Full Report
U.S. Food and Drug Administration (FDA) has announced the recall of 465,000 cardiac pacemakers produced by Abbott for security update installation. The update patches cybersecurity vulnerabilities in the devices’ firmware.
Analysis Summary
# Vulnerability: Abbott Cardiac Pacemaker Firmware Vulnerabilities
## CVE Details
- **CVE ID:** CVE-2017-12731 (Authentication Bypass), CVE-2017-12733 (Improper Input Validation)
- **CVSS Score:** 8.0 (High)
- **CWE:** CWE-287 (Improper Authentication), CWE-20 (Improper Input Validation)
## Affected Systems
- **Products:** Abbott (formerly St. Jude Medical) Implantable Cardiac Pacemakers.
- **Versions:**
- Accent
- Anthem
- Accent MRI
- Accent ST
- Assurity
- Allure
- **Configurations:** Devices utilizing the RF (Radio Frequency) communication protocol for remote monitoring and programming.
## Vulnerability Description
The primary flaw involves the use of unauthenticated and unencrypted wireless communications via the RF protocol used by the pacemakers to talk to the Merlin@home transmitter and the Merlin Patient Care System (PCS) programmer.
1. **Authentication Bypass:** The communication protocol lacks a sufficiently robust "handshake" or authentication mechanism, allowing unauthorized devices to issue commands.
2. **Buffer Overflow/Input Validation:** The firmware fails to properly validate inputs, which could allow a nearby attacker to send specially crafted packets to the device.
## Exploitation
- **Status:** PoC available (Demonstrated by security researchers at MedSec/Muddy Waters); No known exploitation in the wild at the time of the FDA announcement.
- **Complexity:** Medium (Requires specialized hardware to intercept and transmit RF signals).
- **Attack Vector:** Adjacent (Within RF range of the patient, typically several meters).
## Impact
- **Confidentiality:** Low (Access to device serial numbers and limited patient data).
- **Integrity:** High (Unauthorized modification of pacing parameters or delivery of commands).
- **Availability:** High (Potential to issue a "battery drain" command or disable therapy).
## Remediation
### Patches
- **Firmware Update:** ABBOTT has released a firmware update that introduces mandatory "pairing" and encryption for RF communications.
- **Application:** The update must be installed in person by a healthcare provider using the Merlin PCS programmer; it cannot be applied remotely over the air.
### Workarounds
- **Disable RF:** In extreme cases, disabling the RF remote monitoring feature and relying on inductive (wand-based) programming reduces the remote attack surface.
- **Distance:** Maintaining physical distance from unknown RF-transmitting equipment.
## Detection
- **Indicators of Compromise:** Unexpected/rapid battery depletion; unexplained changes in device settings or pacing behavior.
- **Detection Methods and Tools:** Routine device checks via the Merlin PCS programmer will indicate if the firmware is outdated or if log entries show unauthorized access attempts.
## References
- **Vendor Advisory:** hxxps[://]www[.]abbott[.]com/corpnewsroom/product-and-innovation/abbott-updates-world-with-firmware-fix[.]html
- **FDA Safety Communication:** hxxps[://]www[.]fda[.]gov/medical-devices/safety-communications/firmware-update-address-cybersecurity-vulnerabilities-st-jude-medical-abbott-medical-cardiac
- **ICS-CERT Advisory:** hxxps[://]www[.]cisa[.]gov/news-events/ics-advisories/icsa-17-241-01