Medtronic (previously) is a notoriously insecure medical implant manufacturer whose devices have been repeatedly shown to be grossly insecure -- their pacemakers can be hacked before leaving the factory!
To make things worse, the company is notably hostile to independent security research and repair.
The latest twist in the saga: Medtronic has been the subject of an FDA security alert, which has prompted the company to finally disable its insecure software updating system (which let hackers push malicious updates to the hardware "wands" used to update pacemakers) for some models (after denying that this was a problem!).
These wands will now have to be updated by USB.
Two models, the Carelink 2090 and the Carelink Encore 2091, could have been tampered with by an attacker modifying their firmware and, in turn, change how the programmers configured the implants. Medtronic said that now not only does it believe those vulnerabilities would be locally exploitable, but could also be targeted by an attacker who was able to remotely access the device.
"Although the programmer uses a virtual private network (VPN) to establish an internet connection with the Medtronic [software distribution network] SDN, the vulnerability identified with this connection is that the programmers do not verify that they are still connected to the VPN prior to downloading updates," the FDA explained.
"To address this cybersecurity vulnerability and improve patient safety, on October 5, 2018, the FDA approved Medtronic's update to the Medtronic network that will intentionally block the currently existing programmer from accessing the Medtronic SDN."
It's the real Heart Bleed: Medtronic locks out vulnerable pacemaker programmer kit [Shaun Nichols/The Register]
Is a wooden lock as tough as one made out of metal? Nope. Is buying a lock easier than building one? Absolutely. Is a lock you made with your own two hands significantly more badass than anything you can purchase, ready-to-use? Without a shadow of a doubt. If you’re looking for an unusual woodworking project […]
"Privacy Not Included" is Mozilla's Christmas shopping (anti)-guide to toys and gadgets that spy on you and/or make stupid security blunders, rated by relative "creepiness," from the Nintendo Switch (a little creepy) to the Fredi Baby monitor (very creepy!).
Alex Jones, starved of attention since he was no-platformed by Big Tech, has launched a desperate bid for notoriety, releasing an unhinged (even by Jones's standards) statement blaming the credit-card skimming malware his online store was serving on "a zero-day hack probably carried out by leftist stay behind networks hiding inside US intelligence agencies" (he […]
A picture can be worth a heck of a lot more than just a thousand words. If you’ve squinted for ages trying to get just the right photo, you might have the right passion for a career behind the camera. You might even have the right equipment, but do you have the know-how? The Beginner-To-Expert […]
In case you hadn’t noticed from the sleigh bell-heavy music and the hues on your Starbucks cup, the holiday season hasn’t shown any more patience this year. But that doesn’t need to be a bad thing, especially if you’re hoping to get a jump on your shopping. Retailers aren’t waiting til Black Friday to dish […]
What do you get for the techie who has everything? How about giving them a Raspberry Pi and letting them make pretty much anything. Or better yet, do it for yourself with the Ultimate Raspberry Pi eBook Bundle. This trove of ideas and education unlocks the unlimited potential of this mini-computer, whose affordability and versatility […]