8 ms·
Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flat
by redthrowaway 12y ago
Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street."
Watch how long it takes them to fix it then, and watch how reactive they become to responsible disclosure next time.
Also, short their stock before you go on TV. A little something for your troubles.
- wheaties 12y agoNow THAT is how you do it. Grab a "shock of the week" angle and play it for anyone that wants to watch. Only issue is getting a "non-defective" pacemaker. Those things aren't cheap or easy to come by without ordering it from the manufacturer. Whatever profit you could have shorting the stock you'd lose almost immediately by having to purchase the devise.
- _mgr 12y agoI was a Funeral Director in a previous life. I would remove pacemakers if the deceased was to be cremated. We had bags of them. They are cheap and disposable, don't believe anyone that tells you otherwise. Go ask your local Funeral Director for one.
- tptacek 12y agoAnd you're in tech now? That's an interesting career transition. You might write it up sometime; I love stories like that.
- _mgr 12y agoIt's a tale of a misspent youth, wasted 20's, and a procrastinating disaffected attempt to reclaim my life as I now begin my 30's.
- deleted 12y ago[deleted]
- ultrasandwich 12y agoAgreed. I'm intrigued.
- mmcdan 12y agoI echo this sentiment. Would love to hear about your path to tech.
- ntrepid8 12y agoI'm sure this is true, but all of the manufacturers provide postage paid biohazard boxes for the explanted devices to be returned to the manufacturer and properly disposed of. All you have to do is call the customer service number and ask for some to be sent to you.
- tlrobinson 12y agoHow did ErrataSec find (or verify) this vulnerability if they didn't have access to the pacemaker? I'm assuming no pacemaker owners were harmed in the finding of this vulnerability.
- blafunke 12y agoIt seems to me this article is a fantasy. A what if scenario. I don't think this guy really knows pacemakers at all frankly. A bluetooth enabled pacemaker seems far fetched and to my knowledge such a thing does not exist. Pacemakers require the reader device to be in contact with the patient directly over the pacemaker, the range is that limited.
- deleted 12y ago[deleted]
- bryanh 12y agoAlso, be prepared to be labeled a murderous hacker.
- frozenport 12y agoDon't you need surgery to fix it?
- kijin 12y agoIf a pacemaker can be remotely exploited, it can probably be remotely patched as well. Once you have remote root, anything is possible.
- jessaustin 12y agoIt's probably easier to crash than root.
- psychometry 12y agoThere's no need to call CNN. We have Youtube now, which would arguably be a more effective medium if the video can achieve any level of virality.
- kevinchen 12y agoI'd guess the demographic that cares about this does not go on YouTube enough to make it more effective.
- mullingitover 12y agoDoesn't matter, CNN et al will rebroadcast once it's gone viral.
- rtpg 12y agoI think you underestimate the power of mailing lists among the general public
- psychometry 12y agoIs there a demographic left that doesn't go on YouTube?
- vacri 12y agoI understand that this isn't the purview of yellow journalism, but to be accurate, the statement should be: "I can now kill your grandmother just by walking past her on the street, and asking her to stand still while I hold an induction wand quite close to her pacemaker"
- redthrowaway 12y agoYou got me thinking, so I looked up the protocols used. It's apparently not nearly that complex or limited: http://www.secure-medicine.org/public/publications/icd-study.pdf http://www.secure-medicine.org/public/publications/icd-study... http://en.wikipedia.org/wiki/Medical_Implant_Communication_Service http://en.wikipedia.org/wiki/Medical_Implant_Communication_S...
- blafunke 12y agoNo, original commenter is correct. You'd need contact with your victim, you have to hold a reader device directly over the pacemaker. Really you may as well stab them.
- blafunke 12y agoI'd like to know how hard (or easy) it would be to fool a PM into causing and unsafe fast heartbeat. I would imagine there are safeguards at a low level against such a fault. The easiest thing for a PM hacker to do, assuming they have close physical contact with the victim, would be to shut off the pacemaker and in most cases that would not do much more than cause dizziness or fainting.
- jph 12y agoTerrible advice to pull a media stunt. First, you have no idea what the manufacturer needs to do to fix the problem, alert customers, do recalls and recertifications, and the like. Second, you put yourself directly in the line of fire unnecessarily and for all the wrong reasons. You could find yourself on the end of all kinds of legal trouble, and on top of that you would be morally culpable for any harm. Do it the right way: get a lawyer. The lawyer will know how to contact the vendors, the regulatory agencies, media if necessary, and customers if necessary.
- kennywinker 12y agoI think OP is suggesting reveal the effect, but don't reveal the cause. That's what makes the suggestion different from releasing an 0day
- chime 12y agoIf it's as easy as using 'strings', then isn't that no different than releasing a 0day?
- 6d0debc071 12y agoIf it's that simple he or she has, in effect, already released it.
- polarix 12y agoAnd who pays the lawyer?
- aaronbrethorst 12y agoI expect that any savvy lawyer would be happy to take this pro bono. Think of how much free publicity they'd get for their practice.
- eps 12y agoAh, excellent plan. That's a variation of a good old "you should write us an app / design a logo / sketch a website for free, just for all the exposure you get".
- Lagged2Death 12y agoWatch how long it takes them to fix it then... That strikes me as really optimistic. Another scenario: Medical equipment manufacturing lobby (I'm assuming there is such a thing) pushes to have such disclosures treated as acts of terrorism. Manufacturer issues a patch that fixes your very specific vulnerability in some trivial, meaningless way. Your career is ruined. Pacemakers truly secured: 0.
