Incident: Potential Cybersecurity Vulnerabilities in Medical Devices Leading to Patient Safety Threats

Published Date: 2015-09-28

Postmortem Analysis
Timeline 1. The software failure incident involving the hacking of pacemakers and other medical devices was reported in the article published on 2015-09-28. 2. The incident was not explicitly dated in the article, but based on the information provided, it can be estimated that the incident occurred before September 2015.
System 1. Pacemakers and other smart medical technology connected to networks [51603] 2. MedNet computer system designed to manage drug delivery in hospitals [51603]
Responsible Organization 1. Hackers were responsible for causing the software failure incident with pacemakers and other smart medical technology [51603].
Impacted Organization 1. Patients with pacemakers and other smart medical technology [51603] 2. Healthcare organizations and medical device regulatory bodies [51603]
Software Causes 1. Software vulnerabilities in pacemakers and other smart medical devices that allowed for hacking and potential administration of fatal electric shocks or drug doses [51603]. 2. Vulnerabilities in the MedNet computer system used for drug delivery in hospitals that could be exploited by attackers to interfere with patients' doses [51603].
Non-software Causes 1. Lack of readiness by healthcare organizations and medical device regulatory bodies to deal with cybersecurity risks [51603] 2. Vulnerabilities in the interconnectivity of medical devices to computer networks [51603] 3. Potential for wireless-enabled medical devices to be hacked and manipulated [51603] 4. Concerns about the security of networked medical devices [51603]
Impacts 1. The software failure incident involving the hacking of pacemakers and other medical devices raised concerns about cybersecurity vulnerabilities in connected healthcare technology [51603]. 2. The incident highlighted the potential risk of fatal electric shocks or drug doses being administered to targeted individuals or groups of people fitted with the same device [51603]. 3. The failure incident led to warnings that patient safety was under threat due to the lack of readiness from healthcare organizations and medical device regulatory bodies to address the cybersecurity risks [51603]. 4. The incident prompted increased attention from experts and authorities, such as the Food and Drug Administration (FDA) and the Department of Homeland Security, to take steps to reduce the risk of failure due to cyber attacks on medical devices [51603]. 5. The failure incident demonstrated the need for manufacturers to improve the safety of wireless medical devices and implement security engineering programs to address cybersecurity risks [51603].
Preventions 1. Implementing robust cybersecurity measures in the design and development of medical devices, including pacemakers, to prevent hacking and unauthorized access [51603]. 2. Regularly updating software and firmware of medical devices to patch vulnerabilities and enhance security [51603]. 3. Conducting thorough security assessments and penetration testing on medical devices to identify and address potential weaknesses [51603]. 4. Enhancing collaboration between manufacturers, cybersecurity experts, regulatory bodies, and healthcare organizations to proactively address cybersecurity risks in medical devices [51603]. 5. Providing comprehensive cybersecurity training and awareness programs for healthcare professionals and patients to mitigate the risks associated with interconnected medical devices [51603].
Fixes 1. Implementing security improvements and design changes to the products, working with security researchers and experts to enhance cybersecurity measures [51603]. 2. Developing proximity communication features that require attackers to be in very close physical proximity to the patient to manipulate the device [51603]. 3. Ensuring that communication modes in wireless heart devices need to be switched on for any potential hack to occur, reducing the likelihood of remote attacks [51603].
References 1. Experts from the eHealth Research Group and Security Research Institute in Australia [51603] 2. Former U.S. Vice President Dick Cheney's cardiologist [51603] 3. Kevin Fu, a professor in electrical engineering and computer science at the University of Michigan [51603] 4. U.S. Food and Drug Administration (FDA) [51603] 5. Department of Homeland Security [51603] 6. Medtronic, a major maker of pacemakers [51603] 7. Hospira, a U.S.-based manufacturer of computerized drug-delivery pumps [51603] 8. White hat hackers [51603] 9. Department of Health in the UK [51603] 10. National Counter Terrorism Policing HQ in the UK [51603] 11. National Computer Emergency Response Team (CERT) [51603] 12. Cardiologists, including Richard Schilling and Trudie Lobban [51603]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) In the article, it is mentioned that Medtronic, one of the big three international makers of pacemakers, had a software vulnerability issue related to the potential hacking of their pacemakers. The article discusses how former U.S. Vice President Dick Cheney had asked Medtronic to disable the wireless function of his implanted heart device due to fears of a potential cyber attack. This incident highlights a software failure within the organization of Medtronic [51603]. (b) The article also mentions that there have been concerns and warnings from experts about the cybersecurity vulnerabilities in medical devices, including pacemakers, that are connected to networks. It discusses how there have been experiments where pacemakers and other devices have been hacked, raising concerns about fatal electric shocks or drug doses being administered. This indicates that similar incidents related to software vulnerabilities have occurred in multiple organizations or with their products and services [51603].