Kaspersky warns of hackable brain implants

A newly developed class of brain implants could also become hacking targets, researchers are warning.

Kaspersky Lab and the University of Oxford Functional Neurosurgery Group warn in a joint report that the brain stimulation devices used to treat disorders like Parkinson's and OCD carry with them security vulnerabilities that would potentially allow an attacker to manipulate the medical implants.

Those flaws include things like vulnerabilities in the web apps used to administer the devices and bugs in the tablet and smartphone applications doctors use to set up and record data from the implants, as well as poor practices like using default passwords or unencrypted data transmissions.

The vulnerabilities themselves are no different from those affecting other medical implants, with researchers long-warning that such flaws were a weak point in the security chain. Earlier this month, one such flaw caused medical device company Medtronic to cut off automatic update support for one of its lines of pacemaker programmers.

Where the brain implants differ, say Kaspersky, is in their enormous potential for development. The study noted that biomed companies are already looking to implants as a way to alter or recover memories to treat conditions like PTSD, and with the ability to directly affect the brain possible, an attack on a device would become far more dangerous.

"Although no attacks targeting neurostimulators have been observed in the wild, points of weakness exist that will not be hard to exploit," said Kaspersky Lab researcher Dmitry Galov.

"We need to bring together healthcare professionals, the cybersecurity industry and manufacturers to investigate and mitigate all potential vulnerabilities, both the ones we see today and the ones that will emerge in the coming years."

At the same time, the report notes that security will not be the only concern with this new class of devices. As doctors will need to have unfettered access to devices, security can't be implemented in its current form, but will instead need to be looked at from a more holistic point of view.

"When it comes to future security, there are two things to bear in mind," the report concludes.

"The first is that many of the potential vulnerabilities could be reduced or even eliminated by appropriate security education for clinical care teams and patients. The second thing is that patient needs will always take precedence, which means that compromises will inevitably need to be made."

Source theregister

Industry: Cyber Security News