Conference Presentation
Kevin Fu
- The speaker, a professor at the University of Michigan and co-founder/chief scientist at Virta Labs (which closed a seed round last Friday), uses a hotel keypad example to illustrate that security models often fail because they do not account for how adversaries bypass intended logic rather than exploiting software bugs.
- Early implanted medical devices, such as defibrillators, utilized physical potentiometers and needle access for reprogramming to prevent infection risks associated with wireless communication.
- Wireless technology was introduced to medical devices to mitigate the risk of surgical infection, but this shift introduced new attack vectors that were not present in the pre-wireless era.
- Researchers reverse-engineered an implanted defibrillator and discovered they could wirelessly trigger a debugging command to induce fatal heart rhythms, a vulnerability that has since been patched.
- Most implanted medical devices have an operational lifespan of 5 to 7 years before battery replacement or surgical explantation, meaning legacy vulnerabilities in older devices are being phased out as devices are replaced.
- The speaker argues that while wireless was originally adopted to address specific safety risks, it is now frequently added to devices for marketing purposes ("bacon on everything") rather than clinical necessity.
- Common vectors for malware infection in healthcare include vendor-provided USB sticks during software updates, repair processes spreading infections between devices, and accidental contamination during manufacturing assembly lines.
- A specific case involved a ventilator manufacturer that inadvertently attached malware to a software update distributed via their website, which triggered Google Safe Browsing warnings, forcing biomedical engineers to choose between security protocols and operational urgency.
- Researcher Billy Rios discovered a critical vulnerability in an infusion pump where a root shell was accessible via Telnet on port 23, leading the FDA to issue a strong advisory effectively recalling the device due to patient risk.
- Electromagnetic interference (EMI) can be weaponized to trick IoT sensors into receiving falsified inputs by modulating carrier waves at the resonant frequencies of internal wires, effectively bypassing standard authentication.
- Proofs of concept demonstrated that RF interference can trick pacemakers into entering a sleep mode by mimicking normal cardiac rhythms, and acoustic tones can destabilize drones by resonating with MEMS accelerometers.
- The "Row Hammer" vulnerability, originally a reliability issue, has been repurposed to allow attackers to write to specific memory addresses and escalate privileges to supervisor level.
- The speaker's team advocates for a "trust but verify" approach to sensor data in IoT, emphasizing the need to validate that physical phenomena are genuine before acting on them.
- Virta Labs recently developed a product using machine learning to detect anomalies and malware in ruggedized hospital environments by monitoring power consumption patterns at the outlet.
- The startup's founding team formed organically through a crisis response after a house collapse, selecting members based on their ability to collaborate effectively during the crisis rather than prior business intent.
- The speaker notes that while sophisticated nation-state attacks are not yet the primary threat, the current landscape is dominated by low-hanging fruit involving older malware and poor security practices in high-consequence devices.