Two days ago Information Week wrote an article about 3 medical students suggesting that there is a possibility of a pacemaker (with wireless capabilities) being susceptible to hacking. An excerpt from the Information Week article:

“Our investigation shows that an implantable cardioverter defibrillator (1) is potentially susceptible to malicious attacks that violate the privacy of patient information and medical telemetry, and (2) may experience malicious alteration to the integrity of information or state, including patient data and therapy settings for when and how shocks are administered,”

I suspect this will remain just what it is, a proof of concept. What low life would want to target some poor soul with a pacemaker is beyond me. Let’s assume for a moment somebody did attempt to hack one of these pacemakers, they could potentially murder the person they are targeting. I can’t see how the reward is valuable enough to initiate the action.

In the article the medical students claim that it is unlikely that this will happen:

“We believe that the risk to patients is low and that patients should not be alarmed,” the researchers say. “We do not know of a single case where an IMD [implantable medical device] patient has ever been harmed by a malicious security attack. To carry out the attacks we discuss in our paper would require: malicious intent, technical sophistication, and the ability to place electronic equipment close to the patient. Our goal in performing this study is to improve the security, privacy, safety, and effectiveness of future IMDs.”

Curiously though, their reasons above for why the risk is low are completely misguided. First they say someone would need to have malicious intent. Well, correct me if I’m wrong but most hackers do have some form of malicious intent, wouldn’t you say? The medical students continue by saying someone would need “technical sophistication”… this is perhaps one of the most asinine statements I ever read. Unfortunately many of these computer criminals are more sophisticated than these medical students would like us to believe. Many of today’s top information security companies are headed up by a former hacker.

Nevertheless, minus the irrelevant reasons why this wouldn’t happen according to these medical students, I have a theory. Maybe somewhere deep in the mind of the potentially malicious hacker lies some degree of morality, and maybe not!

Let’s hope in this case there is some morality somewhere.