Vulnerabilities / Threats
8/23/2011
10:16 AM
50%
50%

Hacked Medical Device Sparks Congressional Inquiry

Legislators demand answers after a security researcher remotely controlled his own insulin pump using a $20 radio frequency transmitter at Black Hat.

Slideshow: RFID In Healthcare
Slideshow: RFID In Healthcare
(click image for larger view and for full slideshow)
Two members of Congress have asked the Government Accountability Office (GAO) to review the Federal Communications Commission's approach to medical devices with wireless capabilities to ensure that the devices are "safe, reliable, and secure."

The letter to the GAO, from Reps. Anna G. Eshoo (D-Calif.) and Edward J. Markey (D-Mass.)--both members of the House communications and technology subcommittee--was sparked by a medical device hacking demonstration earlier this month at the Black Hat conference in Las Vegas.

While most Black Hat presentations typically detail exploits launched against others or more benign forms of hardware hacking, security researcher Jerome Radcliffe actually hacked--live and onstage--his own insulin pump, which he relies on to subcutaneously administer multiple doses of insulin per day. Radcliffe, 33, said he was diagnosed with diabetes at age 22.

Next came the medical device hardware hacking. Specifically, Radcliffe reverse-engineered the wireless commands sent from the small controller that ships with his pump, and which is used to tell the pump what dosage of insulin to administer. After decoding the communications protocol, Radcliffe was able to program a small radio frequency (RF) transmitter--easily available for $100 new, or $20 for a used one on eBay--to remotely control his insulin pump. In his demonstration, Radcliffe showed how he could use the remote transmitter both to administer arbitrary insulin doses, as well as to disable the pump.

Hacking the pump wasn't easy, he said, but the fact that he was able to crack the communications at all was due to its not being properly protected or encrypted. "There's no passwords, no authentication. All you need is the serial number," said Radcliffe. That's a concern, since the manufacturer of his insulin pump, which he declined to name, probably reused the technology for other medical devices, such as pacemakers. Radcliffe said he was in communications with his pump's manufacturer about ways to improve the security of its devices.

Altering a diabetic's insulin dosage could have fatal consequences. For example, a heavy user of insulin might require 80 units of insulin per day, whereas a child may be receiving doses measured in one-quarter units. Any variation in dosage could raise or lower blood-sugar levels in dangerous ways.

Radcliffe said he focused on his own insulin pump because it was at hand and because the cost of procuring other pumps--ranging in price from $5,000 to $10,000 each--was prohibitive.

Thankfully, not all medical devices can be wirelessly hacked--at least not with a $20 transmitter. For example, Radcliffe said he also wears a glucose monitor sensor on his body, which measure the conductivity of the fluid in his tissue to deduce blood sugar levels. "This thing beacons every five minutes what that value is," he said. But although he's been able to intercept the signal it sends, he hasn't been able to decode what it means. From a security standpoint, of course, that's a good thing.

Likewise, not all insulin pumps can be remotely hacked. "Other pump manufacturers that I've talked to, they're using SSL certificates to do communication ... and using more standardized, non-proprietary ways of communicating," he said. "When you go proprietary, you go with obscurity, and it never works."

Beyond using standardized--and thus tested--techniques for encryption and communication, what else would Radcliffe have done to harden the insulin pump against hacking? "First ... there should be some kind of verification. If something changes, the user should be made aware of it," he said. "Second, the devices need to have unique PINs or passcodes." Without knowing the PIN, an attacker would have a more difficult time altering the device's dosage. Another option, he said, would be to use infrared communications instead of RF. While lining up an infrared transmitter and receiver is more difficult for the device's user, such communications are much more difficult to spoof.

The vendors, contractors, and other outside parties with which you do business can create a serious security risk. Here's how to keep this threat in check. Also in the new, all-digital issue of Dark Reading: Why focusing solely on your own company's security ignores the bigger picture. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0733
Published: 2015-05-30
CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks, via a crafted request, aka Bug ID ...

CVE-2015-0743
Published: 2015-05-30
Cisco Headend System Release allows remote attackers to cause a denial of service (DHCP and TFTP outage) via a flood of crafted UDP traffic, aka Bug ID CSCus04097.

CVE-2015-0744
Published: 2015-05-30
Cisco DTA Control System (DTACS) 4.0.0.9 and Cisco Headend System Release allow remote attackers to cause a denial of service (CPU and memory consumption, and TCP service outage) via (1) a SYN flood or (2) other TCP traffic flood, aka Bug IDs CSCus50642, CSCus50662, CSCus50625, CSCus50657, and CSCus...

CVE-2015-0745
Published: 2015-05-30
Cisco Headend System Release allows remote attackers to read temporary script files or archive files, and consequently obtain sensitive information, via a crafted header in an HTTP request, aka Bug ID CSCus44909.

CVE-2015-0747
Published: 2015-05-30
Cisco Conductor for Videoscape 3.0 and Cisco Headend System Release allow remote attackers to inject arbitrary cookies via a crafted HTTP request, aka Bug ID CSCuh25408.

Dark Reading Radio
Archived Dark Reading Radio
After a serious cybersecurity incident, everyone will be looking to you for answers -- but you’ll never have complete information and you’ll never have enough time. So in those heated moments, when a business is on the brink of collapse, how will you and the rest of the board room executives respond?