While the most radical threats are several decades away, the essential technology already exists in the form of deep brain stimulation devices. Scientists are learning how memories are created in the brain and can be targeted, restored and enhanced using such implantable devices. However, vulnerabilities exist in the connected software and hardware and these need to be addressed if we are to be ready for the threats that lie ahead, according to a new report by researchers from Kaspersky Lab and the University of Oxford Functional Neurosurgery Group.
The researchers combined practical and theoretical analysis to explore the current vulnerabilities in implanted devices used for deep brain stimulation. Known as implantable pulse generators (IPGs) or neurostimulators, these devices send electrical impulses to specific targets in the brain for the treatment of disorders such as Parkinson’s disease, essential tremor, major depression, and obsessive–compulsive disorder. The latest generation of these implants comes with management software for both clinicians and patients, installed on commercial-grade tablets and smartphones. The connection between them is based on the standard Bluetooth protocol.
The researchers found a number of existing and potential risk scenarios, each of which could be exploited by attackers. These include:
- Exposed connected infrastructure – the researchers found one serious vulnerability and several worrying misconfigurations in an online management platform popular with surgical teams that could lead an attacker to sensitive data and treatment procedures.
- Insecure or unencrypted data transfer between the implant, the programming software, and any associated networks could enable malicious tampering of a patient’s or even of whole groups of implants (and patients) connected to the same infrastructure. Manipulation could result in changed settings causing pain, paralysis or the theft of private and confidential personal data.
- Design constraints as patient safety takes precedence over security. For example a medical implant needs to be controlled by physicians in emergency situations, including when a patient is rushed into a hospital far from their home. This precludes use of any password that isn’t widely known among clinicians. Further, it means that by default such implants need to be fitted with a software ‘backdoor’.
- Insecure behaviour by medical staff – programmers with patient-critical software were found being left with default passwords, used to browse the internet or with additional apps downloaded onto them.
Addressing these vulnerable areas is key, because the researchers estimate that over the coming decades, more advanced neurostimulators and a deeper understanding of how the human brain forms and stores memories, will accelerate the development and use of such technology and create in new opportunities for cyberattackers.
Within five years, scientists expect to be able to electronically record the brain signals that build memories and then enhance or even rewrite them before putting them back into the brain. A decade from now, the first commercial memory boosting implants could appear on the market – and, within 20 years or so, the technology could be advanced enough to allow for extensive control over memories. New threats resulting from this could include the mass manipulation of groups through implanted or erased memories of political events or conflicts; while ‘repurposed’ cyberthreats could target new opportunities for cyberespionage or the theft, deletion or ‘locking’ of memories (for example, in return for a ransom).
Commenting on the results of the investigation, Dmitry Galov, junior security researcher, Global Research and Analysis Team, Kaspersky Lab said, “Current vulnerabilities matter because the technology that exists today is the foundation for what will exist in the future. Although no attacks targeting neurostimulators have been observed in the wild, points of weakness exist that will not be hard to exploit. We need to bring together healthcare professionals, the cybersecurity industry and manufacturers to investigate and mitigate all potential vulnerabilities, both the ones we see today and the ones that will emerge in the coming years.”
Laurie Pycroft, doctoral researcher in the University of Oxford Functional Neurosurgery Group added: “Memory implants are a real and exciting prospect, offering significant healthcare benefits. The prospect of being able to alter and enhance our memories with electrodes may sound like fiction, but it is based on solid science the foundations of which already exist today. Memory prostheses are only a question of time. Collaborating to understand and address emerging risks and vulnerabilities and doing so while this technology is still relatively new, will pay off in the future.”
Cisco gives pre-owned tech a Refresh
In a market of constant upgrades, Cisco Refresh aims to keep quality product away from landfills, writes BRYAN TURNER.
When one gets a new smartphone upgrade, the old device may be used as a backup or can be used by someone else. In business environments, equipment upgrades may not be conducive to keeping old equipment around, which may send older, working equipment to landfills.
This is where Cisco’s Refresh initiative comes in. At Cisco Connect in Sun City this week, Ehrika Gladden, VP and general manager of Cisco Refresh, lifted the lid on a little-known aspect of the company’s strategy.
“Refresh is Cisco’s global pre-owned equipment business unit,” said Gladden. “It is certified to meet the quality and engineering standards of Cisco. It is licensed for software and it’s also inclusive of a services warranty.
“Our responsibility in 80 countries around the world is tied to both the recovery of assets and the ability to leverage those assets at a lower price point. This ensures our sustainability and proper usage of the Earth’s resources while providing access to small and medium businesses. The products are typically in the range of 20-40% cheaper. The products represent the entire portfolio for Cisco in some part, the majority of that product set is 2+ years in terms of generation.”
