Pacemakers may save lives but they are also highly vulnerable to hacking, at least according to a report from a security firm published last week.

Security research firm WhiteScope LLC made the claim after studying “implantable cardiac devices,” physician programmers and home monitoring devices for four major manufacturers, finding that there were over 8,000 software vulnerabilities in the code of the pacemakers they studied. “Any pacemaker programmer can reprogram any pacemaker from the same manufacturer,” the company said in a blog post. “This shows one of the areas where patient care influenced cybersecurity posture.”

The pacemakers themselves are also open to external hacking because the major manufacturers have enabled radio frequency connections. That means that in theory, anyone within a connectable distance to someone who has a pacemaker could not only gain access to the pacemaker, but like something straight out of a Hollywood movie, could hijack the pacemaker to kill the person the device resides in.

If that isn’t bad enough, the report finds that pacemakers had literally no defense against hacking, right down to the point where no username or password was required to access them.

While this isn’t the first time pacemakers have been found to be vulnerable, the report comes after the WannaCry ransomware spread across the globe and notably also infected medical devices, in one case infecting a Bayer Medrad device in a U.S. hospital. Although it’s unlikely that ransomware will start targeting people with pacemakers anytime soon, given that hackers seemingly have no moral issues with attacking hospitals and medical devices, it’s not beyond the realm of possibility that at some point they may target pacemakers as well.

Not everyone is concerned. Matthew Green, an assistant professor of computer science at Johns Hopkins, told Engadget that doctors are adamant that security systems should not block patient care. “Requiring passwords would merely lead to a Post-it note on the device listing the password so every doctors’ staff member can access the data they need.”

On the one hand, the argument that pacemakers need to be easily accessible to medical professionals makes a lot of sense. But in an age in which hackers have no bounds, a pacemaker that can be easily hacked is also highly concerning.

Photo: jurvetson/Flickr