Pacemakers get update after security flaw found

There have been no known attacks using the flaw, with a firmware update now being rolled out

Three-quarters of a million pacemakers have a vulnerability that could let hackers access the implanted equipment, running down the battery or meddling with the pacing.

The US Food and Drug Administration (FDA) issued a warning that anyone with a specific model of radio frequency-enabled pacemaker from manufacturer Abbott needs to visit a medical professional to have the firmware updated.

There are no reports of the flaws being used to hack a pacemaker, the FDA and Abbott stressed. "There are no known reports of patient harm related to the cybersecurity vulnerabilities in the 465,000 (US) implanted devices impacted," the alert said. Alongside the half million pacemakers in use in the US, the company told the BBC that there were a further 280,000 used in other countries. 

The firmware update highlights the issues raised by connecting everything from home appliances to medical equipment to the internet, although the latter could have much more serious repercussions. Abbott stressed that security affects all industries and noted its devices were having a "significant positive impact for patients and their health".

Unlike other industries, medical updates are complicated as they need to be approved by the FDA first, to ensure code doesn't brick the hardware not unheard of with other smart devices that receive updates.

The FDA has approved the firmware update, but it can't be installed over-the-air, requiring patients to visit their doctors. "The update process will take approximately three minutes to complete," the alert notes. "During this time, the device will operate in backup mode (pacing at 67 beats per minute), and essential, life-sustaining features will remain available."

The alert warns that there's a tiny risk of losing data or settings, but it's below 1%. However, it warned that the update should be run for patients dependent on the device at a facility that can offer temporary cardiac pacing in case of any failures.

The firmware isn't only patching the vulnerabilities, Abbot said, but boosting security via encryption and network connectivity management tools. "To further protect our patients, Abbott has developed new firmware with additional security measures that can be installed on our pacemakers," said Robert Ford, executive vice president of medical devices at Abbott, in a statement.

It isn't clear why the update is being rolled out. Abbott said it was "scheduled" while the FDA said it had "reviewed information concerning potential cybersecurity vulnerabilities," but didn't say where the information came from. 

The warning applies to a specific set of devices made by Abbott, formerly known as St Jude Medical. The FDA alert has the full details here.

Featured Resources

Security analytics for your multi-cloud deployments

IBM Security QRadar SIEM solution brief

Download now

Five reasons to move to the cloud

Join the enterprises moving their workloads to the cloud

Download now

Architecting hybrid IT and edge for digital advantage

Why business leaders should consider a hybrid IT strategy

Download now

Six reasons to accelerate remote asset monitoring with AI

How to optimise resources, increase productivity, and grow profit margins with AI

Download now

Recommended

Microsoft open sources CodeQL queries used in Solorigate inquiry
Security

Microsoft open sources CodeQL queries used in Solorigate inquiry

26 Feb 2021
CISA warns of ongoing Accellion File Transfer Appliance attacks
hacking

CISA warns of ongoing Accellion File Transfer Appliance attacks

25 Feb 2021
What is a Trojan?
Security

What is a Trojan?

25 Feb 2021
Cyber security firm saw attacks rise by 20% during 2020
cyber security

Cyber security firm saw attacks rise by 20% during 2020

23 Feb 2021

Most Popular

Npower shuts down app after hackers steal user data
hacking

Npower shuts down app after hackers steal user data

25 Feb 2021
Hackers publish Bombardier data in wide-reaching FTA cyber attack
cyber attacks

Hackers publish Bombardier data in wide-reaching FTA cyber attack

24 Feb 2021
New monitors for an agile new normal
Sponsored

New monitors for an agile new normal

19 Feb 2021