Cisco’s Circular Economy initiative ensures a sustainable loop through businesses willing to pay a premium for the latest, cutting-edge solutions, while Cisco markets older, working equipment for resale to those who don’t require the latest solutions. This ensures far less new components need to be used in a product range.
“We are leveraging the model of remanufacturing, refurbishing, recycling, and reusing,” said Gladden. “Depending on the product set, there is a certain set of product yield that we expect. They vary from product to product, but we do have a percentage that doesn’t make it through.
“Those are always reused, meaning we will look at those products and decide to use them completely differently, leveraging the components, remanufacturing back into the overall build process. If that can’t be done, we will go into a recycle process where we melt those products down to reuse them.”
Repairing and refurbishing older products isn’t just that. Cisco is creating repair centres that are owned by third-parties to uplift local ownership.
“The repair centres, as a global manufacturer, is Cisco’s entree into local ownership,” said Gladden. “I want to be precise about what I mean by local ownership. It’s critical for us to have a localised presence, but doing that through ownership. When you look at inclusive economies, those that are participative, to be sustainable – not in the product set, but generationally.
“The ability as a global manufacturer through a local ownership model isto create a repair centre where a product can be returned, screened, tested, and repaired, leveraging the talent that the Networking Academy is creating.”
Cisco is working closely with local governments to understand where it operates and how to leverage the skills in the market.
Gladden said: “We are also super excited about the National Development Plan and African Union statements which with we align: eradication of poverty, job creation, ownership, healthcare, education, it all fits in the model. So we were very excited to have the opportunity to come to Africa first to announce this. Over the next twelve months, we want to establish our first repair centres, and in the next 3 to 5 years, build that vision into a reality.”
Why Data Privacy has become a Pipe Dream
If you’re active on WhatsApp, Facebook or any other social platform, you’re not as safe as you thought, writes
AARON THORNTON, MD of Dial a Nerd
As you begin to read this, let’s perform a quick experiment! How many active conversations are you engaged in – right now – on WhatsApp? When was the last time you shared a picture or video on Instagram? Is Facebook currently open and active on one of your devices? And how many internet- connected devices are you using at this moment? Chances are, you have multiple devices running multiple applications most of the time. So what’s the problem, you ask? Since when did checking in with a high school buddy in Australia via Facebook become a dangerous act?
In reply, we say, read on if you can stomach it!
Nation-State Hacking & You
It might seem like a laughably long shot to say that you are a key player in the increasingly sinister and sophisticated world of nation-state hacking. Well, you are. Given that individuals, businesses and governments are now constantly connected, round the clock, consumers and businesses have become fair game in cyber espionage. And as we create and share more and more data, both the value and accessibility of that data increases. According to a report by McAfee, IP theft now accounts for more than 25% of the estimated $600 billion cost of cybercrime to the world economy.
With data having become the ‘new gold’, nation states are naturally pouring investment and key resources into building advanced cyber warfare tools. Indeed, entire divisions of armed forces as well as the upper echelons of corporate leadership are devising ways to harness data to gain economic, political and social power. At the highest level, tools and platforms are being developed with the specific aim of perpetrating cyber espionage and data theft. No surprise then, that the consumer and business environments are rife with increasingly advanced malware, ransomware and many other malicious hacking tools and methods.
Still not convinced? Yes, we can smell the scepticism from here! So let’s take a moment to see how this has already played out, beneath our noses.
Remember the Facebook–Cambridge Analytica data scandal of early 2018? For many, this was a watershed moment in the emerging war for consumer data – and the ensuing tensions between privacy, power and profit. Need a refresh? Well, in 2018, Facebook exposed data on up to 87 million Facebook users to a researcher who worked at Cambridge Analytica, which worked for the Trump campaign. In essence, the data was harvested without user consent and used for political purposes.
Another chilling but less direct example can be found in Russia’s meddling in the 2016 U.S. elections. According to Politico, Russia launched a massive social media campaign to ‘sow discord’ leading up to the elections. The website reported that as early as 2014, an infamous Russian “troll farm” known as the Internet Research Agency – a company linked to Russian president Putin – developed a strategy using fraudulent bank accounts and other fake identity documents to “spread distrust towards the candidates and the political system in general.”
When referring to the Russian hacks and their impact on election results, one U.S. Representative sagely noted: “They didn’t just steal data; they weaponized it.”
Ignorance is not bliss
Okay, so data is being ‘weaponized’, and ordinary people and businesses are being caught in the crosshairs of cyber warfare. A little bit frightening, but the good news is that savvy individuals like you can take steps to protect personal data and actively combat the creeping influence of juggernauts such as Facebook and Google.
Now that we’ve left you sufficiently spooked, you can get back to those demanding WhatsApp/Facebook/Instagram notifications (same company, by the way)…albeit, we hope, with a slightly altered [cyber] worldview!