(In)Security of Medical Devices
summary
Research finds hard-coded passwords in hundreds of devices and demonstrates concrete exploits: a broadcast DoS script reboots and freezes patient monitors; an integer overflow flips alarm thresholds so a dead patient never triggers alarms; a smart scale sends the Wi‑Fi psk over plain HTTP; a port scan crashes an MRI host and grants telnet access to a vxWorks controller; a syringe pump PIN is extracted and infusion rates set to lethal values; recorded vitals are replayed to conceal a patient’s death.
AI-written summary · about
chapters (38)
- 0:00Introduction
- 2:21Agenda
- 3:27Disclaimer
- 4:16Technology
- 4:49Motivation
- 5:44Barnaby Jack
- 7:02FDA
- 7:36Problem Statement
- 13:42Smart Scale
- 15:45Vendors
- 16:32Network Port
- 17:56Medical Device Vendors
- 18:28Security and Safety
- 20:49Security and Compliance
- 22:52Safety vs Security
- 23:06Targets
- 23:36Communication
- 24:15Severity Rating
- 24:45Monitoring Devices
- 26:28Testing Medical Devices
- 28:36OpenEG
- 29:36Vulnerability
- 29:59Patient Monitor
- 33:08Mute Device
- 33:22Alarm Boundaries
- 34:34MRI
- 35:32Network Diagram
- 36:50Port Scan
- 37:19MRI Crash
- 37:52Getting into the host PC
- 38:31Guest WiFi
- 38:56Syringe Pump
- 41:14Anesthesia Device
- 46:14Vital Signs
- 46:44James Bond Scenario
- 51:51Active Research
- 52:34Responsible Disclosure
- 53:33Questions
related talks
58mMedical Device Security
19mSecurity in the Medical Internet of Things
58mBreaking Bad: Stealing Patient Data Through Medical Devices
31mHacking Everything – The Dark Side of the Internet of Things
56mKeynote Presentation: What Vehicle Security Can Learn from Medical Device Security
26mHacking buildings: Security flaws in embedded building control systems
30mVulnerabilities in the Internet of Things
01h 06mBackdoors in Back Doors