Over the last few years, healthcare administrations have been digitizing their provision of care that led to an increased number of networked medical devices and medical telemetry. Due to such digitization, medical devices have made phenomenal strides in the course of the last half-century. These networked medical devices have enhanced the quality and accessibility of health treatments by achieving pervasive healthcare vision. Moreover, these devices have transformed the canvas of medical treatments and improved the lives of the masses. Such innovation, as a result, assisted in paving the way for reliable healthcare facilities through the introduction of new areas of therapeutic and diagnostic treatments. Medical devices, nowadays, are portable, networked, and capable enough to facilitate human lives. The refined quality and variety of these devices put forward a promising future. However, on the other hand, the healthcare sector is experiencing the greatest amount of security breaches due to the presence of security flaws in medical devices. As these devices are no longer standalone systems and are network-connected, the attack surface has increased profoundly. Actually, devices in practice were designed, developed, and disseminated long ago. Therefore, they were not developed from the ground up with security as a vital design constraint. The flaws present in these devices have acquired the consideration of researchers from both industry and academia. In this paper, we studied security vulnerabilities present in state-of-the-art medical devices by studying security tests and the attacks demonstrated by the researchers on more than a hundred devices. Finally, some state-of-the-art solutions and countermeasures along with applicable regulations in literature were also studied and analyzed. Since these devices are life-critical and can even cause the death of a patient, therefore, this survey is significant as it can assist researchers to get an overview of loopholes present in medical devices and existing countermeasures. We concluded this survey paper with some open research areas that should be properly considered in order to secure these life-critical medical devices.

Security Vulnerabilities, Attacks, Countermeasures, and Regulations of Networked Medical Devices—A Review

Attacks targeting software on embedded systems are becoming increasingly prevalent. Remote attestation is a mechanism that allows establishing trust in embedded devices. However, existing attestation schemes are either static and cannot detect control-flow attacks, or require instrumentation of software incurring high performance overheads. To overcome these limitations, we present LO-FAT, the first practical hardware-based approach to control-flow attestation. By leveraging existing processor hardware features and commonly-used IP blocks, our approach enables efficient control-flow attestation without requiring software instrumentation. We show that our proof-of-concept implementation based on a RISC-V SoC incurs no processor stalls and requires reasonable area overhead.

LO-FAT: Low-Overhead Control Flow ATtestation in Hardware

With the recent proliferation of Internet of Things (IoT) and embedded devices, there is a growing need to develop a security framework to protect such devices. RISC-V is a promising open source architecture that targets low-power embedded devices and SoCs. However, there is a dearth of practical and low-overhead security solutions in the RISC-V architecture. Programs compiled using RISC-V toolchains are still vulnerable to code injection and code reuse attacks such as buffer overflow and return-oriented programming (ROP). In this paper, we propose FIXER, a hardware implemented security extension to RISC-V that provides a defense mechanism against such attacks. FIXER enforces fine-grained control-flow integrity (CFI) of running programs on backward edges (returns) and forward edges (calls) without requiring any architectural modifications to the RISC-V processor core. We implement FIXER on RocketChip, a RISC-V SoC platform, by leveraging the integrated Rocket Custom Coprocessor (RoCC) to detect and prevent attacks. Compared to existing software based solutions, FIXER reduces energy overhead by 60% at minimal execution time (1.5%) and area (2.9%) overheads.

FIXER: Flow Integrity Extensions for Embedded RISC-V

RISC-V is a promising open-source architecture that targets low-power embedded devices and system-on-chips (SoCs). However, there is a dearth of practical and low-overhead security solutions in the RISC-V architecture. Programs compiled using RISC-V toolchains are still vulnerable to code injection and code reuse attacks, such as buffer overflow and return-oriented programming (ROP). In this article, we propose two hardware-implemented security extensions to RISC-V that provides a defense mechanism against such attacks. We first employ a physically unclonable function (PUF)-based randomized canary generation technique that removes the need to store the sensitive canary words in memory or CPU registers, thereby being more secure, while incurring low overheads. We implement the proposed Canary Engine in RISC-V RocketChip with rocket custom coprocessor (RoCC). The simulation results show 2.2% average execution overhead with a single buffer protection, while a $10\times $ increase in buffer count only increases the overhead by $1.5\times $ when protection is extended to all buffers. We further improve upon this with a dedicated security coprocessor flow integrity extensions for embedded RISC-V (FIXER), implemented on the RoCC. FIXER enforces fine-grained control-flow integrity (CFI) of running programs on backward edges (returns) and forward edges (calls) without requiring any architectural modifications to the processor core. Compared to software-based solutions, FIXER reduces energy overhead by 60% at minimal execution time (1.5%) and area (2.9%) overheads.

https://par.nsf.gov/servlets/purl/10163937

Hardware Assisted Buffer Protection Mechanisms for Embedded RISC-V

The vulnerability of electronic systems to attacks from hostile agents over the Internet is a matter of growing concern as the digital world becomes increasingly interconnected. Many countermeasures have been put in place to address these concerns, but the computational burden they impose may be excessive for low-power devices. In particular, the devices which comprise The Internet of Things are particularly vulnerable. This paper provides numerical assessments of their vulnerability to a class of attacks based on triggering buffer overflows. We focus on two such attacks, namely return-to-lib-c and code injection, for IoT devices using the FreeRTOS (V9.0.0) operating system. We show the deficiencies of the prevention measures provided in FreeRTOS to prevent these kinds of attacks, and compare them to the more robust mechanisms available in a mainstream OS (Ubuntu 16.04.1). The paper concludes with suggestions of how to mitigate these vulnerabilities in FreeRTOS - further investigation will be required to determine whether similar vulnerabilities exist in other IoT operating systems.

Assessment of Buffer Overflow Based Attacks On an IoT Operating System

With the emergence of Internet of Things, embedded devices are increasingly the target of software attacks. The aim of these attacks is to maliciously modify the behavior of the software being executed by the device. The work presented in this letter has been developed for the Cyber Security Awareness Week Embedded Security Challenge. This contest focuses on memory corruption issues, such as stack overflow vulnerabilities. These low level vulnerabilities are the result of code errors. Once exploited, they allow an attacker to write arbitrary data in memory without limitations. We detail in this letter a hardware-based countermeasure against return address corruption in the processor stack. First, several exploitation techniques targeting stack return addresses are discussed, whereas a lightweight hardware countermeasure is proposed and validated on the OpenRISC core. The countermeasure presented follows the shadow stack concept with a minimal hardware modification of the targeted core and an easy integration at the application level.

Stack Redundancy to Thwart Return Oriented Programming in Embedded Systems

Software attacks are commonly performed against embedded systems in order to access private data or to run restricted services. In this work, we demonstrate some vulnerabilities of commonly use processor which can be leveraged by hackers to attack a system. The targeted devices are based on open processor architectures OpenRISC and RISC-V. Several software exploits are discussed and demonstrated while a hardware countermeasure is proposed and validated on OpenRISC against Return Oriented Programming attack.

A red team blue team approach towards a secure processor design with hardware shadow stack

Connected medical devices are promising in medical area. However, these devices are known to be poor in security and strongly vulnerable to code injection attacks. These attacks aim at modifying the run-time behavior of an application by violating its control flow graph. Control flow hijacking can lead hackers to remotely control medical application and endanger patient's life. This article focuses on devices and provides an overview of the different countermeasures that mitigate run-time attacks. Finally, from this state of the art, we will expose the perspectives and the ongoing work to make medical devices inherently more secure.

Towards an Inherently Secure Run-Time Environment for Medical Devices

This letter presents SecPump, a new open-source wireless infusion pump platform dedicated to security researchers. The novelty of the platform is that it is “plug and play.” Indeed, SecPump simulates a functional infusion pump system on a single board without requiring additional hardware or mechanical components. The presented cyber-physical platform intends to provide a framework for security evaluation, tailored for countermeasure development against security flaws related to medical devices. This letter presents the functionality of the cyber-physical device, its wireless features, and its portability across several hardware architectures. Finally, both hardware and software attacks are showcased on the platform.

SecPump: A Connected Open-Source Infusion Pump for Security Research Purposes

This paper presents BackFlow, a compiler-based toolchain that enforces indirect backward edge control flow integrity for low-end ARM Cortex-M microprocessors BackFlow is implemented within the Clang/LLVM compiler and supports the ARM instruction set and its subset Thumb The control flow integrity generated by the compiler relies on a bitmap, where each set bit indicates a valid pointer destination The efficiency of the framework is benchmarked using an STM32 NUCLEO F446RE microcontroller The obtained results show that the control flow integrity solution incurs an execution time overhead ranging from 15 to 45%

Cyril Bresch

Papers

Stack Redundancy to Thwart Return Oriented Programming in Embedded Systems

A red team blue team approach towards a secure processor design with hardware shadow stack

Towards an Inherently Secure Run-Time Environment for Medical Devices

SecPump: A Connected Open-Source Infusion Pump for Security Research Purposes

BackFlow: backward edge control flow enforcement for low end ARM microcontrollers