Ask Professor Kevin Fu About Medical Device Security 57
Kevin Fu is a professor of electrical engineering and computer science at the University of Michigan. He heads a research group on medical-device security, Archimedes, that works to find vulnerabilities in medical equipment. WattsUpDoc, a system that can detect malware on medical devices by monitoring changes in power consumption, is based on his work. Professor Fu has agreed to put down the pacemakers for a moment and answer your questions about his work and medical device security in general. As usual, ask as many as you'd like, but please, one question per post.
Cochlear Implants (Score:4, Interesting)
Re: (Score:3, Funny)
How secure are Cochlear implants and their processors? Any chance I'm going to hear the voice of God (without the tooth implant, ala Real Genius?)
That depends: Did you recently vote Republican?
Re: (Score:2)
Re: (Score:2)
3rd party vendors have a bit of control over (Score:2)
3rd party vendors have a bit of control over there own hardware / software and may want to even have some kind of remote login or even need ports open for sending data.
Also some of them don't want OS updates done as well.
Re: (Score:2)
i have worked at many, many of the largest and most prestigious hospitals (like hundreds of them) in this country (and many others) and all have VPNs options. Mostly IPSec but a few use other remote access tools. Its a requirement to run a hospital today.
Re: (Score:2)
Well they want their own OS updates of course. Third party updates make no sense because usually there is no commonly known OS being used or it is statically linked with the applications.
Re: (Score:1)
PCA Pumps? (Score:2)
Hello!
Have you explored changing the dosages on drug pumps? Either through exploiting the device directly or by exploiting the database backend? I reference the Hospira pumps that run Linux, allowing one to telnet to them as root with no password authentication. Hospira did issue an update to that but since pumps are so numerous, I'm sure that many hospitals have been slow to update.
Thanks!
Re: (Score:2)
So that we do not have to have a one-to-one relationship between patient and nurse? If these devices had no connectivity, then every patient would have to have at least one nurse in attendance at all times to monitor that the equipment is still functioning or that the various rates being measured are still within acceptable limits.
Re: (Score:2)
Clinical Data Systems (Score:1)
Most clinics, hospitals, insurance companies and dental offices are extensively computerized and networked. Based on your experience, how often are these systems compromised?
How have US budget issues affected your research? (Score:2)
What can I do if I have one? (Score:3)
Say I have an implant that could be hacked, what can I do to protect myself? Are any vendors more reputable than others when it comes to security? Is tinfoil effective? Should I demand my doctor replaces known vulnerable equipment?
Start-ups (Score:1)
Features to look for in an upgrade (Score:1)
Manual override (Score:2)
Re: (Score:1)
There is a difference between "fly by hand" and "fly without depending on the computer" -- in today's modern fly-by-wire aircraft, there are still computers/electronics between the pilot and the control surfaces even when the flight management system, auto-pilot and even primary flight controls are "down".
The question is what failure modes, considering the presence of security threats, require simple back-up systems? How would such back-up systems be invoked?
Dieing Caps and other parts in systems that old (Score:2)
Dieing Caps and other parts in systems that old may lead to higher power use
Question! (Score:1, Offtopic)
Have you ever considered changing your first name to "Kung"?
Should the local IT team have full control over an (Score:2)
Should the local IT team have full control over any system in place / should vendors be forced to let systems have AV and OS updates installed on them with out delays?
Re: (Score:2)
This is usually not possible. Many of these medical devices don't run Windows or Linux. They are embedded systems with real time operating systems, embedded operating systems, a home grown operating system, and sometimes no OS at all. Other times the applications are statically linked with the OS so that it is unable to be upgraded independently.
That is different from medical turnkey systems that are basically generic computers overlaid with specialized applications (hospital records keeping, image manag
Incentives (Score:1)
The current comments on the draft for "Content of Premarket Submissions for Management of Cybersecurity in Medical Devices" pertaining to 21 CFR 820.30(g) have a disturbing trend of focusing on "unauthorized access" of these devices to be considered criminal (CFAA) instead of trying to protect against said access. Furthermore, I find any discussion of encrypting the data immediately turns to data bloat due to encr
ob (Score:2)
So, Professor, tell us about medical device security.
What can we do now? (Score:1)
Model, or island? (Score:3)
Being a highly regulated industry, I could see the eventual evolution of a competent security culture in medical IT/manufacturing. We certainly don't have it quite together now, but if and when that comes to pass, do you see the lessons learned in that sector promulgating out to other industries, or will the environment of high regulation (and high stakes) produce too alien a solution set for general application?
But how does it smell? (Score:1)
What does the inside of a used implantable defib smell like? I know Kevin knows :)
Closed set of acceptable commands? (Score:1)
Same as data acquisition? (Score:2)
Insulin Pump (Score:1)
Hello? Fu? Anyone home? (Score:1)
IMD hackathon? (Score:1)