Security Analysis of the Pacemaker Home Monitoring Unit: A BlackBox Approach
Year: 2019
Type: dissertation
Abstract: With the fast rise of Internet of Things (IoT), electronics systems are more and more connected, exposing new attack surfaces on devices responsible for human life, such as automobiles or medical devices. While companies in these areas are keeping the internals of their devices closedsource, the consumer or patient has no other choice than to trust the manufacturers when it comes to their security. Pacemaker monitoring systems have been on the market for several years now and are no exception to this rule. Previous research on the security of these monitoring systems indicates that they often have vulnerabilities that can be exploited by malicious adversaries in order to threaten the patient’s life and privacy. This Master’s thesis investigates the security of the Biotronik’s Home Monitoring Unit, motivated by the absence of publicly available research on it. It was hypothesized that the Biotronik’s HMUs contain security vulnerabilities that might help an attacker with physical access to the device to get patients’ personal data or to be a threat to patients’ safety. We conducted a Black Box Testing approach of the HMU’s security and used off-the-shelves equipment along with open-source software to simulate the scenario of an external attacker having little knowledge about the device. The details of our work will be provided to the vendor to follow a coordinated vulnerability disclosure process. The research findings confirm that an attacker having physical access to the HMU has the ability to threaten both the patient’s privacy and safety. We also showed that no special skills nor expensive equipments are required to perform the attacks. Our technical findings open the door to more work on the communication link between the HMU and the pacemaker, as long as future work on Biotronik’s last generation of HMU. Our results also shed light on the importance for medical device manufacturers to consider security at every layer of their product and thus to include security as part of their development cycle.
Author: Guillaume Bour
Language: English
Topic: IoT and Edge/Fog Computing
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W3049401034