Friday, May 13, 2016

Attacking commercially available devices! Not in the TV show Homeland, but in reality. Most of these attacks can be pointed to the manufacturers not paying too much attention to security. On the other side, security is still not a strictly enforced necessity so it is natural that manufacturers would go easy on means to provide the same. With such research publications, there is spread of the emphasis of security for the future of medical devices.
To start with a cool title to the paper - Take two software updates and see me in the morning. A summary of the paper:
  • A commercial Automated external Defibrillator is taken and malicious updates are successfully launched.No, cryptographic controls were detected. Several software vulnerabilities are present including buffer overflow and cryptographic flaws.
  •  IDA Pro5.6 is use for reverse engineering and off-the shelf hardware/software used. Vulnerabilities discussed: buffer overflow, weak password authentication, weak CRC as digital signatures and credentials stored in plaintext.
  • Limited to one manufacturer but opens the door for the issue of medical device attacks.

1 comment:

  1. My view after reading all your posts is that this will take a very concerted effort by many people to reign in or regulate the device manufacturing industry with more scrutiny. Certainly not all device manufacturers will follow safety and security regulations, so how to make sure they do?

    ReplyDelete