## 3 Consumer Products and Active Implantable Medical Devices
### Security and attacks in Consumer Products  
We interpret the phrase _consumer-product security_ in two ways. The first, which we adopt primarily, is that of _protecting users from malicious or insecure devices_. The second (and generally less common) view is that of _protecting devices themselves from consumer attacks or \"hacks\"_ (for example, in order to access manufacturer disabled functionalities). A primary reason manufacturers intentionally disable functionalities is to enable product price tiering (e.g. low and high end products) while maintaining highly cohesive manufacturing processes: lower end devices will have excess functionalities disabled rather than removed altogether. These viewpoints of the phrase \"consumer product security\" are distinct but not mutually exclusive; many of the techniques proposed in dealing with the second viewpoint are directly applicable to the first. For example, the use of secure boot processes, robust code reviews, and component isolation in consumer devices has been advocated in order to prevent the introduction of unauthorized, feature-enabling new code [36]. These measures have direct end-user security benefits in that they aid in preventing the introduction of _all_ new code, whether that code be user intended or malicious. In the remainder of this section, we discuss security vulnerabilities in consumer products, describing instances of successful attacks upon those vulnerabilities where possible. Consumer products are susceptible to attacks against anonymity, similar to CAMSN. One example of this is the Nike+iPod Sport Kit [37]. The product utilizes two paired devices, a sensor and a receiver. The sensor is placed in an end-user's shoes, while the receiver is attached to the user's pre-existing iPod. The users' footsteps are monitored by the sensor and reported to the receiver, allowing the user to monitor her exercise. The product utilizes a non-encrypted unique ID for every sensor. This allows attackers to sniff for the system's presence and, in turn, monitor the end-user's presence at various physical locations. Because the system is physically based (e.g. users wear it), attackers can easily associate overheard unique IDs with individual persons. In this case, the manufacturers of the device failed to recognize that communications between two statically paired devices (sensor and receiver) could easily be encrypted with a symmetric cryptography system. **Side channel attacks** allow an attacker to gain useful information by means other than message contents; these attacks are a type of _information leak_. Examples of side channels are inter-packet timing, packet header contents, packet size, and network flow size. An attacker can observe all of these without knowledge of message contents or protocol encryption schemes. Side channel attacks are possible in any networked system including mobile social networks, vehicular ad-hoc networks, and medical devices. Certain features of consumer devices make them particularly favorable targets for side channel attacks. Specifically, side channel attacks are most easily carried out when an estimate of the type of network traffic to be eavesdropped is available. The SlingBox Pro, a wireless consumer media device utilizing Variable Bit Rate (VBR) compression, was found to suffer from information leak problems [37]. The SlingBox Pro's goal is to encode live media signals (e.g. television or movies), apply VBR compression to the encoded media, and stream the compressed media over a network to the Internet. In testing the SlingBox Pro, researchers used an encrypted 802.11 WiFi network for communications. Researchers discovered that they did not need to examine message contents (nor break 802.11 WiFi security measures) in order to discover the movies being viewed by SlingBox Pro users. Rather, the SlingBox's use of VBR compression allowed investigators to correlate network flows with individual media items.