Whipped Cream Difficulties

Another Ars story based on another Black Hat panel:

Life-saving pacemakers manufactured by Medtronic don’t rely on encryption to safeguard firmware updates, a failing that makes it possible for hackers to remotely install malicious wares that threaten patients’ lives, security researchers said Thursday.

The presentation in question is “Understanding and Exploiting Implanted Medical Devices” by Billy Rios and Jonathan Butts. No slides or white paper yet, so I don’t want to comment very much. But: I do also want to point out this article, “The $250 Biohack That’s Revolutionizing Life With Diabetes“. Why? Well…

The DIY pancreas movement would never have happened if not for a Medtronic blunder. In 2011 a pair of security researchers alerted the public that the wireless radio frequency links in some of the company’s best-selling insulin pumps had been left open to hackers. Medtronic closed the loophole after the researchers warned of risks to patients, but it never recalled the devices, leaving thousands in circulation.

Some additional interesting looking work:

• “TRITON: How it Disrupted Safety Systems and Changed the Threat Landscape of Industrial Control Systems, Forever” by Andrea Carcano, Marina Krotofil, and Younes Dragoni. “In 2017, a sophisticated threat actor deployed the TRITON attack framework engineered to manipulate industrial safety systems at a critical infrastructure facility. This talk offers new insights into TRITON attack framework which became an unprecedented milestone in the history of cyber-warfare as it is the first publicly observed malware that specifically targets protection functions meant to safeguard human lives.” Slides. White paper.
• “There will be Glitches: Extracting and Analyzing Automotive Firmware Efficiently” by a whole bunch of people.
• And it just wouldn’t be a security conference in 2018 without a Tesla attack: “Over-the-Air: How we Remotely Compromised the Gateway, BCM, and Autopilot ECUs of Tesla Cars” by Ling Liu, Sen Nie, Wenkai Zhang, and Yuefeng Du. White paper is at the link: slides are broken.

That’s all I’ve been able to turn up today. More tomorrow, I hope.

This entry was posted on Thursday, August 9th, 2018 at 7:48 pm and is filed under Cars, DEFCON, DEFCON 26. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.