Medical Device Security: Hacking Intelligent Medical Devices to Enhance Your Organization's Benefits

 Adversarial testing is important to ensure the safety of patients, the confidence of regulators, and to continue with a technology that is moving healthcare forward.

The market for intelligent medical devices is smoldering. The number of devices approved by the FDA increased 25% from 2019 to 2020.1 Venture investments in new device development has grown an astounding 46% YoY to $12.5B as of May 2021.2 And the Internet of Medical Things (IoMT) market, which accounts for just a portion of all smart medical devices, is projected to grow from $24.4B in 2019 to $285.5B in 2029.3

There are several reasons for this growth:

·         IoT technology (including the increased computing power now available in small form factors and the increased network bandwidth that's becoming more readily available in healthcare facilities) has matured to the point that, given the proper development cycle, smart devices can now be trusted for use on the innards of live human beings.

·         Smart devices can be an amazing addition to medical treatments and provide a consistent way of achieving better results as they help even out differences in experience and skill level amongst clinicians who run them.

·         Smart devices have the ability to improve clinician productivity, which healthcare providers are trying to do by cutting down on cost but also increasing revenue.

·         Smart devices produce high-quality data that can be used to improve clinician practices, institutional treatment policies, insurers' risk adjustment calculations, and epidemiological insights.

Understanding the Threats

The cyber assault on healthcare has been going on for quite some time now, but it’s only intensifying as technology becomes more prevalent in the medical field. For example, WannaCry in 2017 was believed to have had a major impact given the nature of what was stolen from hospitals – personal and patient data. That makes sense because no one wants their medical history spread all over the internet for all to see! HealthCareITSecurity.com reports that attacks on healthcare infrastructure have risen 42% year over year so far in 2019 alone. In fact, they state that nearly 39 million patients’ records have potentially been compromised.

Medical devices created with many vulnerabilities. These security threats can put patients at risk. Many of them have been made using deeply problematic operating systems and vulnerable components, particularly those that utilize the Windows XP platform extensively like Trek or Nucleus' TCP/IP stacks.

And, of course, the vulnerabilities of these devices put not just the devices themselves at risk but also all other connected devices. Because connecting our smart devices gives us access to such a wide range of technology, attacks are easier and can go undetected for longer periods of time, too. When we allow so many vulnerabilities in any device or system, it can increase risks for our healthcare networks and make it easier than ever for attackers.

Healthcare organizations cannot front the costs of this thing by simply adding more security staff and technology. There just aren’t enough trained security personnel available to them on the market—and their tight budgets won’t allow it anyway.

Trial by Fire

The new vulnerabilities created by the IoMT are similar to those created by more general problems. More often than not, we’ve seen this year what can happen when important information is leaked because of a vulnerable IoT implementation. That’s why it’s always advised that healthcare organizations undergo annual audits against HIPAA and ISO/IEC 27001 standards to ensure that their security precautions are up-to-date.

Medical device manufacturers need to be aware of and use the various recommendations in the UL29004 series for pre-market medical device security. These frameworks facilitate the testing and hardening of devices so they can resist attacks through unauthorized access, execution of malicious code, data loss, or other types of actions.

The DEF CON community - or, more specifically, the BioHacking village that is run at DEF CON events - has helped promote this kind of medical device security testing by providing forum for hackers and medical device manufacturers to be able to collaborate. That collaboration includes hackers working in the physical presence of manufacturer staff so that the two groups can have a live dialog about any issues they discover. They can even work on a Coordinated Vulnerability Disclosure, if necessary.

Cyber Risk Advisory & Consulting Services (CyRAACS) provides cutting-edge solutions to help companies set up a more stable and sustainable cyber risk management system.