Special Topics in Security and Privacy of Medical Information. Reminders. Last lecture: Recap. Sujata Garera. Project part 1 submission

Transcription

1 Special Topics in Security and Privacy of Medical Information Sujata Garera Reminders Project part 1 submission Assignment 2 is online Last lecture: Recap Medical Telemetry Infrastructure Devices capturing vital signs Communication to a controller device (wirelessly) Controller device communicates over the internet to a doctors office for example What are some of the goals that should be kept in mind when setting such a system up? 1

2 Last lecture Recap: Work by Halperin et al. Security and privacy properties of an implantable cardioverter defibrillator (ICD) Includes pacemaker technology Communicates wirelessly with external programmer device in 175Khz frequency range What was the adversarial model they considered? Last lecture Recap: Results of study Recap: Reverse engineering transmissions Commercial Programmer Reverse Engineer 2

3 Recap:Reverse engineering transmissions Reverse engineering the physical layer Encoding convert data bits into radio symbols Modulation process of varying one waveform in relation to other waveform Recap: Reverse engineering transmissions Reverse engineering transmissions Observed that ICD and programmer used different modulation schemes but same encoding scheme Programmer used 2-FSK ICD used DBPSK ICD and Programmer used NRZI Recap: Reverse engineering transmissions Reverse engineering the physical layer Non-Return to Zero Inverted with bit stuffing Zero bits are represented with no change in symbol over one symbol period One bits are represented by a change of symbol state 3

4 Recap: Eavesdropping Transaction timeline of conversation between ICD programmer and ICD Through Eavesdropping were able to obtain PII and telemetry Information How were they able to identify if the data being sent is actually telemetry information? Active attacks with Software Programmer Replay attacks Transmit only attacks over 175 KHz band Start with ICD in known state Replay the transmissions in a loop One second to 37.7 seconds Observe ICD state after transmissions Active attacks Replay attacks Triggering ICD identification Replay 1.5 second auto identification trace recorded from programmer Disclosed several details about ICD such as model and serial number Disclosing patient data After identification programmer asks ICD for rest of information stored on it including patient data GNU Radio used to replay 26 second capture containing autoidentification and interrogation command ICD disclosed same information as with programmer 4

5 Active attacks Replay attacks Disclosing cardiac data Magnetic field can induce telemetry transmissions Replaying the initial part of the interrogatory command can also induce such transmissions from the ICD Changing patient name Used GNU radio to replay the trace for changing a patient name Active attacks Replay attacks Setting the ICD s clock Attack succeeded after 10 replays Changing therapies Therapies are ICD responses to cardiac events GNU Radio used to turn of therapies Without therapies ICD does not respond to potentially dangerous cardiac conditions Active attacks Replay attacks Inducing fibrillation ICD has a test mode in which it can induce ventricular fibrillation Introduced a 100 ohm resistor between the ICDs defibrillation ports to measure the voltage during a command shock 1 Joule shock sent using programmer Peak voltage observed is V Replayed command with software radio 30 replay attempts succeeded in causing similar voltage spikes 5

6 Zero power defenses What factors must one consider when incorporating security features in an ICD? Zero power defenses Effective approach should either prevent or deter attacks by malicious outsiders with custom equipment as well as insiders with commercial programmers Security and privacy should draw no power from the battery life Prevent DOS on power Security sensitive events should be effortlessly detectable by the patient Security mechanisms should not introduce failure modes Detection Zero power notification for patients Alerts patients to potentially malicious activities both by insiders using commercial programmers and by outsiders using custom attack hardware Wirelessly drives a piezo element that can audibly warn a patient of security sensitive events 6

7 Detection Zero power notification for patients How can you evaluate the effectiveness of their prototype? Detection Zero power notification for patients Placed prototype in an environment designed to simulate a human Prevention Zero power authentication 7

8 Prevention Zero power authentication Key management Large scale deployment of shared key material may pose risk of compromise by unauthorized party Revocation of privileges Zero power sensible key exchange Future directions Medical device design Investigate prevention detection and audit mechanisms Develop methods that balance security and privacy with safety and effectiveness Develop a set of design principles for secure design of IMDs and other medical devices 8

9 This lecture Based on Pacemakers and Implantable Cardiac Defibrillators: Software Radio attacks and Zero Power Defenses by Halperin et al. available on website. Security and Privacy for Implantable Medical Devices 9