Vulnerability

Medtronic names FA Controller and Patient Telemetry Module in BIAS Bluetooth impersonation bulletin

MedDevice Cyber Staff · Jun 11 · 2 min read · Via Medtronic security disclosure

Medtronic published a bulletin on June 11, 2020 naming the FA Controller (model 3537) and Patient Telemetry Module (model 97745) as affected by the BIAS Bluetooth vulnerability.

BIAS could allow an attacker to impersonate a device and spoof Bluetooth communication, potentially making unauthorized changes to stimulation settings or reading stored therapy or patient information. Medtronic said no cyberattack or patient harm had been observed.

Impersonation attacks defeat a pairing that both ends already trust, so the remaining control is radio range and keeping the accessory in the patient's hands.

Are you a representative of Medtronic? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Follow Medtronic's June 11, 2020 BIAS bulletin for the FA Controller 3537 and Patient Telemetry Module 97745. Advise patients to keep these accessories with them and to pair only in private settings.

Advise patients. Tell patients to keep the FA Controller and Patient Telemetry Module in their possession.
Apply any update. Install firmware or app updates Medtronic issues for these models.
Check settings at follow-up. Verify stimulation settings match the prescribed program at each visit.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Therapy delivery Handles patient data Home use

FA Controller

Wireless connectivity Therapy delivery

Patient Telemetry Module

Wireless connectivity

Fix the class in your product

The device honors control commands from any peer in radio range. As the maker, gate every state-changing characteristic behind an authenticated, bonded link on the device itself, and strip undocumented command paths from the release image.

Authenticate on the device, not the app. Reject writes to state-changing characteristics unless the link is encrypted, bonded, and authenticated.
Bond with a modern pairing method. Require LE Secure Connections and add a physical confirmation on a safety-critical device.
Fail to a safe state. On an unexpected or unauthenticated command, hold or revert rather than acting.

Mapped EMB3D mitigations

Questions & Answers

Which Medtronic devices are affected by the BIAS Bluetooth vulnerability?

Medtronic's June 11, 2020 bulletin names the FA Controller (model 3537) and the Patient Telemetry Module (model 97745) as affected by BIAS.

What can an attacker do with BIAS on Medtronic stimulation devices?

Per Medtronic's June 11, 2020 bulletin, BIAS could let an attacker impersonate a device, spoof Bluetooth communication, make unauthorized changes to stimulation settings or read stored therapy or patient information.

← Back to Vulnerabilities