Incident: Implantable Medical Device Vulnerabilities to Hacking Threats

Published Date: 2017-08-31

Postmortem Analysis
Timeline 1. The software failure incident related to vulnerabilities in pacemakers and implantable defibrillators due to hacking threats happened in August 2017 [Article 62028]. 2. The software failure incident related to vulnerabilities in Medtronic's implantable cardiac devices was reported in March 2019 [Article 82409]. 3. The software failure incident concerning the potential hacking of medical devices, including pacemakers, was highlighted in October 2019 [Article 90756]. 4. The software failure incident discussing the risks of hacking attacks on heart devices using software and wireless communications was reported in February 2018 [Article 68077]. 5. The software failure incident involving the recall of implantable defibrillators by Abbott (formerly St. Jude Medical) was published in May 2018 [Article 71488].
System 1. Medtronic's implantable cardiac devices, including defibrillators and clinic programmers, were vulnerable to hacking due to a security flaw in the Conexus communications protocol [Article 82409]. 2. Abbott's implantable defibrillators, including Amplia MRI CRT-D, Claria MRI CRT-D, Compia MRI CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera MRI ICD, Evera ICD, Maximo II CRT-D and ICD, Mirro MRI ICD, Nayamed ND ICD, Primo MRI ICD, Protecta CRT-D and ICD, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF MRI ICD, Visia AF ICD, and Viva CRT-D, were recalled for a firmware update to enhance security and detect abnormal battery drainage [Article 71488]. 3. St Jude Medical's pacemakers, specifically six types of radio-controlled implantable cardiac pacemakers, were recalled due to cybersecurity vulnerabilities that could allow unauthorized access to reprogram the devices, potentially leading to battery depletion or inappropriate pacing [Article 62028].
Responsible Organization 1. Hackers [68207, 71488, 82409, 90756, 68077, 62028]
Impacted Organization 1. Patients with pacemakers and implantable defibrillators [68207, 71488, 82409, 61982, 90756, 62028]
Software Causes 1. Vulnerabilities in operating systems running third-party software called IPnet used in medical devices [90756] 2. Lack of encryption and authentication in Medtronic's Conexus communications protocol, allowing nearby attackers to intercept communications and potentially harm patients [82409] 3. Vulnerabilities in software and wireless communications of heart devices, making them susceptible to hacking attacks [68077] 4. Lax cybersecurity in pacemakers manufactured by Abbott, allowing unauthorized access to reprogram devices, drain batteries, or alter heartbeats [62028]
Non-software Causes 1. The vulnerabilities in Medtronic's defibrillators were caused by the lack of encryption in the Conexus communications protocol, allowing nearby attackers to intercept communications and potentially harm the patient [Article 82409]. 2. The FDA identified cybersecurity vulnerabilities in medical devices using third-party software called IPnet, which could allow hackers to take control of the devices and cause malfunctions or information leaks [Article 90756]. 3. Abbott's pacemakers were recalled due to cybersecurity concerns, where hackers could potentially access the devices and reprogram them to run the batteries down or alter the patient's heartbeat [Article 62028].
Impacts 1. The impacts of the software failure incident included the vulnerability of pacemakers and other electrical medical devices to potential hacking for political, financial, or personal gain, leading to concerns about patient safety and device functionality [68207, 71488, 82409, 90756]. 2. The vulnerabilities in the software of medical devices, such as pacemakers and defibrillators, could allow hackers to take control of the devices, change their function, cause denial of service, or leak information, posing significant risks to patient safety [90756]. 3. Patients with affected devices needed urgent software updates to protect them from potential hacking threats, which required medical procedures and temporary generators in case of malfunctions, highlighting the seriousness of the security flaws [61982, 62028]. 4. The software vulnerabilities in medical devices raised concerns about the potential for hackers to interfere with device functionality, interrupt wireless communications, drain batteries, issue unauthorized commands, and even cause life-threatening malfunctions, emphasizing the critical need for security measures and updates [68077]. 5. The incidents led to recalls of hundreds of thousands of implantable defibrillators and pacemakers to address the cybersecurity vulnerabilities, with firmware updates being implemented to mitigate the risks of hacking and unauthorized access to the devices [71488, 62028]. 6. The software failures prompted regulatory actions from agencies like the FDA and the Department of Homeland Security, issuing warnings, guidelines, and security alerts to healthcare providers, patients, and device manufacturers to address the cybersecurity risks associated with medical devices [82409, 90756].
