News for hackers. Stuff that matters.

A comment on CVE-2015-3459 – Hospira Lifecare PCA Infusion Pump. Parent comment

Re:CVE-2015-3459 – Hospira Lifecare PCA Infusion Pump by fabulist on Monday May 04, 2015 @06:22PM (#9489635)
They also need to be "able to kill you" so that the patient can be defibrilated if their heart stops beating. If you do that when their heart is functioning it tends to have the opposite effect.
[ Parent | on HN ]
Re:CVE-2015-3459 – Hospira Lifecare PCA Infusion Pump by TheLoneWolfling on Monday May 04, 2015 @06:27PM (#9489666)
Right. But that functionality can be airgapped from the readout parts.
[ Parent | on HN ]
Re:CVE-2015-3459 – Hospira Lifecare PCA Infusion Pump by fabulist on Monday May 04, 2015 @08:07PM (#9490093)
Some sandboxing could be done, but if an attacker roots a pacemaker or an insulin pump it will be extremely difficult if not impossible to prevent them from convincing the device to perform its intended function at an unintended time.
[ Parent | on HN ]
Re:CVE-2015-3459 – Hospira Lifecare PCA Infusion Pump by TheLoneWolfling on Monday May 04, 2015 @08:46PM (#9490258)
Airgapped. Not just sandboxed. As in two separate processors, with no overlapping RAM / etc.

You can't do your example, because there's no way to get at the internal clock from the radio.

[ Parent | on HN ]