Medical equipment can be taken over and controlled remotely by hackers
09/15/2015 / By cyberwar
The development of a form of medical technology known as telesurgery, which uses robotic arms capable of performing surgery that can be remotely controlled, has tremendous potential to save lives and money. The ability to remotely perform a surgical procedure is an inexpensive way to partially solve the problems associated with the lack of expert surgeons in remote areas, for example.
However, security flaws have recently been identified regarding the remote control communication systems used to operate the machinery, which could easily be exploited by hackers. Researchers at the University of Washington have demonstrated how a hacker could take over the controls and interfere in a surgical procedure, making it impossible to perform.
The problem is that telesurgery procedures take place using public networks instead of secured private networks. Public networks can be hacked into with relative ease using various forms of cyber-attack.
The team of scientists used a device that was developed at the University of Washington – the Raven II teleoperated robotical surgeon – to test the security of the systems used to control it.
They demonstrated that “Due to the open and uncontrollable nature of communication networks, it becomes easy for malicious entities to jam, disrupt, or take over the communication between a robot and a surgeon.”
Telesurgery was introduced in 2001, and the first operation performed using the technology involved a surgeon in New York remotely removing the gall bladder of a patient in France.
That initial procedure was performed using a dedicated fiber furnished by a telecommunications company. However, dedicated fibers are prohibitively expensive; in recent years, surgeons have begun to consider using ordinary communication protocols over the internet to perform remote surgery. This is a much cheaper option, but it carries with it the dangers of being vulnerable to hacking.
When the team of experts decided to find out if they could successfully hack into the Raven II system, they set up an experimental operation in which the operator would attempt to move rubber blocks on a peg board from one side to the other.
They then measured how long it took different operators to complete the task while under attack and also how difficult the operators rated the task.
The team used three methods of attack. The first involved altering the commands sent from the operator to the device by “deleting, delaying or re-ordering them,” according to a report on the experiment posted in the MIT Technology Review.
The second type of attack used against the system modified “the intention of signals from the operator to the robot by changing, say, the distance an arm should move or the degree it should rotate and so on.”
The third method incorporated an attack using the protocol designed to control the Raven II robot and others like it. This protocol is available to the public. The attack was intended to take control of the entire system.
The MIT report said:
The robot itself runs on a single PC running software based on open standards, such as Linux and the Robot Operating System. It communicates with the control console using a standard communications protocol for remote surgery known as the Interoperable Telesurgery Protocol.
This communication takes place over public networks that are potentially accessible to anyone. And because the robot is designed to work in extreme conditions, this communications link can be a low-quality connection to the internet, perhaps even over wireless.
The attacks were successful in hindering and preventing the operators from completing the assigned task. The research found that the video connection of a remote operation could also be easily accessed.
Encryption could cheaply solve many of the security issues, but it is not an entirely foolproof solution.
Telesurgery is a very promising medical technology, but better cybersecurity measures need to be developed before it can truly be considered safe to use on humans.
Sources:
http://www.technologyreview.com
Tagged Under:
RECENT NEWS & ARTICLES