- sudont 12y agohttps://www.opensecrets.org/lobby/clientsum.php?id=D000022110 https://www.opensecrets.org/lobby/clientsum.php?id=D00002211... Yes, there is a lobby.
- shard972 12y ago> Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers We should probably check first to see if BIOTRONIC is one of their advertisers first, might be an issue.
- EGreg 12y agoEverything except shorting their stock. If you wrote a hard-hitting exposé or a John Stossel-type broadcast you aren't likely to be branded a terrorist. Make sure you don't reveal how it's actually done, but the fact that it can be. In short - media showing the potential results (and dramatizing them) puts heat on the company to fix it.
- harrylove 12y agoIf you attempt a stunt like this, please first consider the people who have these pacemakers in their bodies. Put yourself in their shoes as they're watching the news broadcast or getting a frantic call from a family member. Let's say one of them panics out of fear, has a heart attack, and dies. The family reports this to the media. Now the news media is hunting you down. The authorities want to have a word with you, and you're the target of several lawsuits. Not to mention, you just killed someone with your flippant remarks. Technically speaking, the device manufacturer hasn't hurt anyone at this point. But you've contributed to the death of a person. Is that really what you're after? Contacting a lawyer to understand the protocol for disclosure and the ramifications won't cost you anything for the initial consultation. Contact the EFF or ACLU and ask for advice. Ask them who you should contact next.
- baddox 12y ago> If you attempt a stunt like this, please first consider the people who have these pacemakers in their bodies. Put yourself in their shoes as they're watching the news broadcast or getting a frantic call from a family member. The whole idea is to handle this knowledge in the way that leads to the least hardship/pain/death. It's quite possible that a "stunt" like this is the best way, especially considering that there will likely be other less virtuous people making this discovery on their own soon.
- rlpb 12y ago> Technically speaking, the device manufacturer hasn't hurt anyone at this point. But you've contributed to the death of a person. Is that really what you're after? I agree that this could happen, but the obvious argument is that technically the device manufacturer did just kill their customers by 1) selling them a defective product; and 2) failing to take the opportunity to fix it when notified.
- sturmeh 12y agoThen they cut to an ad of Watch_Dogs.
- nl 12y agoI'd imagine the correct thing to do is use the FDA's "MedWatch Online Voluntary Reporting Form". Use the MedWatch form to report adverse events that you observe or suspect for human medical products, including serious drug side effects, product use errors, product quality problems, and therapeutic failures for:... Medical devices (including in vitro diagnostic products) [1] https://www.accessdata.fda.gov/scripts/medwatch/ https://www.accessdata.fda.gov/scripts/medwatch/
- redthrowaway 12y agoThat strikes me as a system that was set up with the best intentions, but which in practice acts as a barrier to, rather than facilitator of, change. The only way I can see it compelling a manufacturer to change is if someone is killed by this exploit and their family uses the existence of a report of that vulnerability to push for massive willful negligence damages in a lawsuit.
- nl 12y agoThat strikes me as a system that was set up with the best intentions, but which in practice acts as a barrier to, rather than facilitator of, change Hu? I can see an argument that is is ineffective (maybe it just drops into the FDA bureaucracy), but I'm not sure how you can argue it is actually a barrier? The FDA does actually have some pretty significant regulatory authority over medical devices. IANAL, but it appears this may be one of the limited cases where the FDA may actually be able to force a recall[1] as opposed to just requesting it. I suspect (and hope) the "recall" would actually be limited to a software update in this case. Even if they can't force it, a FDA-requested recall is a pretty significant thing. [1] http://www.fda.gov/downloads/AboutFDA/Transparency/PublicDisclosure/GlossaryofAcronymsandAbbreviations/UCM212063.pdf http://www.fda.gov/downloads/AboutFDA/Transparency/PublicDis...
- nl 12y agoI'd suggest contacting Andrea Peterson at the Washington Post, and letting her know you have a follow up story for her piece on how Dick Cheneys had the wireless on his pacemaker disabled[1]. [1] http://www.washingtonpost.com/blogs/the-switch/wp/2013/10/21/yes-terrorists-could-have-hacked-dick-cheneys-heart/ http://www.washingtonpost.com/blogs/the-switch/wp/2013/10/21...
- qbrass 12y agoThis might sound pedantic, but don't say "I can now kill your grandmother," it makes you look evil instead of the company you're trying to shame. BIOTRONIC releasing the patch they should have released anyway, just to stop your evil scheme of murdering the elderly, turns into a PR win for them.
- droope 12y agoisn't that what weev did? he sure got arrested and prosecuted for it
- captainmuon 12y agoNo need to involve the media. Call the police, and make an anonymous death threat towards a well-known person with a pacemaker. They will have to investigate. Then send them your POC anonymously.
- madaxe_again 12y agoThat will land him in prison. Have you learned nothing?! Think AT&T - and that's just frigging phone info. For this, they'll tar him a terrorist and throw him in a hole to die.
- aquadrop 12y ago"I can now kill your grandmother" - very bad phrasing for TV...
- blafunke 12y agoBut first have some skepticism. You can't interface with a PM without direct contact with a patient. Pacemakers are not bluetooth enabled wifi connected internet appliances. Yes, they are programmed remotely, but in this case remote means a reader device that must be physically placed on a person directly over the pacemaker. While there are things to be legitmately concerned about, this article is a wild fantasy.