IoT and Biometry: From Identity Theft to Heart Attack
TechnologyBit News Today2 min read
IoT's Risks
The granularity and sensitivity of data generated by IoT devices make them attractive targets for attackers. At the Black Hat conference, security researchers Billy Rios and Jonathan Butts plan to demonstrate a series of vulnerabilities in how pacemaker programmers connect to Medtronic's software delivery network. A cloud vulnerability enabled remote access to and modification of patients' pacemaker data, though Medtronic has since resolved it. The pacemaker programmers run on Windows XP.
Crucially, body fluids carry electrical signals very well, and it's now ever easier for attackers to access. What could start as identity theft could proceed to in-body fraud. Last year, 22% of identity theft complaints to the FTC concerned tax identity theft.
Even the heart may not be safe. Abbott issued a recall for new pacemaker firmware to further mitigate the risk of unauthorized access over radio frequency (RF) communications. An FDA report identified a hardcoded universal unlock code as an exploitable hazard for the firm's High Voltage devices.
And the regulatory scrutiny goes far beyond routine compliance. The FDA informed the manufacturer that the firm conducted a risk assessment and a corrective action outside of its CAPA system.
The Bio-hacker's Secret Weapon
There's a standard structure to modeling IoT systems. Security researchers discuss it through Rich Pictures and Use Cases that run through a scenario such as a patient potentially suffering from a myocardial infarction.
This hasn't happened in real life yet, but researchers have been demonstrating for at least a decade that it's possible.
Considering the rise of all the data available to biometrics feels like swimming against the tide as the field of biometric security grows.
Recent progress has delivered some victories, yet only a bit of the long battle is won. Identity theft was the second biggest category, making up nearly 14 percent of all the consumer complaints to the FTC. And biometric data may take an even chunkier share of the identity-theft pie.
Finally, the fundamental question remains: will consumers adopt biometric methods for transactions, identity verification, and data access, even if they require the most personalized of personal data?
