A Vital Hack Could Turn Medical Devices Into Ventilators

As infections from the ongoing Covid-19 pandemic continue to climb, hospitals around the world are struggling with a potentially fatal shortage of ventilators, the bedside machines that help patients breathe when they’re unable to do so on their own. Meanwhile, hundreds of thousands of lower-grade breathing devices known as continuous positive airway pressure machines sit idle in closets or warehouses because their manufacturers say they can’t perform the same life-saving functions.

Security researcher Trammell Hudson analyzed the AirSense 10—the world’s most widely used CPAP—and made a startling discovery. Although its manufacturer says the AirSense 10 would require “significant rework to function as a ventilator,” many ventilator functions were already built into the device firmware.

Its manufacturer, ResMed, says the $700 device solely functions as a continuous positive airway pressure machine used to treat sleep apnea. It does this by funneling air into a mask. ResMed says the device can’t work as a bilevel positive airway pressure device, which is a more advanced machine that pushes air into a mask and then reduces the pressure to a calibrated lower level to allow it back out. With no ability to work in both directions or increase the output when needed, the AirSense 10 can’t be used as the type of ventilator that could help patients who are struggling to breathe. After reverse-engineering the firmware, Hudson says the ResMed claim is simply untrue.

To demonstrate his findings, Hudson on Tuesday is releasing a patch that he says unlocks the hidden capabilities buried deep inside the AirSense 10. The patch is dubbed Airbreak in a nod to jailbreaks that hobbyists use to remove technical barriers Apple developers erect inside iPhones and