Security of Internet-Connected Hearing Aids

Unabhängig. Unvoreingenommen.

Produktbewertungen.

A statistic that I recently read and have discussed with my colleagues at length is:

70% of IoT devices on the market today are not secure.

For a market that is projected to reach billions of devices – that’s right billion with a ‘B’ – 70% is a staggeringly high number!

In recent news, IoT devices have been used to launch DDoS (Distributed Denial of Service) attacks against governments, corporations, and other entities, which take advantage of these insecure devices. These attacks are capable of flooding the internet with so many connections, that websites cannot handle the load and are knocked offline for regular users like you and I. The recent DDoS attack that took down Twitter, Spotify, PayPal, GitHub, CNN.com and the New York Times, was largely preventable, and only made possible by thousands of insecure IoT devices! Hearing aids too can fall victim to hacking attempts, and be used to mount such attacks. Just imagine your new pair of Oticon Opn’s taking down the New York Times!

Let’s get a little personal so that the dangers of insecure hearing aids are something that you would be able to relate to. I’ll illustrate these dangers with two scenarios:

Imagine your hearing aids are paired to your phone at all times – like the ReSound LiNX and Starkey Halos. Yesterday, you received an email from a “friend” about some cool new app and you clicked the link to get it and installed it on your phone. Little did you know, the link in the email was malicious and you ended up installing an app from a hacker. Imagine that malicious app is able to capture all communication between your phone and your hearing aids. Later that day, you decide to call your bank to pay a bill. You are asked to answer some verification questions from the bank agent over the phone. Because your awesome new hearing aids are paired to your phone, the malicious app was able to passively listen to your entire conversation capturing answers to your security questions, account balance, and etc … and then upload to the hacker’s server. You’ve now just been compromised and your banking information is in the hands of a fraudster!
Imagine you are successful CEO of a startup company that is just about to IPO and you have a great new pair of internet-connected hearing aids to help you go about negotiating the various aspects of the deal. Secrecy is of paramount importance as information about your company can affect its stock price and many other factors that can impact the success of the IPO. What you didn’t know is that that the great new pair of internet-connected hearing aids you bought had a zero-day exploit (i.e. a security bug previously unknown to the manufacturer) that allowed an attacker to listen and record your conversation in real-time. They’d be able to use that information to harm your company on the day of your big IPO. You might be targeted for insider-trading by regulatory bodies, face financial ruin, or even jail-time as result of this IPO-gone-bad scenario.

These are just two examples of what can happen when security is missing or not strong enough in a product like a hearing aid. These scenarios would previously not have been possible, because the hearing aid was a closed system with no outside connection, except during fittings at the hearing clinic. But going forward that will no longer be case.

Security, unfortunately, is often not well understood and brushed aside as an expensive overhead cost to manufacturers of IoT devices – until something goes horribly wrong. For hearing aid manufacturers, my message is that they need to pay attention and start integrating security into their solutions now. Security is often ineffective or greatly diminished when it’s “bolted-on” to an existing solution or product. For maximum protection of the end user, security must be at the core of every product starting at the time of design and followed through to implementation in both hardware and software.

I want to feel safe wearing my hearing aids 16+ hours a day knowing that my conversations remain private at all times and the technology they integrate with is not spying on me or causing malicious activities as result of the connection to the Internet. As hearing aid users, we should demand that hearing aid security be treated as a fundamental right for every single hearing user, not a privilege. Just like we can choose who we let through the front door to our house, we need to be able to securely choose what we digitally allow into our connected hearing aids.

Security of Internet-Connected Hearing Aids

Constantine Grantcharov