Skip to main content

Abbott Laboratories Pacemaker Vulnerabilities

A vulnerability has been found in Abbott Laboratories’ (formerly St. Jude Medical) pacemakers. Successful exploitation of these vulnerabilities may allow a nearby attacker to gain unauthorized access to a pacemaker and issue commands, change settings, or otherwise interfere with the intended function of the pacemaker.
Threat ID:
CC-1616
Category:
Threat Severity:
Medium
Threat Vector:
Exploit
Published:
31 August 2017 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

A vulnerability has been found in Abbott Laboratories’ (formerly St. Jude Medical) pacemakers. Successful exploitation of these vulnerabilities may allow a nearby attacker to gain unauthorized access to a pacemaker and issue commands, change settings, or otherwise interfere with the intended function of the pacemaker.

Affected platforms

The following platforms are known to be affected:

Accent / Anthem

The following pacemakers manufactured prior to 28th August 2017, are affected:
• Accent/Anthem,
• Accent MRI,
• Assurity/Allure, and
• Assurity MRI.

Accent MRI

Assurity / Allure

Assurity MRI

Threat details

Successful exploitation of these vulnerabilities may allow a nearby attacker to gain unauthorized access to a pacemaker and issue commands, change settings, or otherwise interfere with the intended function of the pacemaker.

Improper Authentication:
The pacemaker’s authentication algorithm, which involves an authentication key and time stamp, can be compromised or bypassed, which may allow a nearby attacker to issue unauthorised commands to the pacemaker via RF communications.

Improper Restriction of Power Consumption:
The pacemakers do not restrict or limit the number of correctly formatted “RF wake-up” commands that can be received, which may allow a nearby attacker to repeatedly send commands to reduce pacemaker battery life.

Missing Encryption of Sensitive Data:
The Accent and Anthem pacemakers transmit unencrypted patient information via RF communications to programmers and home monitoring units. Additionally, the Accent and Anthem pacemakers store the optional patient information without encryption; however, the Assurity and Allure pacemakers encrypt stored patient information.

The following CVEs have been assigned:
• CVE-2017-12712 – Improper Authentication
• CVE-2017-12714 - Improper Restriction of Power Consumption
• CVE-2017-12716 - Missing Encryption of Sensitive Data

Exploitability:
These vulnerabilities could be exploited via an adjacent network. Exploitability is dependent on an attacker being sufficiently close to the target pacemaker as to allow RF communications.

Remediation advice

Mitigation:

Remediation steps

Type Step

Abbott has developed a firmware update to help mitigate the identified vulnerabilities.

The pacemaker firmware update will implement “RF wake-up” protections and limit the commands that can be issued to pacemakers via RF communications. Additionally, the updated pacemaker firmware will prevent unencrypted transmission of patient information (Accent and Anthem only). The firmware update can be applied to an implanted pacemaker via the Merlin PCS Programmer by a healthcare provider.

Abbott states that firmware updates should be approached with caution. Like any software update, firmware updates can cause devices to malfunction. Potential risks include loss of device settings, the device going into back-up mode, reloading of the previous firmware due to a failed upgrade, loss of diagnostic data, and a complete loss of device functionality. The Abbott Cybersecurity Medical Advisory Board has reviewed this firmware update and the associated risk of performing the update in the context of potential cybersecurity risk.

Last edited: 17 February 2020 11:25 am