Preventions 1. Implementing secure software design practices from the outset, involving multiple stakeholders including software experts, security experts, and medical advisors could have prevented the software failure incident [68207]. 2. Conducting regular monitoring of the environment for new vulnerabilities and responding quickly to emerging cyber threats could have helped prevent the software failure incident [68207]. 3. Developing software updates to resolve vulnerabilities and enhance security measures could have prevented the software failure incident [71488, 82409]. 4. Using devices that are not designed to permit remote software updates or wireless communications could have reduced the risk of hacking incidents [68077]. 5. Enhancing cybersecurity measures, such as encryption and authentication protocols, in communication protocols of medical devices could have prevented the software failure incident [82409]. 6. Proactively addressing common cybersecurity topics and advancing the security of devices and systems in the healthcare sector could have helped prevent the software failure incident [62028].
Fixes 1. Implementing firmware updates to patch security vulnerabilities in the affected medical devices [71488, 62028]. 2. Enhancing security measures in the software and wireless communications of medical devices to prevent hacking attempts [90756]. 3. Following FDA guidelines and recommendations for protecting against medical device hacking [68207, 82409]. 4. Conducting risk mitigation plans in collaboration with device manufacturers to address potential vulnerabilities in hospitals and other facilities [90756]. 5. Developing software updates to secure wireless communication affected by vulnerabilities [82409]. 6. Monitoring the environment for new vulnerabilities and responding quickly to emerging cyber threats [68207]. 7. Ensuring that medical devices are not designed to permit remote software updates or wireless communications to reduce the risk of hacking [68077]. 8. Educating patients and healthcare providers about the risks associated with software vulnerabilities in medical devices [68077]. 9. Continuing to advance the security of devices and systems in the healthcare sector to proactively address common cybersecurity issues [62028].
References 1. Journal of the American College of Cardiology [68207, 68077] 2. ThreatPost [71488] 3. Department of Homeland Security [82409, 90756] 4. FDA [62028, 90756] 5. Reuters Health [68077]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - Abbott Laboratories, formerly St. Jude Medical, issued a recall for some of its implantable defibrillators due to software vulnerabilities that could allow hackers to take control of the devices [Article 71488]. - Abbott Laboratories, the manufacturer of St. Jude pacemakers, issued a warning to patients about cybersecurity vulnerabilities in their devices that could allow hackers to access the devices and potentially cause harm [Article 62028]. (b) The software failure incident having happened again at multiple_organization: - Medtronic's implantable cardiac devices were identified to have vulnerabilities that could allow hackers to hijack defibrillators and issue commands after they are implanted in a patient [Article 82409]. - The FDA identified cybersecurity vulnerabilities in medical devices using third-party software called IPnet, which could allow hackers to take control of devices connected to wireless networks [Article 90756].
Phase (Design/Operation) design, operation (a) In the context of software failure incidents related to the development phases: - Article 68207 discusses the importance of designing protected software from the outset to enhance cybersecurity for medical devices like pacemakers. The study author emphasizes the need for true cybersecurity starting from the design phase and involving multiple stakeholders, including software experts and security experts [68207]. - Article 62028 highlights a cybersecurity vulnerability in pacemakers due to lax cybersecurity, leading to a recall of almost half a million pacemakers by the FDA. The vulnerability allowed unauthorized access to the device, enabling hackers to reprogram it, potentially causing harm to patients [62028]. (b) In the context of software failure incidents related to the operation phases: - Article 82409 reports a critical flaw in Medtronic's implantable cardiac devices that could allow hackers to hijack defibrillators and issue commands after the devices are implanted in a patient. The vulnerability stemmed from how the devices communicated with radios used by doctors to monitor and adjust the devices, potentially impacting product functionality and patient safety [82409]. - Article 90756 discusses software vulnerabilities in medical devices that could allow hackers to take control of items connecting to wireless networks, such as pacemakers. The FDA warned about the cybersecurity vulnerabilities that may cause a hacker to change the function of a medical device, cause denial of service, or leak information, potentially affecting device operation and patient safety [90756].
