Security+ Guide To Network Security Fundamentals

What is the deadliest security attack that you can imagine? A virus that erases all the

contents of a hard disk drive? A malicious program that locks up files until the user

pays a “ransom” to have them released? The theft of millions of user passwords?

Although each of these attacks can be extremely harmful, the deadliest attacks

could result in the actual death of the victim. These deadly attacks are directed

against medical devices that sick patients rely upon to live.

An insulin pump is a small medical device worn by diabetics that administers insulin

as an alternative to multiple daily injections with an insulin syringe or pen. One secu-

rity researcher, himself a diabetic, demonstrated at a security conference a wireless attack on an insulin pump that could secretly change the delivery dosage of insulin to the patient.1 By scanning for wireless devices in a public space up to 300 feet

(91 meters), this researcher could locate vulnerable insulin pumps made by a specific

medical device manufacturer, and then force these devices to dispense fatal insulin

doses—just as an attacker could.2 Another security researcher “hacked” into a defibril-

lator used to stabilize heartbeats and reprogrammed it, and also disabled its power-

save mode so the battery ran down in hours instead of years. It is estimated that there

are more than 3 million pacemakers and 1.7 million Implantable Cardioverter Defibril-

lators (ICDs) in use today that are vulnerable to these types of wireless attacks.3 This

threat was so real that a former vice president of the U.S. had his defibrillator removed and replaced with one that lacked capabilities that an attacker might exploit.

Other serious concerns regarding medical devices have also surfaced. A vendor that

manufactures medical ventilators maintains a website from which software updates to

the ventilators can be downloaded and installed. A security researcher discovered that the website was infected with 48 viruses that could be installed on a user’s computer,

and 20 of the 347 pages of this website contained infections.4 And spreading medical device malware is not limited to infecting websites. Today devices that perform medi-cal imaging like computerized tomography (CT) scans automatically send scan results

as PDF file attachments to email accounts. This email capability can be highly vulnera-

ble and make an ideal entry point for an attacker to install medical device malware.

The U.S. Department of Homeland Security (DHS) has issued a report entitled

“Attack Surface: Healthcare and Public Health Sector.” This report says these attacks

are “now becoming a major concern…. In a world in which communication networks

and medical devices can dictate life or death, these systems, if compromised, pose a

significant threat to the public and private sector.”5 The national Information Secu-

rity and Privacy Advisory Board (ISPAB) said that the United States Computer Emer-

gency Readiness Team (US-CERT) should create “defined reporting categories for

medical device cybersecurity incidents.”

WhatsApp Number: +2349065708537 Legacy Tech Influencers