WaPo: Hacking a Heart Monitor Too Easy, Says Study

It didn't take much to hack into the heart monitoring device and get it to administer a 137-volt shock: an oscilloscope, a PC, a wireless radio with a couple of antennas and some free software.

With those tools, a group of university researchers were able to gain access to what is known as an implantable cardioverter defibrillator (ICD), reading sensitive patient information, disrupting its operation and even programming it to repeatedly administer strong electric shocks.

These tiny life-saving ICD devices are surgically implanted in the chests of heart patients, wired to the heart so they can shock it out of ventrical fibrillation. This is a heart-attack condition in which the heart muscle twitches randomly instead of pumping blood in a coordinated fashion.

They've been used in the U.S. since 2003, but until now have never been subject to a rigorous public security review, according to Tadayoshi Kohno, an assistant professor with the University of Washington, who co-authored a paper looking into the security of ICDs and pacemakers.