Boundary (Internal/External) within_system, outside_system (a) within_system: - The software failure incidents related to pacemakers and implantable defibrillators being vulnerable to hacking and cyber threats are primarily within the system failures. These incidents involve vulnerabilities in the software and wireless communications of the medical devices themselves, making them susceptible to potential hacker attacks [68207, 71488, 82409, 90756, 68077, 62028]. (b) outside_system: - The incidents also highlight the external factors contributing to the software failures, such as the potential threat from hackers targeting the medical devices for political, financial, or personal gain [68207, 71488, 82409, 90756, 68077, 62028]. Additionally, the involvement of regulatory bodies like the FDA and legislative proposals in Congress to address the security vulnerabilities of these devices points to external influences impacting the software failures [68207, 71488, 82409, 90756, 68077, 62028].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - Article 62028 reports on the recall of almost half a million pacemakers by the FDA due to cybersecurity vulnerabilities that could be exploited by hackers to run down the batteries or alter the patient's heartbeat. The recall involves issuing a firmware update to patch the security holes, indicating a failure due to contributing factors introduced without human participation [62028]. - Article 71488 discusses Abbott recalling implantable defibrillators to protect patients from potential hacking threats. The recall involves a voluntary firmware update to enhance security and detect abnormal battery drain, suggesting a failure introduced by non-human actions [71488]. (b) The software failure incident occurring due to human actions: - Article 68207 highlights the risk of pacemakers being targeted by hackers for political, financial, or personal gain. It emphasizes the importance of designing protected software from the outset and integrating multiple stakeholders to enhance cybersecurity, indicating a potential failure due to contributing factors introduced by human actions [68207]. - Article 82409 discusses a security warning issued by Homeland Security for Medtronic's implantable cardiac devices, making them vulnerable to hacking. The vulnerabilities were identified in how the devices communicate with radios, lacking encryption and authentication, potentially allowing nearby attackers to interfere with the devices. This points to a failure introduced by human actions [82409].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - Article 62028 reports on a recall of almost half a million pacemakers by the FDA due to cybersecurity concerns that could lead to the batteries running down or altering the patient's heartbeat. The vulnerabilities in the pacemakers' hardware could allow unauthorized access to reprogram the devices, potentially causing harm to patients [62028]. (b) The software failure incident occurring due to software: - Article 62028 also mentions that the vulnerabilities in the pacemakers' software could be exploited by hackers to reprogram the devices, leading to issues such as running the battery flat or administering inappropriate pacing, which could result in patient harm [62028]. - Article 68077 discusses how medical devices using software and wireless communications are vulnerable to hacking attacks that could cause life-threatening malfunctions. The increasing use of software and wireless communications in medical devices has raised the risk of hackers reprogramming devices, interrupting information relay, or draining batteries prematurely [68077].
Objective (Malicious/Non-malicious) malicious, non-malicious (a) Malicious: 1. The articles highlight the potential malicious intent behind software vulnerabilities in medical devices, such as pacemakers and defibrillators. These vulnerabilities could allow hackers to take control of the devices, change their function, cause denial of service, or even cause information leaks or logical flaws [Article 90756]. 2. There have been instances where manufacturers issued firmware updates to protect patients from potential hacker attacks that could lead to life-threatening malfunctions, such as stopping the pacing of pacemakers [Article 61982]. 3. The Department of Homeland Security issued a security warning for Medtronic's implantable cardiac devices, stating that hackers could hijack defibrillators and issue commands to them after they are implanted in a patient, potentially harming the patient [Article 82409]. (b) Non-malicious: 1. While there are concerns about the vulnerability of medical devices to hacking attacks, it is noted that there have been no documented cases of cardiac devices being hacked in real patients [Article 68077]. 2. The articles also mention that the risk of hacking cardiac implants is more theoretical at this point, with no documented cases of actual harm caused by hacking in patients [Article 68077]. 3. Despite the potential risks associated with hacking vulnerabilities in medical devices, the focus is also on the benefits of connected devices, such as personalized care and quicker treatment of acute or chronic events, which outweigh the risks of potential hacking [Article 68077].
