Security Matters - passwords, post-its and pacemakers

By Tom Crumpton, Head of Security

Eagle-eyed TV viewers will have spotted a classic security blunder in a recent story at a geothermal power station. Viewers were treated to a close-up of the management terminal controlling the power station. Beneath it, was a clearly visible post-it note, with the word ‘password’ double underlined - just in case you were in any doubt!

After some eye rolling, alerting TV One to the issue and using it as an excuse to remind people of good password hygiene I moved on.

Sometimes it’s not so easy to move on from a security vulnerability. Dr Marie Moe, an Associate Professor at the Norwegian University of Science and Technology and a security researcher, found herself in such a situation. Six years ago Dr Moe was fitted with a pacemaker that not only saved her life but continuously monitors and manages her heart so that she can lead a safe and normal life. A truly incredible piece of technology.

Several weeks after the life-saving operation, a work trip to London required Dr Moe to walk up the 193 steps at Covent Garden tube station. Suddenly, halfway up the stairs, she stopped and could no longer carry on, feeling giddy and as though she was in the final stages of a marathon. This turned out to be because of a misconfiguration in her pacemaker.

As a security researcher, and with a vested interested, Dr Moe looked further into pacemakers and made some astonishing discoveries.

Manufacturers do not see patients as their end users, they see the hospitals and healthcare workers – not patients - as their end users, so process and systems are set up to support their requirements. Systems were designed to be easy to use and easy to access, preventing or limiting access inhibits that goal. And security did not feature highly. 

A fantastic feature that allows the pacemaker to be updated remotely means that surgery is not required to make a configuration change if the patient’s needs change.  It also means that a malicious 3^rd party can make changes if they have access to a pacemaker programmer. So how well protected were the pacemaker programmers?

Not well!  Dr Moe found the programmers were frequently left in hospital corridors or could be purchased on eBay from as little as $500 USD.  This could have catastrophic outcomes for the individuals, including:

• battery exhaustion – by constantly querying the pacemaker to drain the battery;

• patient privacy – by accessing key health data on the device;

• device malfunction – by giving inappropriate heart pacing by changing the configuration;

• death threats or extortion.

Most famously, Dick Cheney, former Vice-President of the USA, had remote access chips removed from his pacemaker to eliminate the risk of remote assassination.

Device manufacturers may not have had requirements to make secure products when they were commissioned but hopefully research by Dr Moe and her colleagues will help inform policy makers and the next generation of pacemakers will have improved security.

As technology becomes more advanced and embedded in our working and personal lives, we need to ensure that security is considered by everyone so that post-it notes undermining the security of a power station are not broadcast on national television and life-saving pacemakers are as effective in prolonging life as they can be.