8,000 security vulnerabilities found in implanted medical devices

Medical devices might be your next security nightmare, researchers warn after discovering at least 8,000 common code vulnerabilities in pacemakers. Defibrillators, insulin pumps and other medical devices that can now connect to the internet and allow remote monitoring.

Last year the US Food and Drug Administration published some 30 pages of guidelines to identify and mitigate threats. Even though these devices can be easily hacked, most manufacturers to ignore the US government’s warnings.

Medical devices suffer from one of the most common security issues seen among all smart gadgets on the market; they either come with default or weak credentials or have no password protection whatsoever, easily exposing patient medical records.

Two recent studies show that critical medical devices are more susceptible to attacks than ever due to the number of security bugs and poor data encryption. Although they are aware of the security risks in their products, only 17 percent of medical device manufacturers have implemented stronger security in their products, one of the studies found, while 49 percent disregarded security guidelines issued by the FDA. As little as 9 percent conduct annual tests to detect the security vulnerabilities in the devices.

Hackers are more sophisticated in their attacks, and their ability to create IoT botnets for DDoS attacks increases security alerts. Medical device security should become a high priority for both manufacturers and health institutions, as a cyberattack may turn into a life or death situation, especially if implanted devices are involved.

The US Department of Homeland Security has been informed of the findings.