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident in the article. It discusses how the interconnectivity of medical devices like pacemakers to computer networks has exposed them to cybersecurity vulnerabilities. Experts warn that this interconnectivity is an Achilles' heel that could expose vulnerable patients to terrorist attacks for the digital age. The article highlights concerns about the lack of readiness from healthcare organizations and medical device regulatory bodies to deal with the cybersecurity risks, putting patient safety under threat [51603]. (b) The software failure incident related to the operation phase is also mentioned in the article. It discusses how an attacker with low skill could exploit software vulnerabilities in the system and interfere with patients' doses. There are concerns about the potential for fatal electric shocks or drug doses being administered to targeted individuals or groups of people fitted with the same device. The article also mentions cybersecurity flaws in medical devices that officials fear could be exploited by hackers, leading to a cybersecurity alert being issued for a medical device [51603].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident related to the vulnerability of pacemakers and other smart medical devices to cybersecurity attacks is primarily within the system. The articles discuss how these devices, when connected to networks, become vulnerable to hacking and potential manipulation of patient doses or shocks [51603]. The incidents of hacking and demonstrated vulnerabilities in implantable heart defibrillators and drug-delivery systems highlight the risks originating from within the system itself, such as software vulnerabilities that can be exploited by attackers [51603]. Additionally, the focus on improving security measures within the companies manufacturing these devices indicates that the software failure incidents are primarily due to factors originating from within the system [51603]. (b) outside_system: On the other hand, the articles also touch upon the external factors contributing to the software failure incident. For example, the concerns raised about the interconnectivity of medical devices to computer networks and the lack of readiness of healthcare organizations and regulatory bodies to address cybersecurity risks suggest that external factors, such as the evolving technological landscape and the lack of preparedness in the industry, play a role in the vulnerability of these devices [51603]. The mention of potential targeted attacks in public places and the need for constant attentiveness by attackers also points to external threats that can exploit vulnerabilities within the system [51603].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: The articles discuss the vulnerability of medical devices, such as pacemakers and insulin pumps, to cyber attacks. These devices are becoming part of the 'internet of things' and are connected to networks, making them susceptible to cybersecurity vulnerabilities. Researchers have demonstrated the ability to hack into implantable heart defibrillators and deliver fatal shocks, raising concerns about the potential for targeted attacks on individuals with such devices [51603]. (b) The software failure incident occurring due to human actions: The articles mention that hackers, including so-called 'white hat' hackers, have demonstrated the ability to hack into life-or-death medical devices, such as portable insulin pumps and pacemakers. Additionally, the articles highlight the case of former U.S. Vice President Dick Cheney, whose cardiologist asked to disable the wireless function of his implanted heart device due to fears of a sophisticated attacker wirelessly accessing and reprogramming it to cause harm [51603].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - The article discusses the vulnerability of medical devices like pacemakers and insulin pumps to cybersecurity attacks due to their interconnectivity with networks, which can expose patients to risks of fatal electric shocks or drug doses [51603]. - There are concerns raised about the potential for hackers to wirelessly access implantable medical devices like pacemakers and defibrillators, leading to fears of targeted attacks in public places or random attacks on patients with such devices [51603]. (b) The software failure incident occurring due to software: - The article mentions that an 'independent researcher' identified vulnerabilities in a widely used computer system called MedNet, which manages drug delivery into patients, highlighting the risk of software vulnerabilities being exploited to interfere with patients' doses [51603]. - It is noted that white hat hackers have demonstrated hacks on life-or-death devices like portable insulin pumps and pacemakers, indicating the presence of software weaknesses in these medical devices [51603].
