food And Drug Admin, 21 CFR Part 880, Final Rule." Federal Register, 2011 Feb 15; 76 (31): pg.8637-8649.
18. "FDA Proposes Unique Device Identification Regulations for Medical Devices." Bio-Medicine.org. Available: http://www.mdtmag.com/news/2012/07/fda-proposes-unique-device-identification-regulations-medical-devices.
19. "Enabling 21 CFR Part 11 Compliance." Epicor White Paper, pg.1-12. Available: http://www.epicor.com/ nobusinessbarriers/21CFRCompliance/Pages/welcome.aspx.
20. "Anti-malware software and medical devices." Health Devices, 2010 Oct; 39 (10): pg.360-365.
21. "Software glitches leave Navy Smart Ship dead in the water." Government Computer News, 1998 Jul 13. Available: http://gcn.com/Articles/1998/07/13/Software-glitches-leave-Navy-Smart-Ship-dead-in-the-water.
22. Paoli C, "Hacker selling Java Zero-Day vulnerability online." Application Development Trends, 2012 Nov 29. Available: http://adtmag.com/articles/2012/11/29/java-hole-sold.aspx.
23. "US Government tells computer users to disable Java." Yahoo! News, Associated Press. Available: http://news.yahoo.com/us-government-tells-computer-users-disable-java-010200371.html.
24. Fei Hu, Qi Hao, Lukowiak M, Qingquan Sun, Wilhelm K, Radziszowski S, Yao Wu, "Trustworthy data collection from implantable medical devices via high-speed security implementation based on IEEE 1363." IEEE Transactions on Information Technology in Biomedicine, 2010 Nov; 14 (6): pg.1397-1404.
25. Moon J, "Choosing the Right OS for your Medical Device." Medical Electronics Design, 2011 March 16. Available: http://www.medicalelectronicsdesign.com/article/choosing-right-os-your-medical-device.
26. "QNX Neutrino RTOS Certified Plus is first RTOS to achieve both safety and security certification." Embedded.com. 2011 Dec 15. Available: http://www.embedded.com/electronics-products/electronic-productreviews/ embedded-tools/4233316/QNX-Neutrino-RTOS-Certified-Plus.
27. Radcliffe J, "Issues with embedded device disclosures: helping vendors improve their security." Meds Magazine, 2012 Oct, pg.1-5. Available: http://medsmagazine.com/2012/10/issues-with-embedded-device-disclosureshelping- vendors-improve-their-security.
28. Monaco A, "Keeping hackers out of implanted medical devices: researchers find way to prevent attacks on wireless medical equipment." IEEE The Institute, 2012 July 16. Available: http://theinstitute.ieee.org/ technology-focus/technology-topic/keeping-hackers-out-of-implanted-medical-devices.
29. Atmel CryptoRF Devices. Available: http://www.atmel.com/products/other/securerf/default.aspx.
30. Microchip Technology KeeLoq Authentication Products. Available: http://www.microchip.com.
31. Maxim MAX32590 DeepCover Secure Microcontroller with ARM926EJ-S Processor Core. Available: http://www.maximintegrated.com/datasheet/index.mvp/id/7538.
32. Ironkey Trusted Access Cryptochip. Available: https://www.ironkey.com/hardware-encryption.
33. Trusted Computing Group Information. Available: http://www.trustedcomputinggroup.org/developers/ trusted_platform_module/faq.
34. Comparison of CPU architectures. Available: http://en.wikipedia.org/wiki/Comparison_of_CPU_architectures.
35. Rather E, Colburn D, Moore C, "The evolution of Forth." ACM SIGPLAN Notices, 1993 March, 28 (3): pg.177-199.
36. Frenger P, "Potential Unrealized: the MicroMED Advisor", ACM Sigplan Notices, 2006 Dec, pg.10-16.
37. Frenger P, "Semiconductor Memory Cards for FORTH Systems", Rochester Forth Conf, 8, 1988, pg.60-61.
38. Frenger P, "String Pattern Matching in UR/Forth", ACM SIGForth Newsletter, 2 (1), 1990, pg.15-18.
39. Frenger P, "Extreme Forth", ACM Sigplan Notices, 2001 Feb, pg.20-23.
40. Frenger P, "Forth and the Open Terminal Architecture", ACM Sigplan Notices, 1999 Feb, pg.36-39.
41. FirmWorks: The Open Firmware Source. Available: http://firmworks.com.
42. CodeGen, Inc. Available: http://CodeGen.com.
43. Welcome to OpenBios. Available: http://www.openfirmware.info/Welcome_to_OpenBIOS.
44. Frenger P, "Robot Operating Systems", Workshop on Automation and Robotics, 2009, NASA/JSC Houston, pg.2-3.
45. Frenger P, "Human Nervous System Function Emulator", Biomed Sci Instrum, 36, 2000, pg.289-294.
46. Frenger P, "Human Brainstem Emulator Using an Extensible Multicore Processor Network", Workshop on Automation and Robotics, 2008, NASA/JSC Houston, pg.5.
47. Frenger P, "Emulating i", Biomed Sci Instrum, 46, 2010, pg.26-32.
48. Koopman P, "Architecture of the Novix NC4016", Ch.4.4, Stack Computers: the new wave, 1989. Available: http://www.ece.cmu.edu/~koopman/stack_computers/index.html.
49. Frenger P, "A Software-Controlled EKG Simulator", Biomed Sci Instrum, 27, 1991, pg.227-230.
50. GreenArrays GA144 Chip. Available: http://www.greenarraychips.com/home/documents/greg/PB001-100503- GA144-1-10.pdf.
51. Parnas D, "Inside Risks: Risks of Undisciplined Development", Communications of ACM, 53 (10), 2010 Oct: pg.25-27.
52. "Remembering Bob Pease, TIs legendary analog expert". Available: http://www.ti.com/ww/en/bobpease/ index.html.
53. Marks E, "Addressing compliance mandates with product lifecycle management." Medical Design, 12 (8), 2012 Oct: pg.10-14.
54. "Medtech focus on excise tax." PricewaterhouseCoopers LLC. Available: http://www.pwc.com/us/en/healthindustries/publications/medtech-focus-on-excise-tax.jhtml.