Technology allows us to enjoy impressive advances in the world of medicine. Effective drugs, more precise surgeries and bionic replacements are the order of the day, but a very little explored side is the cybersecurity associated with that medical advance. A group of experts at the University of Washington decided to investigate with a remote surgery robot, and discovered that it is very easy to hack, either by interrupting its operation, or worse, taking control.
The first remote surgery was performed on September 7, 2001. A French surgeon stationed in New York 'operated' (the technical procedure was a cholecystectomy) on a 68-year-old woman in Strasbourg, 6,200 kilometers away. The use of dedicated and redundant optical fibers greatly optimized communication, and from there, the concept of remote surgery became a very important resource in modern medicine. The need to lower costs led to cheaper links, that is, the Internet. Fourteen years later, there has not been a single incident in remote surgery related to infrastructure problems... but that does not mean it is a safe process.
Recently, Tamara Bonaci and her colleagues at the University of Washington (Seattle) decided to put to the test the robustness of robotic platforms for remote surgery, using as a 'participant' a robot developed at the same university, called Raven II. They applied the standard ITP communications protocol for telesurgery over an open network, and from there, they decided to evaluate how easy it was to interrupt the operation of Raven II. The attacks were divided into three types: deletion and delay of orders, changes in the signals that control its movements, and the 'complete hijacking' of the robot. The ITP protocol is publicly available, so taking control of the robot was not that complicated, but the most interesting thing is that by causing erratic movements, Raven II constantly activated its emergency stop mechanism. In other words, Raven II was trapped in a 'robotic DDoS'.
Bonaci and the rest of the team then explored different methods to protect the robot from attacks, and at the end of the day, encryption of communication remains the best option. Raven II had no problem with encrypted links, and those responsible highlight that the added cost is too low not to take advantage of its benefits. Although there are doubts about encrypting the video signal (to save bandwidth), there are solutions such as WebRTC that, in addition to being efficient, also have initial support to verify identities, thus avoiding any 'man-in-the-middle'.