Objective (Malicious/Non-malicious) malicious, non-malicious (a) The articles discuss the potential for malicious software failure incidents in the context of medical devices like pacemakers and implantable cardioverter defibrillators (ICDs). There are concerns raised about the vulnerability of these devices to cyber attacks, with the possibility of hackers administering fatal electric shocks or drug doses to targeted individuals or groups of people fitted with the same device [51603]. (b) On the non-malicious side, the articles mention that some experts and companies believe the likelihood of a malicious security breach of a patient's device is low [51603]. Additionally, there are discussions about the efforts made by manufacturers to improve the safety of wireless devices and the challenges in addressing cybersecurity vulnerabilities in medical devices [51603].
Intent (Poor/Accidental Decisions) poor_decisions (a) In the context of the software failure incident related to the security vulnerabilities in medical devices like pacemakers and insulin pumps, the intent of the incident can be attributed to poor_decisions. This is evident from the fact that experts warned about the Achilles' heel of interconnectivity in medical devices exposing vulnerable patients to cybersecurity risks, with concerns raised about fatal electric shocks or drug doses being administered due to software vulnerabilities [51603]. Furthermore, the incident involving the potential hacking of medical devices, as highlighted by the example of the fictional assassination of the Vice President in the TV series Homeland, indicates that poor decisions in terms of cybersecurity measures and software design could lead to severe consequences [51603].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The articles discuss the potential software failure incident related to development incompetence in the context of cybersecurity vulnerabilities in medical devices. It is mentioned that experts have warned about the Achilles' heel of interconnectivity in smart medical technology, which could expose vulnerable patients to cyber attacks [51603]. Additionally, the articles highlight concerns raised by academics that healthcare organizations and medical device regulatory bodies were not adequately prepared to deal with the cybersecurity risks, potentially putting patient safety at risk [51603]. (b) The articles also touch upon the accidental introduction of contributing factors leading to software failure incidents. For example, it is mentioned that an 'independent researcher' identified vulnerabilities in a widely used computer system designed to manage drug delivery into patients, warning that an attacker with low skill could exploit software vulnerabilities and interfere with patients' doses [51603]. This accidental introduction of vulnerabilities could lead to unintended consequences and failures in the software systems.
Duration permanent, temporary (a) The articles discuss the potential for permanent software failure incidents in the context of medical devices like pacemakers and implantable cardioverter defibrillators (ICDs). There are concerns raised about the cybersecurity vulnerabilities of these devices, with experts warning that fatal electric shocks or drug doses could be administered due to software vulnerabilities [51603]. (b) The articles also mention temporary software failure incidents, such as the vulnerabilities identified in the MedNet computer system used to manage drug delivery in hospitals. An independent researcher identified four vulnerabilities in the system that could be exploited by attackers with low skill levels to interfere with patients' doses. The manufacturer, Hospira, quickly released a new version of the software to address these vulnerabilities [51603].
Behaviour omission, value, byzantine, other (a) crash: The articles do not specifically mention any instances of software failures due to a system losing state and not performing any of its intended functions. (b) omission: The articles discuss the potential risk of software vulnerabilities in medical devices that could lead to the omission of intended functions. For example, an attacker with low skill could exploit software vulnerabilities in the system and interfere with patients' doses [51603]. (c) timing: There is no direct mention of software failures related to timing issues in the articles. (d) value: The articles highlight concerns about software vulnerabilities that could lead to the system performing its intended functions incorrectly, such as administering fatal electric shocks or drug doses to patients [51603]. (e) byzantine: The articles discuss the possibility of software vulnerabilities leading to inconsistent responses and interactions, such as the potential for hackers to wirelessly access and reprogram implantable medical devices to deliver fatal shocks [51603]. (f) other: The articles also mention the risk of software vulnerabilities in medical devices leading to targeted attacks in public places on individuals with heart devices or random attacks on any patients with pacemakers who happen to be in the wrong place at the wrong time [51603].

