Hacking Hearts by Reverse Engineering Pacemaker Firmware

The talk opens with Marie Mo, a researcher who depends on a pacemaker herself. She began studying her Biotronik device in 2015, after finding no published security research on it. A radiation-induced fail-safe event, and the memory dump the clinic programmer produced during recovery, later became a lead for the wider project, which has since produced several CVEs, papers and student theses.

The student speakers walk through the ecosystem: a Windows XP programmer, a programming head acting as a radio transceiver, and the implant. From the programmer they traced the DLLs behind its dump routine and patched hard-coded address ranges, reaching the device's full 16 MB space instead of a small default region. Mapping COM vtables to interface names and hooking serial APIs let them rebuild the packet protocol in a custom tool. Firmware analysis then revealed read, write and an indirect-call command, giving arbitrary read and write. One shellcode overwrite crashed the device and had to be recovered with a reset command.

The weaknesses they list include a von Neumann layout without execute-versus-write separation, no address randomization, and no real authentication, since the device returns its connection identifier to any requester. Attacks needed close range, and the team reported the findings to the vendor, which is working on fixes. The takeaway is that obscurity does not protect implanted devices, though the speakers stress that the benefits still outweigh the risk.