Hacking medical devices

S povezljivostjo medicinskih pripomočkov, uporabo različnih brezžičnih tehnologij in interneta v zdravstvu ter medicinskih pripomočkih se je pojavilo tveganje za kibernetske in informacijsko varnostne grožnje. Ena izmed omenjenih groženj je tudi vdor oz. pojav v tujini, znan tudi pod izrazom »medjacking«. Izhaja iz dveh besed, medicine in hijacking/hacking in bi ga lahko prevedli kot ugrabitev medicinskega pripomočka. Bolj strokovno pa pomeni škodoželjen in nepooblaščen vdor oz. dostop do medicinskega pripomočka. Tako vdor kot tudi druge varnostne grožnje bi lahko vplivali na odpoved ali nepravilno delovanje medicinskega pripomočka ter posredno ali neposredno tudi na uporabnika. Za razliko od drugih naprav bi v tem primeru lahko bilo resno ogroženo zdravje in življenje uporabnika. Kot težava pri zagotavljanju varnih medicinskih pripomočkov se pogosto pojavlja razlikovanje med safety in security vidikom varnosti. V diplomskem delu se usmerjamo na slednji vidik. Obravnavamo različne vrste vdorov in posledice. Preko dveh primerov smo podrobneje nakazali, katere ranljivosti so lahko izkoriščene za vdor v pripomoček. V empiričnem delu smo izvedli tudi dva intervjuja za pridobitev dodatnih informacij glede zagotavljanja varnih medicinskih pripomočkov, preprečevanja vdorov in ukrepanja ob zaznanem vdoruWith connectivity of medical devices, use of various wireless technologies and internet in healthcare and medical devices, the risk of cyber and information security threats has occurred as well. One of the mentioned threats is also hacking, known abroad as “medjacking”. The term is formed from two words, medicine and hijacking/hacking, which could be explained as a medical device hijack. Formally, it can be explained as malicious and unauthorized hack or access into a medical device. Both hacking as well as other security threats might cause failure or malfunction of a medical device and, directly or indirectly, affect its user. Unlike in other devices, malfunction in such a case could seriously compromise health and safety of its user. Issue in providing safe medical devices is often the distinction between safety and security aspect. In this thesis, we focused on the latter aspect. We discussed different types of hacks and consequences. We explained in detail which vulnerabilities can be exploited for hacking into a device through two examples. In the empirical part, we also conducted two interviews to obtain additional information regarding the assurance of safe medical devices, prevention of hacking and reaction to detected hacks