Vulnerabilities / Threats
8/5/2011
12:19 PM
100%
0%

Getting Root On The Human Body

Black Hat researcher shows it is possible to remotely control a diabetic's insulin pump without person's knowledge

BLACK HAT USA 2011 -- Las Vegas -- A security researcher at Black Hat yesterday demonstrated how a hacker could remotely turn off a diabetic person's insulin pump without his knowledge. The findings came after months of research delving into the security of the portable medical devices that monitor diabetics' blood-sugar levels and those that deliver the body-chemistry-balancing insulin necessary to keep those levels in check throughout the day.

Click here for more of Dark Reading's Black Hat articles.

A SCADA security expert by day, Jerome Radcliffe himself is a diabetic and had been curious about the security of the devices that keep him alive. He looked into both continuous glucose monitors (CGMs) and insulin pumps within his research, with the findings from his pump-tinkering offering the most dramatic hackability.

According to Radcliffe, it is possible for a hacker to not only illicitly turn off the pump remotely, with the device only offering a small chirp as a response, but also to remotely manipulate any setting on the pump without it notifying the user at all.

"It's basically like having root on the device, and that's like having root on the chemistry of the human body," he said.

Diabetics today measure their glucose levels either by using blood-testing kits or a CGM that attaches a wire in the body and wirelessly transmits readings to a small pager-like device. Using those findings, a diabetic would then manually trigger the insulin pump he wears throughout the day to deliver the appropriate amount to keep blood-sugar levels stable. When a diabetic doesn't get enough insulin, he can suffer from a potentially fatal high-blood sugar level. But too much insulin can also cause fatally low-blood sugar, and once it is delivered to the body it can't be taken out.

The ability to fully control insulin delivery to a person is "scary" because of the precarious balance a diabetic must walk with the drug in order to stay alive.

In addition to his hack of the insulin pump, Radcliffe also learned how to listen into the transmissions of a CGM device using an oscilloscope. Though he wasn't able to fully hack the device in order to deliver precise false readings, he says the possibility is technically possible, and he was still able to disrupt and jam the device.

Radcliffe says that medical device manufacturers in this space need to be thinking of these types of vulnerabilities as the industry begins to move to support the Juvenile Diabetes Research Foundation's Artificial Pancreas Project. This project hopes to develop the toolset to the point where it is possible to link CGM data directly to insulin pumps to completely automate the insulin-delivery process. It sounds convenient, but if it is possible for hackers to own either device, the diabetic's life could be in grave danger.

"This makes the secure transmission of the CGM much more important," Radcliffe says. "We've got to think about how these technologies talk to each other."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Security Technologies to Watch in 2017
Emerging tools and services promise to make a difference this year. Are they on your company's list?
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.