Hackers can steal your BRAIN WAVES

Depressingly familiar and stupid mistakes in EEG kit, health org's storage of recorded brains

BruCon: Behold the future: attackers can already get between brain-waves and hospital kit, and it's just going to get worse according to IOActive senior consultant Alejandro Hernández.

Hernández says the ability to steal, manipulate, and replay brain waves used in electroencephalography (EEG) is already emerging, with consumer-grade kit already able to be hacked and the health care industry taking few precautions to properly protect recorded brain waves.

After decades in labs and hospitals, encephalography is steadily being implemented in lightweight consumer headsets and other devices that as yet remain largely experimental or gimmicky.

In clinical settings, EEG-recording devices are a useful tool for diagnosing seizures and sleeping disorders like narcolepsy.

Researchers think recorded brain waves have the potential to score the mental faculties of murderers, create brain-to-brain interfaces where conscious thoughts are transmitted over the internet and unconsciously enacted by another person or see drones flown by neural impulses.


Hernández pulls off a man-in-the-middle attack against his own brain waves.

Before we get there, we'll need to lock down EEG devices. Hernández says a year's research taught him how to find discover holes in EEG equipment and come to the recognition that recorded brain waves should be considered sensitive data and therefore encrypted. The researcher worked with a US$80 MindWave device

pitched as a tool to help measure how students' brains work when doing maths and other problems.

Hospital-grade machinery remains out of reach of hackers without deep pockets and the required intricate knowledge of which brain waves can be modified for a given outcome.

Nevertheless, Hernández asserts that dangerous vulnerabilities exist in home and likely hospital kit, including data stream stealing and application holes, and garden-variety man-in-the-middle and denial-of-service attacks.

The required knowledge too is not exotic or unobtainable for a determined hacker.


Analysing brain waves isn't easy.

The hacker demonstrated at the BruCon conference last week a live man-in-the-middle attack on his own brain signals using the unsupported but still very widely used open-source EEG NeuroServer package.

“Years ago no-one was worried about SCADA networks just that it works, and a decade later we are talking about [SCADA] security… I am finding exactly the same thing with EEG and now is the best time to put security in the technology,” Hernández told the conference.

“If you can sniff brain data in the wire, you can do replay attacks [such as] if there is no security mechanism between an operator and a drone [or by] tampering with EEG data so it is not the same that was recorded by the electrodes.

“Or how about instead of spammers, there are EEG data neural marketers?”

EEG data also poses more prosaic risks. Hernández told Vulture South of an un-named hospital's EEG file shares, saying the server could be found exposed by using the popular Shodan hacker search engine.

These attacks are part speculation, part tested, but all built on the evidence that EEG like so many emergent technology fields has left security in the dust of capability progress. Hernández has however popped the mental locks of popular gear within the realms of the everyday hacker.

Mind bending

EEG's security problems are depressingly familiar results of bad software design, Hernández told this reporter. The ENOBIO EEG device (which rather resembles rugby headgear) is vulnerable to man-in-the-middle attacks. He found less-severe application vulnerabilities and ordinary crashes in EEG software including Persyst Advanced Review; Natus Stellate Harmonie Viewer; NeuroServer; BrainBay, and SigViewer.

“For example, some applications send the raw brain waves to another remote endpoint using the TCP/IP protocol, that by design doesn’t include security, and therefore this kind of traffic is prone to common network attacks such as man-in-the-middle where an attacker would be able to intercept and modify the EEG data sent,” Hernández says.

Further, components like the acquisition device, middleware, and endpoints lack authentication meaning an attacker can connect to a remote TCP port and steal raw EEG data. That same flaw lets attacks pull off the more dangerous reply attacks.

Hernández cannot speak for the state of security of hospital-grade EEG kit, which is harder for hackers to access and test. But his research is bad news for those who advocate EEG readings as an authentication mechanism.

The good news, the researcher says, is that the vulnerabilities he's found can be nixed with known best practices: “This is a big yes – best practices from the technology perspective, secure design, and secure programming should be followed”. ®

Similar topics

Other stories you might like

  • Running Windows 10? Microsoft is preparing to fire up the update engines

    Winter Windows Is Coming

    It's coming. Microsoft is preparing to start shoveling the latest version of Windows 10 down the throats of refuseniks still clinging to older incarnations.

    The Windows Update team gave the heads-up through its Twitter orifice last week. Windows 10 2004 was already on its last gasp, have had support terminated in December. 20H2, on the other hand, should be good to go until May this year.

    Continue reading
  • Throw away your Ethernet cables* because MediaTek says Wi-Fi 7 will replace them

    *Don't do this

    MediaTek claims to have given the world's first live demo of Wi-Fi 7, and said that the upcoming wireless technology will be able to challenge wired Ethernet for high-bandwidth applications, once available.

    The fabless Taiwanese chip firm said it is currently showcasing two Wi-Fi 7 demos to key customers and industry collaborators, in order to demonstrate the technology's super-fast speeds and low latency transmission.

    Based on the IEEE 802.11be standard, the draft version of which was published last year, Wi-Fi 7 is expected to provide speeds several times faster than Wi-Fi 6 kit, offering connections of at least 30Gbps and possibly up to 40Gbps.

    Continue reading
  • Windows box won't boot? SystemRescue 9 may help

    An ISO image you can burn or drop onto a USB key

    The latest version of an old friend of the jobbing support bod has delivered a new kernel to help with fixing Microsoft's finest.

    It used to be called the System Rescue CD, but who uses CDs any more? Enter SystemRescue, an ISO image that you can burn, or just drop onto your Ventoy USB key, and which may help you to fix a borked Windows box. Or a borked Linux box, come to that.

    SystemRescue 9 includes Linux kernel 5.15 and a minimal Xfce 4.16 desktop (which isn't loaded by default). There is a modest selection of GUI tools: Firefox, VNC and RDP clients and servers, and various connectivity tools – SSH, FTP, IRC. There's also some security-related stuff such as Yubikey setup, KeePass, token management, and so on. The main course is a bunch of the usual Linux tools for partitioning, formatting, copying, and imaging disks. You can check SMART status, mount LVM volumes, rsync files, and other handy stuff.

    Continue reading

Biting the hand that feeds IT © 1998–2022