When it comes to hacking we're mostly concerned about leaked data, especially if it involves banking details, credit cards or anything that could hurt us in the pocket. But as the Internet of Things brings more devices online, hackers could hurt us in more ways that just through our pockets.
Security researcher Billy Rios has discovered a flaw in popular Hospira hospital pumps that could allow hackers deliver potentially fatal drug doses to patients over the Internet.
Rios says hackers could take control of the pumps by accessing the hospital networks which communicate with the pumps. Hospira sends updates to the devices remotely and hackers could create a false firmware update to tamper with the machines. "You can talk to that communication module over the network or over a wireless network," Rios told Wired. "If you can update the firmware on the main board, you can make the pump do whatever you like."
In theory a hacker could deliver a fatal dose undetected. The attacker could alter the software to make the pumps display regular doses, meaning no safety alerts would go off, while patients are silently poisoned.
The flaws affect the following five Hospira models: PCA 3 LifeCare, PCA 5 LifeCare, Plum A+ Infusion Pumps, PCA LifeCare, and Symbiq (no longer sold by Hospira, but affected).
In his blog post which details the flaw, Rios also says he suspects but has not yet verified that these four other models could be vulnerable to the same attacks: Plum A+3, Plum 360, Sapphire, Sapphire Plus.
He said he alerted Hospira to potential flaws more than a year ago but it denied its pumps could be hacked. Hospira claimed that the circuit board controlling the pumps is completely separate from the communications module to prevent such attacks. But Rios points out that the two systems are linked by a serial cable, and that Hospira knows this because its the very cable they use to deliver firmware updates.
Rios says he will demonstrate the flaws at the SummerCon hacker convention, which takes place in Brooklyn this July 17 - 1 8.
Last month Rios highlighted flaws in the machines but at the time thought only dosage limits, a safety design to ensure large doses cannot be administered accidentally, could be tampered with. It would still require a health care worker in the room to deliver a fatal dose, but the new revelations are far more worrying.
If recent hacking scandals have taught us anything it's that most things connected to the Internet are vulnerable to attack. Hospital pumps could be just the tip of the iceberg. As we embrace driverless cars and the Internet of Things, it opens up a whole new environment in which hackers could cause havoc. Science fiction movies have been scaring us with "attack of the machines" scenarios for decades and while we're probably a bit away from that yet, it's not entirely unimaginable.
If hospital pumps can be tampered with, surely smart "connected" thermostats, cookers, cars and other devices could also be hacked, with potentially lethal consequences. Of course, many of these devices can already relatively easily be physically manipulated but almost never are and the Internet of Things isn't going to turn the hacking community into an army of remote murderers overnight, but it's probably worth a thought.
