Cardiac Implantable Medical Devices forensics: Postmortem analysis of lethal attacks scenarios

Interpol review of digital evidence 2016 - 2019

“…Ellouze et al. [ 86 ] propose a digital investigation system for the postmortem analysis of lethal attack scenarios on the devices. The postmortem analysis would seek to establish: 1) what functions of the implanted device were impacted, ie either did not execute or executed incorrectly; 2) the role of the malfunctioning of the device in the health event; 3) the malfunctioning was due malicious intent or improper deployment; 4) the attack scenario; and, 5) the vulnerabilities that were exploited.…”

“…Further, they construct a library of medical rules that infer potential medical scenarios that might have led to the death of the patient, or that created cardiac emergency situations. The examination is a three step process: The cause of death is identified based on the observations collected and stored in memory by the device and the log of actions performed by the device; Based on the access and system logs, reconstruct potential attack scenarios that would generate the similar content of the collected evidence; and, Correlate the technical and medical evidence to arrive at a conclusion supported by the evidence [ 86 ]. …”

“…Correlate the technical and medical evidence to arrive at a conclusion supported by the evidence [ 86 ].…”

A Bleeding Digital Heart: Identifying Residual Data Generation from Smartphone Applications Interacting with Medical Devices

“…Ellouze et al [24] focused on the type of evidence that is needed in medical device investigations, including data collected from sensor nodes, mobile devices, wireless medical devices, databases, and thirdparty applications. In later work, Ellouze et al [25] proposed a theoretical investigation framework to help guide a post-mortem analysis of implantable medical devices. Part of this solution involves developing a set of techniques to assist with the secure storage of evidence logs on mobile devices, which can be used to track sensitive medical events.…”

Attack Graph Modeling for Implantable Pacemaker

“…A digital inspection system is proposed by [17] for the examination of fatal attack scenarios on cardiac implantable medical devices (IMDs). The system reports the identification and regeneration of possible attack scenarios that result in a patient's death.…”