Implantable Cardiac Device Wireless Attack Range Simulator (2D)

Attacker Position

Distance from patient 4.0 m

Orbit angle 0°

Implant transmit power 0 dBm

Telemetry Link

Listening… no attacker packets captured yet.

Live Readouts

Signal at attacker

−dBm

Capture probability

Packets intercepted

Successful attacks

How it works

Implantable cardiac devices (pacemakers, ICDs) talk to an external programmer over a short-range radio link. How far an eavesdropper can be and still read that link is governed by the log-distance path-loss model:

RSSI(d) = P_tx − PL₀ − 10·n·log₁₀(d / d₀)

P_tx = implant transmit power (dBm)
PL₀  = path loss at reference distance d₀ = 1 m (≈40 dB, 2.4 GHz)
n    = environment exponent (2.5, typical hospital room clutter)
d    = distance from implant (m)

The attacker's chance of actually capturing a packet is modelled as a sigmoid centred on a −85 dBm receiver sensitivity threshold:

P(capture) = 1 / (1 + exp( −(RSSI − (−85)) / 4 ))

Top-down map — drag the red attacker marker anywhere on the floor plan (or use the sliders); the orange ring shows the −85 dBm detection-range boundary computed live from the current transmit power.
RSSI-vs-distance graph — the blue curve is the exact path-loss function for the current transmit power; the dashed line is the −85 dBm sensitivity floor and the marker tracks your current distance.
Transmit power — real implants deliberately use very low power (often under 0 dBm) specifically to shrink the detection ring and force an attacker close to the body.
AES-128 Encryption toggle — with encryption on, captured frames are unreadable ciphertext (grey packets): the attacker can still detect the link but not forge a valid command. With it off, packets are cleartext (red) and can be recorded and replayed.
Attempt Replay Attack — only succeeds when a plaintext packet was captured in range; it re-sends a captured "pace/shock" command back at the implant, which accepts it because it has no way to tell a valid command from a recorded one without cryptographic authentication.

This is the real vulnerability class behind FDA safety communications on implantable device telemetry (e.g. the 2017 St. Jude/Abbott pacemaker advisory): unauthenticated short-range RF links can be eavesdropped and replayed unless the firmware adds encryption and message authentication.

Implant ⇄ Programmer link Attacker device Detection range (−85 dBm)

RSSI vs. distance