Intent (Poor/Accidental Decisions) poor_decisions (a) poor_decisions: The software failure incidents mentioned in the articles were primarily related to vulnerabilities in medical devices such as pacemakers and defibrillators that could be exploited by hackers. These vulnerabilities were due to poor decisions in the design and implementation of the software, including lack of encryption, unauthenticated access, and insecure communication protocols. For example, the vulnerabilities in Medtronic's implantable cardiac devices were attributed to the Conexus communications protocol not being encrypted and not requiring user authentication [82409]. Similarly, the recall of pacemakers by Abbott (formerly St. Jude Medical) was due to cybersecurity vulnerabilities that could allow unauthorized access to the devices and potential reprogramming by hackers [62028]. (b) accidental_decisions: The incidents did not involve failures due to accidental decisions or unintended mistakes. Instead, they were deliberate attempts by hackers to exploit vulnerabilities in the software of medical devices for malicious purposes. The vulnerabilities were not accidental but rather a result of poor cybersecurity practices and design flaws in the software of the devices.
Capability (Incompetence/Accidental) development_incompetence, accidental (a) In the articles, there are mentions of software vulnerabilities in medical devices that could potentially be exploited by hackers. For example, the vulnerabilities in Medtronic's implantable cardiac devices were identified by security firm Clever Security, indicating a potential lack of professional competence in ensuring the security of these devices [Article 82409]. Additionally, the FDA identified cybersecurity holes in operating systems running third-party software used in medical devices, highlighting potential development incompetence in ensuring the security of these systems [Article 90756]. (b) The accidental introduction of vulnerabilities is also implied in the articles. For instance, Abbott Laboratories issued a firmware update for pacemakers to patch security holes that could be exploited by hackers to run down batteries or alter the patient's heartbeat. This indicates that the vulnerabilities were not intentionally introduced but were discovered after the devices were already in use [Article 62028].
Duration permanent (a) In the articles, the software failure incidents related to vulnerabilities in medical devices, such as pacemakers and defibrillators, are considered to be permanent failures. These vulnerabilities could potentially allow hackers to take control of the devices, change their functions, cause denial of service, or even lead to life-threatening malfunctions [90756]. The incidents have led to recalls of hundreds of thousands of devices, firmware updates being issued, and warnings being issued by regulatory bodies like the FDA and the Department of Homeland Security [71488, 82409, 62028]. (b) However, it is important to note that while the vulnerabilities exist and the potential for hacking is a real concern, there have been no documented cases of actual hacking affecting patients through their implanted medical devices [68077]. The risk of hacking is considered to be low, and the likelihood of an individual hacker successfully affecting a cardiovascular implantable electronic device or being able to target a specific patient is very low [68207].
Behaviour crash, omission, value, other (a) crash: - Article 62028 reports on a software failure incident related to pacemakers being recalled due to cybersecurity vulnerabilities that could potentially be hacked to run the batteries down or alter the patient's heartbeat, which could lead to a crash scenario where the system stops pacing or fails to respond correctly [62028]. - Article 71488 mentions a voluntary recall of implantable defibrillators by Abbott due to software vulnerabilities, which required a firmware update to enhance security and detect abnormal battery drain, indicating a potential crash scenario if the devices were not updated [71488]. (b) omission: - Article 62028 discusses the recall of pacemakers due to cybersecurity vulnerabilities that could allow unauthorized access to reprogram the devices, potentially leading to the omission of performing the correct pacing functions or causing inappropriate pacing [62028]. - Article 68077 highlights the risks associated with hacking attacks on heart devices that could interrupt the relay of information needed for remote monitoring, potentially resulting in the omission of critical data transmission or causing information leaks [68077]. (c) timing: - No specific instances related to timing failures were mentioned in the provided articles. (d) value: - Article 68077 discusses the potential risks of hackers intercepting and modifying data going to or coming from a medical device, which could lead to incorrect data being processed by the system, indicating a value failure scenario [68077]. (e) byzantine: - No specific instances related to byzantine failures were mentioned in the provided articles. (f) other: - Article 68207 discusses the possibility of hackers targeting pacemakers and other electrical medical devices for political, financial, or personal gain, which could lead to various types of software failures beyond those described in the options, such as unauthorized access, data manipulation, or system compromise [68207]. - Article 82409 reports on a security warning issued for Medtronic's implantable cardiac devices, highlighting vulnerabilities that could allow hackers to hijack defibrillators and issue commands, potentially resulting in a range of software failure incidents not limited to the options provided [82409].

IoT System Layer

Layer Option Rationale
Perception sensor, actuator, processing_unit, network_communication, embedded_software (a) sensor: The articles discuss vulnerabilities in medical devices such as pacemakers and defibrillators that could be targeted by hackers. These vulnerabilities could potentially lead to sensor-related failures, such as interrupting wireless communications or causing the device to malfunction [68207, 71488, 82409, 90756, 68077, 62028]. (b) actuator: The articles mention the risk of hackers being able to issue commands to implanted medical devices, potentially causing actuator-related failures like delivering unnecessary shocks to the heart or failing to respond with needed shocks [82409, 68077, 62028]. (c) processing_unit: The articles highlight the possibility of hackers reprogramming medical devices to work improperly, interrupting the relay of information needed for remote monitoring, or draining the batteries prematurely, indicating potential processing_unit-related failures [68077]. (d) network_communication: The incidents reported in the articles involve vulnerabilities in the network communication of medical devices, allowing hackers to intercept communications, change data on the devices, or issue commands through radio frequency transmission, which could lead to network_communication-related failures [82409, 90756, 62028]. (e) embedded_software: The articles discuss the importance of secure software design and firmware updates to address vulnerabilities in the embedded software of medical devices. Firmware updates are mentioned as a way to enhance security and detect abnormal battery drainage, indicating potential embedded_software-related failures [71488, 82409, 62028].
Communication link_level, connectivity_level [a68077] The failure was related to the communication layer of the cyber physical system that failed, specifically mentioning the vulnerability of remote monitoring and potential interruptions in communications for implanted cardiac devices. [a82409] The failure was also related to the communication layer of the cyber physical system that failed, as the vulnerabilities in Medtronic's implantable cardiac devices allowed hackers to use radio communications to hijack defibrillators and issue commands after implantation.
Application TRUE [62028, 61982, 68207] The software failure incidents reported in the articles were related to the application layer of the cyber physical system. These incidents involved vulnerabilities in the software of medical devices such as pacemakers and defibrillators, which could be exploited by hackers to cause malfunctions, alter device settings, drain batteries, or interrupt wireless communications. The failures were attributed to cybersecurity vulnerabilities in the software of the devices, highlighting the risks associated with remote monitoring and wireless communications in medical devices.

Other Details

Category Option Rationale
Consequence death, harm, theoretical_consequence (a) death: The articles discuss the potential risk of death due to software vulnerabilities in medical devices such as pacemakers and defibrillators. If hacked, these devices could cause life-threatening malfunctions, irregular heart rhythms, unnecessary shocks to the heart, or failure to respond with needed shocks, potentially leading to fatal outcomes [62028, 68077, 82409]. (b) harm: Patients could be physically harmed if their implanted medical devices are hacked, leading to malfunctions, interruptions in therapy delivery, or interference with device settings. The vulnerabilities in the devices could allow attackers to modify device settings, stop pacing, or impact device functionality, posing a risk of harm to patients [62028, 68077, 82409]. (h) theoretical_consequence: The articles mention that while there have been no documented cases of cardiac devices being hacked in real patients, the theoretical risks of hacking include reprogramming devices to work improperly, interrupting information relay for remote monitoring, prematurely draining batteries, causing denial of service, or causing information leaks. The potential consequences discussed are theoretical risks rather than actual observed outcomes [68077, 82409].
Domain health (a) The articles discuss software failure incidents related to the health industry, specifically focusing on medical devices such as pacemakers and implantable defibrillators that are vulnerable to hacking attacks [68207, 71488, 82409, 90756, 68077, 62028]. (b) The transportation industry is not directly mentioned in the articles. (c) The natural resources industry is not directly mentioned in the articles. (d) The sales industry is not directly mentioned in the articles. (e) The construction industry is not directly mentioned in the articles. (f) The manufacturing industry is not directly mentioned in the articles. (g) The utilities industry is not directly mentioned in the articles. (h) The finance industry is not directly mentioned in the articles. (i) The knowledge industry is not directly mentioned in the articles. (j) The articles do not discuss software failure incidents related to the entertainment industry. (k) The articles do not discuss software failure incidents related to the government industry. (l) The articles do not discuss software failure incidents related to any other specific industry. (m) The software failure incidents discussed in the articles are related to the health industry, specifically focusing on vulnerabilities in medical devices.

Sources

Back to List