Hacking a pacemaker

In the last few days I have read a couple of pieces which quote the William Gibson dictum "the future has already arrived, it’s just not distributed evenly". Confirmation that we are indeed living in a science-fiction story arrived today in the shape of a message on the Full Disclosure list: hacking a pacemaker. Security researcher Gadi Evron cites a report in the NYT.

" The threat seems largely theoretical. But a team of computer security researchers plans to report Wednesday that it had been able to gain wireless access to a combination heart defibrillator and pacemaker.

They were able to reprogram it to shut down and to deliver jolts of electricity that would potentially be fatal . if the device had been in a person. In this case, the researcher were hacking into a device in a laboratory. "

What a great way to assassinate somebody....

Who needs SQL injection?

I - probably like many of you - thought the prevention of SQL injection (the passing of additional SQL statements through the parameters of dynamic SQL calls) was the low hanging fruit of web app security. Not at all. This latest post from The Daily WTF really takes database (in)security to another level.