Has Anyone Experienced Malicious Hacking of Their CPAP Machine Remotely?

[Dog Slobber]

That may be the case, but if so, the tech was able to push that "call home" command, 'cause it changed in seconds  while we were on the phone together. It didn't happen during the "normal" noonish schedule where the PAP reports to the mothership, as the telemedicine set-up appointment was at 2 p.m., and we were several minutes late getting started, as one tech had passed me off to another before I even got called. It seems feasible that perhaps the PAP checks in more frequently if it's still set at the default pressure range, of course.  

Receiving packets across a cell network which cause a near-instantaneous change on the device may not be "interactive," but it's not something I've seen done until now, with the AirSense 11.

-Jeff

From the ResMed AirView setup Guide:

   

Note: Changes in the settings will update the next day data is wirelessly retrieved.

Other events can force the device to connect to the network.

• Ending a sleep session
  
• Powering on the device
  

[GuyScharf]

The challenge is all the incentive they need. Either way still needs to have IP. Which means it can be scanned and services found.

No, they don't have an internet connection so do not have an IP address. They use a cellular connection and call out.

[Ms.Tired]

I see this message about malicious hacking of Capp was posted in 2021 and most responders seemed to doubt why anyone would hack a machine. I believe people will hack your cpap for malicious reasons to disrupt your sleep so you are tired and irritable and and can’t function. They also may be hoping you will act out of character at work or maybe fall asleep on your job. I just got a new machine in December 2022 and have been having no issues until last week when I was awakened at 5:30 am with water in my mask and my machine was completely shut off.  It did not work after unplugging and checking connections. My machine came back on when I took in for service two days later. This week, I have been awakened for no reason at 3:59 am, 2 am, and 5 am. The first time my machine died, I heard somebody drive away from curb. So yes, I believe people can and will hack your machine to harass you.

[Dog Slobber]

Motivation is just one reason, some people believe these devices haven't been hacked.

To date, we have seen zero evidence of hacking.  Basically, CPAP devices have processors, CPAP devices have communication, hackers hack computers, therefore our CPAP machines are getting hacked.

Or, something that happens that an individual can't explain, therefore their CPAP was hacked. Thius demonstrates a huge logic error, specifically an argument from incredulity.

You experienced rainout, perfectly explainable
You experienced a device failure, perfectly explainable
You woke up a couple times, very common. A possibly explainable.
You heard a car drive away, perfectly explainable.

In fact, associating the above with hacking is not evidence of hacking, but evidence of your lack of understanding of the technology within CPAPs. Your machine is listed as a ResMed 10. There is nothing within an AirSense 10 that requires close proximity, to connect to it. They use cellular for communication. The association you've created with a car driving away immediately after you woke up does not and cannot be associated with any kind of malicious hacking. But you believing there could be a link says a lot about your ability to technically and rationally evaluate other explanations.

[Ms.Tired]

Mr. Dog Slobber, what is your expertise? Particularly as it pertains to CPAP machines or any medical device for that matter.  And I’m not talking about medal plates. 

There have been other incidents that also led me to this conclusion but I will not waste my time typing so you can misunderstand. Thank goodness you are not my doctor or attorney!

[Dog Slobber]

Mr. Dog Slobber, what is your expertise? Particularly as it pertains to CPAP machines or any medical device for that matter. 

I have approximately 25 years of computer security experience, including:

• Perimeter and host-based firewalls
  
• Installing and maintaining servers
  
• Digital forensics
  
• M2M/IoT devices (which is the technology used in ResMed connected devices)
  

I will not waste my time typing

Thank you!