USA: pacemakers recalled for risk of piracy

The Food and Drug Administration (FDA), the federal agency for food and pharmaceutical surveillance, has recalled nearly half a million pacemakers. The latter are exposed to the risk of piracy, due to a fault in the firmware.

Possible change in heart rate :

While the problem of piracy engages the whole IT industry, it also affects more and more industrialists, and sometimes in unexpected sectors. The leading US health authority, the Food & Drug Administration (FDA), has just issued a reminder about pacemakers, which are commonly referred to as "piles", which are commonly implanted in people with heartbeat.

The FDA has indeed found a serious risk that models of pacemakers developed by the company St Jude Medical can be pirated remotely. Tests have shown that it is possible to take control of the pacemaker by altering the wearer's heartbeat, or to exhaust the battery. In issue, a security hole discovered in the firmware piloting the pacemaker.

Advantage and disadvantage of connected health :

The problem is that once placed by internal surgery on the patient, the device is difficult to access. Fortunately, the manufacturer proposes a non-invasive firmware update method: the concerned pacemaker models are equipped with a radio connection that allows remote updating.

The discovery of this fault raises questions, as it proves to be exploitable with equipment whose price does not exceed 3,000 dollars. In addition, the update is not totally safe: during the process, the pacemaker operates in backup mode and may be purged of its diagnostic data, or even bricked, that is, in a state of death software! The FDA concludes by recalling the advantages and disadvantages of connected healthcare devices, namely that if they allow better follow-up of patients, they also expose them to the risk of piracy: it has already been proven that it is possible to trigger a shock or upset a patient's heart rhythm by remotely manipulating the embedded software of a pacemaker.

---