Security for Implanted Medical Devices
Worried about someone hacking your implanted medical devices? Here’s a signal-jamming device you can wear.
Entries Tagged "medicine"
Page 5 of 9
Search Redirection and the Illicit Online Prescription Drug Trade
Really interesting research.
Search-redirection attacks combine several well-worn tactics from black-hat SEO and web security. First, an attacker identifies high-visibility websites (e.g., at universities) that are vulnerable to code-injection attacks. The attacker injects code onto the server that intercepts all incoming HTTP requests to the compromised page and responds differently based on the type of request:
Requests from search-engine crawlers return a mix of the original content, along with links to websites promoted by the attacker and text that makes the website appealing to drug-related queries.
- Requests from users arriving from search engines are checked for drug terms in the original search query. If a drug name is found in the search term, then the compromised server redirects the user to a pharmacy or another intermediary, which then redirects the user to a pharmacy.
- All other requests, including typing the link directly into a browser, return the infected website’s original content.
- The net effect is that web users are seamlessly delivered to illicit pharmacies via infected web servers, and the compromise is kept hidden from view of the affected host’s webmaster in nearly all circumstances.
Upon inspecting search results, we identified 7,000 websites that had been compromised in this manner between April 2010 and February 2011. One quarter of the top ten search results were observed to actively redirect to pharmacies, and another 15% of the top results were for sites that no longer redirected but had previously been compromised. We also found that legitimate health resources, including authorized pharmacies, were largely crowded out of the top results by search-redirection attacks and blog and forum spam promoting fake pharmacies.
And the paper.
Putting Unique Codes on Objects to Detect Counterfeiting
This will help some.
At least two rival systems plan to put unique codes on packages containing antimalarials and other medications. Buyers will be able to text the code to a phone number on the package and get an immediate reply of “NO” or “OK,” with the drug’s name, expiration date, and other information.
To defeat the system, the counterfeiter has to copy the bar codes. If the stores selling to customers are in on the scam, it can be the same code. If not, there have to be sufficient different bar codes that the store doesn’t detect duplications. Presumably, numbers that are known to have been copied are added to the database, so the counterfeiters need to keep updating their codes. And presumably the codes are cryptographically hard to predict, so the only way to keep updating them is to look at legitimate products.
Another attack would be to intercept the verification system. A man-in-the-middle attack against the phone number or the website would be difficult, but presumably the verification information would be on the object itself. It would be easy to swap in a fake phone number that would verify anything.
It’ll be interesting to see how the counterfeiters get around this security measure.
Statistical Distribution of Combat Wounds to the Head
This is interesting:
The study, led by physician Yuval Ran, looked at Israeli combat deaths from 2000 to 2004 and tracked where bullet entries appeared on the skull (illustrated above), finding that the lower back (occipital region) and front of the temple areas (anterior-temporal regions) were most likely.
I’m not sure it’s useful, but it is interesting.
Hot Dog Security
A nice dose of risk reality:
Last week, the American Academy of Pediatrics issued a statement calling for large-type warning labels on the foods that kids most commonly choke on—grapes, nuts, carrots, candy and public enemy No. 1: the frank. Then the lead author of the report, pediatric emergency room doctor Gary Smith, went one step further.
He called for a redesign of the hot dog.
The reason, he said, is that hot dogs are “high-risk.” But are they? I mean, I certainly diced my share of Oscar Mayers when my kids were younger, but if once in a while we stopped for a hot dog and I gave it to ’em whole, was I really taking a crazy risk?
Here are the facts: About 61 children each year choke to death on food, or one in a million. Of them, 17 percent—or about 10—choke on franks. So now we are talking 1 in 6 million. This is still tragic; the death of any child is. But to call it “high-risk” means we would have to call pretty much all of life “high-risk.” Especially getting in a car! About 1,300 kids younger than 14 die each year as car passengers, compared with 10 a year from hot dogs.
