9

Black Hat: Lethal Hack and wireless attack on insulin pumps to kill people Like something straight out of science fiction, an attacker with a powerful antenna could be up to a half mile away from a victim yet launch a wireless hack to remotely control an insulin pump and potentially kill the victim.

After conducting his research, Radcliffe told the Associated Press, "My initial reaction was that this was really cool from a technical perspective. The second reaction was one of maybe sheer terror, to know that there's no security around the devices which are a very active part of keeping me alive."

Seems dubious that there is zero, nada, zilch security of any type.

Improve this question
6
  • Some pumps do support a limited degree of radio control. I believe at least one model had mandatory (can't turn it off) signalling when receiving remote commands (though the user choose switch it between audio and vibration), so the target could not be guaranteed to be unaware that the attack was underway.
    – dmckee --- ex-moderator kitten
    Commented Aug 6, 2011 at 4:00
  • 3
    It will be difficult to get a definite answer at this point as Radcliffe hasn't revealed which manufacturer is affected. Though I wouldn't be all that surprised if the security of these devices is really that terrible.
    – Mad Scientist ♦
    Commented Aug 6, 2011 at 6:25
  • 1
    The article notes that one can change the reading of a blood glucose meter remotely - I have not seen a wireless blood glucose meter where the reading can be changed remotely. The reading can be read remotely, but not changed. I suspect that part of the article is simply a reporter misinterpreting the conversation. There are insulin infusion pumps which include a remote fob (like a car lock/unlock remote) that allows the patient to dose themselves without touching the pump itself. These are protected by weak security, but would still take significant time and observation to find the code.
    – Adam Davis
    Commented Aug 6, 2011 at 14:33
  • 1
    Patients who are on an infusion pump are typically receiving very high doses of insulin. While the doctor and patient set limits so they cannot give themselves an obviously too large dose, it's quite possible that at the right time the maximum dose could be pushed and result in a significant medical problem. The serial number is all that's required to make a radio remote for the pump, so using social engineering one could probably get that. I don't think it could easily be brute forced due to lack of feedback (unless observing the patient directly, you don't know you dosed them).
    – Adam Davis
    Commented Aug 6, 2011 at 14:36
  • 2
    @Adam: Oddly enough I've known several pump patients who were taking very low does of insulin (for a type I). The pump simply allows much better control of the does than shots (i.e. the patient can reliably give themselves 0.05 to 0.1 units), so being on circa 12 units a day (basal and bolus) isn't a problem.
    – dmckee --- ex-moderator kitten
    Commented Aug 6, 2011 at 15:38

2 Answers 2

Reset to default
7

If you go to the source, it's clear that there is no proof that it can be done.

Abstract for Jerome Radcliffe's "Hacking Medical Devices for Fun and Insulin: Breaking the Human SCADA System" presentation:

As a diabetic, I have two devices attached to me at all times; an insulin pump and a continuous glucose monitor. This combination of devices turns me into a Human SCADA system; in fact, much of the hardware used in these devices are also used in Industrial SCADA equipment. I was inspired to attempt to hack these medical devices after a presentation on hardware hacking at DEF CON in 2009. Both of the systems have proprietary wireless communication methods.

Could their communication methods be reverse engineered? Could a device be created to perform injection attacks? Manipulation of a diabetic's insulin, directly or indirectly, could result in significant health risks and even death. My weapons in the battle: Arduino, Ham Radios, Bus Pirate, Oscilloscope, Soldering Iron, and a hacker's intuition.

After investing months of spare time and an immense amount of caffeine, I have not accomplished my mission. The journey, however, has been an immeasurable learning experience - from propriety protocols to hardware interfacing-and I will focus on the ups and downs of this project, including the technical issues, the lessons learned, and information discovered, in this presentation "Breaking the Human SCADA System."

So it seems to me that the quote in the article you're referring to must have been taken out of context.

Improve this answer
6
  • The problem I have here is the same problem I have when myth busters "Busts" some of their myths. Just because they were not able to reproduce the results does not mean it is not possible. Unless you can demonstrate that hack is impossible or at least approaching it(ie shielded from wireless/strong encrytption based communication), or engineered so as to prevent an overdose even if the numbers look like the dose is needed, or some other method of fool proof protection, then you can not say that it cant be done.
    – Chad
    Commented Aug 8, 2011 at 16:46
  • 2
    No encryption is proven to be safe. All current encryption methods are based on assumption that there are no quick factorization methods. Which is based on assumption that NP≠P, which hasn't been so far proven. But that's not really relevant. Question was if it's true, that there is no security at all. Expert hacker couldn't hack it in months, proving that there is in fact security. And that is the same hacker as the one referred to in the article.
    – vartec
    Commented Aug 8, 2011 at 16:56
  • actually all it proved was that expert hacker was not able to figure out how to do it in the time he allowed. Maybe the next thing he tries works. Not only that it as only investing spare time. Can a dedicated assassin wanting to target a specific persons pump figure it out? Is there some weakness that was not found? That is not answered
    – Chad
    Commented Aug 8, 2011 at 17:37
  • @Chad: If he couldn't figure it out, that means it doesn't have any typical security design mistakes (as not using encryption, not using timestamps etc). You want a proof of correctness? It not being done for any software, not even ones that control nuclear weapons. There is never a guarantee that software is bug free.
    – vartec
    Commented Aug 9, 2011 at 9:17
  • I am not asking for bug free. I am saying that one person not being able to do it no matter how good they maybe does not "PROVE" it cant be done. I am notsaying it can be just that this is not enough to say that it cannot be done
    – Chad
    Commented Aug 9, 2011 at 12:59
3

This blog entry is relevant: "Hackers can kill Diabetics with Insulin Pumps from a half mile away - Um, no. Facts vs. Journalistic Fear mongering" (Scott Hanselman) and contains interesting email thread between the author (diabetic, computer programmer) and Radcliffe. The email thread has been added to the entry afterwards as a disclaimer (in red).

From: Jerome Radcliffe

I can hack an insulin pump. I can suspend it, change all the settings remotely. I did that on stage.

he also wrote:

Check CBS in las Vegas's web site. They have a video of the demo.

So everybody's answer to the question seems to be: "no", Radcliffe's is: "yes", mine is: "I'm confused".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .