It's a wonderful thing that a doctor can wirelessly reprogram a pacemaker for a patient to deliver better care. It seems quite odd to me, however, that no one thought to protect the connection with authentication and encryption. That being said, vulnerability is not new.

This paper not only discusses the potential vulnerability of Implantable Cardiac Defibrillators (ICDs), but also presents some very interesting ideas around authentication.

Basically, the problem is as follows: any authentication mechanism requires power consumption, and these devices are resource constrained (i.e. battery operated), so adding a repeatable activity that could be engaged to consume power amounts to a denial of service attack. Now, we can solve this problem in the InfoSec world with account lockout policies. You can't, however, have a situation where a doctor is locked out the pacemaker, I imagine. Instead, you need to prevent the DoS by developing a "zero power authentication" mechanism. They also talk about harvesting entrophy from patient movement and vibration, as well as some considerations of patient notification of security events. It's not a long paper, and is a pretty interesting read.

The concept of implantable medical devices isn't new, but the extension of interaction with these devices to outside the patient is just beginning. I can imagine the development of a Medical Device Industry Data Security Standard that dictates the requirements for in-patient connectivity. The stakes here are as high as they get.