Kaspersky warns of hackable brain implants
A newly developed class of brain implants could also become hacking targets, researchers are warning.
Kaspersky Lab and the University of Oxford Functional Neurosurgery Group warn in a joint report that the brain stimulation devices used to treat disorders like Parkinson's and OCD carry with them security vulnerabilities that would potentially allow an attacker to manipulate the medical implants.
Those flaws include things like vulnerabilities in the web apps used to administer the devices and bugs in the tablet and smartphone applications doctors use to set up and record data from the implants, as well as poor practices like using default passwords or unencrypted data transmissions.
The vulnerabilities themselves are no different from those affecting other medical implants, with researchers long-warning that such flaws were a weak point in the security chain. Earlier this month, one such flaw caused medical device company Medtronic to cut off automatic update support for one of its lines of pacemaker programmers.
Where the brain implants differ, say Kaspersky, is in their enormous potential for development. The study noted that biomed companies are already looking to implants as a way to alter or recover memories to treat conditions like PTSD, and with the ability to directly affect the brain possible, an attack on a device would become far more dangerous.
"Although no attacks targeting neurostimulators have been observed in the wild, points of weakness exist that will not be hard to exploit," said Kaspersky Lab researcher Dmitry Galov.
"We need to bring together healthcare professionals, the cybersecurity industry and manufacturers to investigate and mitigate all potential vulnerabilities, both the ones we see today and the ones that will emerge in the coming years."
At the same time, the report notes that security will not be the only concern with this new class of devices. As doctors will need to have unfettered access to devices, security can't be implemented in its current form, but will instead need to be looked at from a more holistic point of view.
"When it comes to future security, there are two things to bear in mind," the report concludes.
"The first is that many of the potential vulnerabilities could be reduced or even eliminated by appropriate security education for clinical care teams and patients. The second thing is that patient needs will always take precedence, which means that compromises will inevitably need to be made."
Source theregister
Industry: Cyber Security News
Latest Jobs
-
- PCI QSA needed. Discreet Opportunity | London | Client facing
- London
- N/A
-
CH08421 PCI QSA needed. Discreet Opportunity | London | Client facing. Payment Card Industry - Qualified Security Assessor - London Seeking someone looking to accelerate their career, into a variety of interesting clients / projects. Must be happy to be onsite with clients- this is not a fully remote role. You must currently hold a valid CISSP or CISM or ISO27001 lead implementer certification AND one of the following; CISA, GSNA, iso27001 lead Auditor, CIA or IRCA ISMS auditor+ Visa sponsorship not available. Apply today for more information chris.holt@dclsearch.com Use this whatapp link to reach out https://wa.me/message/6USF5RAQBOZIP1
-
- Network / Security Infrastructure Engineer | West London | Permanent
- London
- N/A
-
Network / Security Infrastructure Engineer | West London | Current Config, Install, upgrade experience On prem / Datacetner experience essential. Hands on experience MUST include: Routing, Switching, Network Security (firewall, IDS etc), Microsoft exchange / Exchange 365. Scripting / automation experience wanted. Python, Powershell etc Regular travel to West London is required. Visa sponsorship not available. Apply today for more information chris.holt@dclsearch.com Use this whatapp link to reach out https://wa.me/message/6USF5RAQBOZIP1
-
- Security Operations / information Security Analyst / Engineer. London
- London
- N/A
-
Security Operations / information Security Analyst / Engineer needed for a London opportunity. A technical hands on role to investigate, escalate and proactively work to protect a globally recognised brand. Someone with SOC Analyst / security engineering background would be well suited. This position will join a small team and would suit someone that has broad experience across the security threat landscape. Experience / knowledge across industry GRC standards such NIST, ISO27001 etc very advantageous and a priority. You will work across multiple teams proactively working to secure the business. Must be able to commute to Central London 3 days a week. Visa sponsorship not available Apply today to find out more.
-
- Security Cleared Penetration Tester: United Kindom
- N/A
- N/A
-
Security Cleared Penetration Tester Deliver technical Penetration tests to the NCSC CHECK standard. Active CHECK Member or Leader status desirable either in Web Application or Infrastructure. Reach out to find out more. Whatsapp directly here https://wa.me/message/6USF5RAQBOZIP1 Or apply today