Experts find 8,000 security flaws in pacemaker software

rt.com

A tech security evaluation has found a whopping 8,000 software vulnerabilities in the code of pacemakers.
Security research firm WhiteScope carried out the assessment on implantable cardiac devices, physician programmers and home monitoring devices for four major manufacturers.

The researchers found a worrying consistency across all vendors, highlighting inherent system weaknesses in file system encryption and storage of unencrypted patient data.

The report notes that pacemaker security faces “some serious challenges”...

The new study builds on earlier research which raised concerns over security flaws in cardiac devices such as the implantable cardioverter defibrillator (ICD) and the pacemaker, with WhiteScope researchers easily able to obtain subsystems for the four major vendors through public auction sites such as Ebay.

One particular concern is the use of third party components, software that is sold by a company other than the original vendor. These components often have vulnerabilities that go unpatched.

The report notes that as home monitoring devices receive updates to their permanent software, or firmware, via the patient support network, “the potential exists to perform a man-in-the-middle attack and issue counterfeit firmware” to the devices.