What’s happening is that the concept of “risk” is broadening to encompass almost everything a kid ever does, from running to sitting to sleeping. Literally!
There’s a lot of good stuff on this website about how to raise children without being crazy paranoid. She comments on my worst-case thinking essay, too.
Botox as a Terrorist Threat
From Scientific American, no less.
EDITED TO ADD (6/12): A JAMA article.
Terrorizing Ourselves
Who needs actual terrorists?
How’s this for an ill-conceived emergency preparedness drill? An off-duty cop pretending to be a terrorist stormed into a hospital intensive care unit brandishing a handgun, which he pointed at nurses while herding them down a corridor and into a room.
There, after harrowing moments, he explained that the whole caper was a training exercise.
[…]
The staff at St. Rose Dominican Hospitals-Siena Campus, where the incident took place Monday morning, found the exercise more traumatizing than instructive.
Perhaps a better way to phrase it is that they learned to be terrorized.
Security for Implantable Medical Devices
Interesting study: “Patients, Pacemakers, and Implantable Defibrillators: Human Values and Security for Wireless Implantable Medical Devices,” Tamara Denning, Alan Borning, Batya Friedman, Brian T. Gill, Tadayoshi Kohno, and William H. Maisel.
Abstract: Implantable medical devices (IMDs) improve patients’ quality of life and help sustain their lives. In this study, we explore patient views and values regarding their devices to inform the design of computer security for wireless IMDs. We interviewed 13 individuals with implanted cardiac devices. Key questions concerned the evaluation of 8 mockups of IMD security systems. Our results suggest that some systems that are technically viable are nonetheless undesirable to patients. Patients called out a number of values that affected their attitudes towards the systems, including perceived security, safety, freedom from unwanted cultural and historical associations, and self-image. In our analysis, we extend the Value Sensitive Design value dams and flows technique in order to suggest multiple, complementary systems; in our discussion, we highlight some of the usability, regulatory, and economic complexities that arise from offering multiple options. We conclude by offering design guidelines for future security systems for IMDs.
Storing Cryptographic Keys with Invisible Tattoos
This idea, by Stuart Schechter at Microsoft Research, is—I think—clever:
Abstract: Implantable medical devices, such as implantable cardiac defibrillators and pacemakers, now use wireless communication protocols vulnerable to attacks that can physically harm patients. Security measures that impede emergency access by physicians could be equally devastating. We propose that access keys be written into patients’ skin using ultraviolet-ink micropigmentation (invisible tattoos).
It certainly is a new way to look at the security threat model.
Electronic Health Record Security Analysis
In British Columbia:
When Auditor-General John Doyle and his staff investigated the security of electronic record-keeping at the Vancouver Coastal Health Authority, they found trouble everywhere they looked.
“In every key area we examined, we found serious weaknesses,” wrote Doyle. “Security controls throughout the network and over the database were so inadequate that there was a high risk of external and internal attackers being able to access or extract information without the authority even being aware of it.”
[…]
“No intrusion prevention and detection systems exist to prevent or detect certain types of [online] attacks. Open network connections in common business areas. Dial-in remote access servers that bypass security. Open accounts existing, allowing health care data to be copied even outside the Vancouver Coastal Health Care authority at any time.”
More than 4,000 users were found to have access to the records in the database, many of them at a far higher level than necessary.
[…]
“Former client records and irrelevant records for current clients are still accessible to system users. Hundreds of former users, both employees and contractors, still have access to resources through active accounts, network accounts, and virtual private network accounts.”
While this report is from Canada, the same issues apply to any electronic patient record system in the U.S. What I find really interesting is that the Canadian government actually conducted a security analysis of the system, rather than just maintaining that everything would be fine. I wish the U.S. would do something similar.
The report, “The PARIS System for Community Care Services: Access and Security,” is here.
Sidebar photo of Bruce Schneier by Joe MacInnis.