How can brain implants act as viable hotspots for hackers and cybercriminals?

Tech entrepreneur Elon Musk recently spoke about the possibility of a future where man has brain implants to various reasons ranging from augmenting his memory to listen to music. His Neuralink computer chip brain implant promises to demonstrate linking the body's muscles with a machine, with the goal of treating neurological injuries and trauma. Though this tech sounds intriguing, it also raises some concerns. Experts believe that bio-implants are more likely to be prone to malicious cyber-attacks and become a new sport for hackers. This is the reason why the former Vice president of USA Dick Cheney had disabled wireless telemetry on his implantable cardioverter-defibrillator during his time in office for fear of political assassination. In 2016 Johnson and Johnson had warned patients that the company had discovered a security vulnerability in its insulin pumps, which might allow cybercriminals to alter their dosages remotely. As the human brain is the CPU of human bodies and thoughts-action process, scientists fear that attack and corruption of brain implants, also called brainjacking, can shoot up in the coming years.

As we live in a hyper-connected world, where every connected end-device is hackable, brainjacking poses a severe threat to people even before brain implants have hit the commercial markets. In 2016, a group of researchers, neurosurgeons, and doctors of philosophy from Oxford Functional Neurosurgery and several Oxford University departments published a paper exploring the issue of brainjacking. Even in 2018, scientists in Belgium have found that neurostimulator, a wireless brain implant can be hacked using off-the-shelf materials. They discovered that by utilizing remote exploitation, hackers could make voltage changes that can result in sensory denial, disability, or even death. These research studies highlight how cybercriminals can weaponize a simple brain implant for malicious purposes.

Laurie Pycroft, a doctoral candidate at Oxford's Nuffield Department of Surgical Sciences, who headed the Oxford study, says that the most common type of brain implant is the deep brain stimulation (DBS) system. It consists of implanted electrodes positioned deep inside the brain connected to wires running under the skin, which carry signals from an implanted stimulator. This DBS can feed tiny, precision jolts of electricity into ones' brain to control epilepsy or Parkinson's tremors, dystonia (muscle spasms), and severe chronic pain. It has also been in trial for conditions like depression and Tourette's syndrome. The neurosurgeons use it to map and target various regions of the brain using different stimulation parameters to have precise control over the human brain.

However, Pycroft fears that such precise control of the brain, coupled with the wireless control of stimulators, paves the way for hackers to attack the brain implants. For instance, an attacker could potentially induce behavioral changes like hypersexuality or pathological gambling, or even exert a limited form of control over the patient's behavior by stimulating parts of the brain involved with reward learning to reinforce certain actions. The criminal perpetrators can cause blind attacks like cessation of stimulation, draining implant batteries, inducing tissue damage, and information theft, and targeted attacks like impairment of motor function, alteration of impulse control, modification of emotions or affect, induction of pain, and modulation of the reward system. Pycroft says although these hacks would be hard to achieve as they would require a high level of technological competence and the ability to monitor the victim, a sufficiently determined attacker could manage it.

While the scope of brain implants looks extremely promising, a single brainjacking incident can malign their reputation and raise questions of its safety and usability. This is why it is important to address this issue before the chips hit the mainstream market. Kaspersky has collaborated with the University of Oxford researchers on a project to map the potential threats and means of attack concerning these emerging technologies. Further, we need reinforced cybersecurity measures, which include encryption, identity and access management, patching, and updating the security of these brain implants to minimize instances of brainjacking. Clinicians and patients need to be educated on how to take precautions against these attacks.

You can read the research by the University of Oxford here.

You can read the research by Belgian researchers here.