Technology now plays a huge role in our lives – our lives depend on it – including our SmartWatches, but also our medical devices. Unfortunately, we often forget that even medical devices, the ones that help us save lives, are also technological devices that could be affected by many security issues, just like a regular computer… and hackers can exploit these vulnerabilities, so ransomware infection is a possible scenario!
A report published by Forrester and released a few days ago predicts that in 2016 we will start to see ransomware taking advantage of medical devices.
Imagine a patient with a pacemaker suddenly receiving a message on their phone saying: “Do you want to continue using your pacemaker? Pay us 2 bitcoins.” This may seem strange to you, but it is a situation that could happen in the near future.
It's a bold prediction from the report "Predictions 2016: Cybersecurity Swings To Prevention," but honestly it's something that's already crossed our minds.
We could argue that it's not right to profit from cases like this, but there are many scammers who simply don't care.
ICS-ALERT-13-164-01 from 2013 by Rios and Terry McCorkle showed that 300 medical devices use difficult passwords, set at the factory and that cannot be disabled or modified, these passwords are separated in the manufacturer's manual.
The truth is that cybersecurity has been around for maybe the last 15-25 years, but this is something new in the medical industry, as Joshua Corman, founder of “I Am the Cavalry,” states:
“As we’ve been doing this cyber work for 15-25 years, this is year zero or one for them [the healthcare industry],” “We can’t give them 15-25 years to catch up, although it’s not logical for them to get to the same point overnight… We’re trying to approach it with teamwork and advocacy, and not as a pointing finger, but as a helping hand.”
Ransomware , and major security vendors report that 2015 saw a huge increase in ransomware usage, which tends to be used more with IoT devices.
A few months ago, a list was developed by “I Am the Cavalry”, which was created to mitigate the threat to cars and now they are planning the same type of list, but this time for Medical Devices.
There are a lot of challenges when you're dealing with medical devices, but we're starting to see a lot of people concerned about that, so a lot of security researchers are going to focus their attention on that. But we also need to support the medical device manufacturers.