IoT System Layer

Layer Option Rationale
Perception sensor, actuator, processing_unit, network_communication, embedded_software (a) sensor: The failure incident discussed in the articles is related to the sensor layer of the cyber physical system. Specifically, the vulnerability lies in the sensors embedded in medical devices like pacemakers and implantable cardioverter defibrillators (ICDs). These sensors can transmit information about a patient's heart to their doctor and can be reprogrammed remotely. However, the interconnectivity of these devices to networks exposes them to cybersecurity vulnerabilities, allowing hackers to potentially administer fatal electric shocks or drug doses [51603]. (b) actuator: The failure incident is also related to the actuator layer of the cyber physical system. In the case of the pacemakers and ICDs, the actuators are responsible for delivering shocks to the heart to maintain rhythm or revive a patient. The vulnerability in these actuators arises from the potential for hackers to remotely access and reprogram the devices, leading to the possibility of administering fatal shocks or incorrect drug doses [51603]. (c) processing_unit: The failure incident involves the processing unit layer of the cyber physical system. The processing units in medical devices like pacemakers are susceptible to software vulnerabilities that can be exploited by attackers. These vulnerabilities can allow hackers to interfere with the processing of patient data and potentially administer harmful electric shocks or drug doses [51603]. (d) network_communication: The failure incident is also related to the network communication layer of the cyber physical system. The connectivity of medical devices like pacemakers to computer networks exposes them to cybersecurity risks. Hackers can exploit weaknesses in network communication to gain unauthorized access to the devices, enabling them to administer fatal shocks or manipulate drug delivery [51603]. (e) embedded_software: The failure incident is connected to the embedded software layer of the cyber physical system. The software running on medical devices like pacemakers and ICDs is vulnerable to exploitation by hackers. These vulnerabilities in the embedded software can be leveraged to remotely reprogram the devices, leading to potential risks such as administering fatal electric shocks or incorrect drug doses [51603].
Communication connectivity_level The failure related to the communication layer of the cyber physical system that failed was at the connectivity_level. The articles discuss how the interconnectivity of medical devices like pacemakers to computer networks exposes them to cybersecurity vulnerabilities, allowing for potential attacks on patients through the network layer. For example, the articles mention that increasing connectivity to computer networks has exposed medical devices to cybersecurity vulnerabilities, and there have been concerns raised about fatal electric shocks or drug doses being administered due to these vulnerabilities [51603]. Additionally, the articles highlight that the U.S. authorities, such as the Food and Drug Administration (FDA) and the Department of Homeland Security, have been investigating cybersecurity flaws in medical devices and issuing alerts to reduce the risk of failure due to cyber attacks [51603].
Application TRUE The software failure incident related to cybersecurity vulnerabilities in medical devices, particularly pacemakers and implantable cardioverter defibrillators (ICDs), can be attributed to the application layer of the cyber physical system. This failure was due to contributing factors introduced by bugs, operating system errors, unhandled exceptions, and incorrect usage [51603]. The articles discuss how these devices, which are part of the 'internet of things,' are vulnerable to hacking and cyber attacks, leading to concerns about fatal electric shocks or drug doses being administered due to software vulnerabilities in the system [51603]. The incident involving the potential hacking of pacemakers and ICDs demonstrates a failure at the application layer of the cyber physical system, where software flaws and cybersecurity vulnerabilities can be exploited to interfere with patients' doses or even cause harm [51603].

Other Details

Category Option Rationale
Consequence death, harm, theoretical_consequence (a) death: The articles discuss the potential consequence of death due to software failure incidents involving medical devices like pacemakers and implantable cardioverter defibrillators. There are concerns that fatal electric shocks or drug doses could be administered, either to targeted individuals or groups of people fitted with the same device, which could lead to fatalities [51603]. The articles also mention a fictional scenario in the TV series Homeland where the vice president is assassinated by terrorists who hack into his wireless-enabled ICD to give him a fatal heart attack [51603]. (b) harm: The articles highlight the potential physical harm that could result from software failure incidents involving medical devices. There are concerns that hackers could interfere with patients' doses, leading to harm [51603]. Additionally, there is a mention of a demonstration hack of life-or-death devices, including portable insulin pumps and pacemakers, by 'white hat' hackers, indicating the potential for physical harm [51603].
Domain health (a) The failed system in the articles is related to the healthcare industry, specifically focusing on smart medical technology like pacemakers and implantable cardioverter defibrillators (ICDs) connected to networks for patient monitoring and treatment [51603]. The incident involves concerns about cybersecurity vulnerabilities in these medical devices, which could potentially lead to fatal electric shocks or drug doses being administered to patients [51603]. (j) The software failure incident is directly related to the health industry, particularly concerning the cybersecurity vulnerabilities in smart medical devices like pacemakers and ICDs [51603]. The incident highlights the potential risks associated with these devices being connected to networks and the possibility of malicious attacks on patients through hacking into the devices.

Sources

Back to List