Thread by @doctorow

Medtech giant Medtronic is quite a piece of work. The company started as a Minneapolis repair shop before growing to be one of the world's largest, most profitable - and lowest-taxed, thanks to financial engineering - corporations.

1/

Despite the company's origins in conducting unauthorized repairs on behalf of hospitals and other device owners, Medtronic (along with Apple) has led the fight to kill dozens of state #RightToRepair bills:

pluralistic.net/2020/07/10/fli…

2/

Medtronic's dirty tricks campaigns against R2R are especially salient now, because the company has sabotaged its ventilators so they can't be repaired by hospital engineers without obtaining an unlock code from the company:

pluralistic.net/2020/07/10/fli…

3/

But Medtronic's device defects aren't limited to ventilators. At least as alarming is the company's history of making personal medtech devices (including pacemakers) that are insecure in every conceivable way.

4/

Medtronic devices have been shown to be LETHALLY compromisable by sending them unencrypted wireless signals or just by poisoning their unsecured supply chain, which allows you to inject malicious firmware into devices en masse.

5/

If there was ever a manufacturer whose customers needed to be able to turn to third parties to shore up its products (literally) fatal deficiencies, it's Medtronic.

6/

Which brings me to the present moment. It's been two years since QED Security Solutions' @XSSniper and Jonathan Butts presented their work on Medtronic's Minimed insulin pump, showing that it could be remotely controlled by cheap wireless devices.

7/

Among the attacks they enabled: dumping the device's full supply of insulin, potentially killing the person wearing it.

8/

The defects they identified were intrinsic to the device and the only defense was disabling the wireless, which rendered the device useless for family members who helped loved ones manage their insulin (especially young kids or people with dementia, etc).

9/

Still, Medtronic dragged its feet on a recall, saying (incredibly) that it had known about these defects for years before Rios and Butts told them about it, but had decided not to fix them and didn't see why that should change now.

10/

Finally, though, the company has launched a "voluntary recall" - after Rios and Butts built an Android app that exploited the defect they identified and created a "universal remote for every one of these insulin pumps in the world" and presented it at Black Hat.

11/

This is an app that would let the user murder Medtronic users from a distance of several feet. Obviously, they haven't released it, but the publicity did its job.

wired.com/story/medtroni…

Finally.

eof/