Vulnerabilities / Threats
8/23/2011
10:16 AM
50%
50%

Hacked Medical Device Sparks Congressional Inquiry

Legislators demand answers after a security researcher remotely controlled his own insulin pump using a $20 radio frequency transmitter at Black Hat.

Slideshow: RFID In Healthcare
Slideshow: RFID In Healthcare
(click image for larger view and for full slideshow)
Two members of Congress have asked the Government Accountability Office (GAO) to review the Federal Communications Commission's approach to medical devices with wireless capabilities to ensure that the devices are "safe, reliable, and secure."

The letter to the GAO, from Reps. Anna G. Eshoo (D-Calif.) and Edward J. Markey (D-Mass.)--both members of the House communications and technology subcommittee--was sparked by a medical device hacking demonstration earlier this month at the Black Hat conference in Las Vegas.

While most Black Hat presentations typically detail exploits launched against others or more benign forms of hardware hacking, security researcher Jerome Radcliffe actually hacked--live and onstage--his own insulin pump, which he relies on to subcutaneously administer multiple doses of insulin per day. Radcliffe, 33, said he was diagnosed with diabetes at age 22.

Next came the medical device hardware hacking. Specifically, Radcliffe reverse-engineered the wireless commands sent from the small controller that ships with his pump, and which is used to tell the pump what dosage of insulin to administer. After decoding the communications protocol, Radcliffe was able to program a small radio frequency (RF) transmitter--easily available for $100 new, or $20 for a used one on eBay--to remotely control his insulin pump. In his demonstration, Radcliffe showed how he could use the remote transmitter both to administer arbitrary insulin doses, as well as to disable the pump.

Hacking the pump wasn't easy, he said, but the fact that he was able to crack the communications at all was due to its not being properly protected or encrypted. "There's no passwords, no authentication. All you need is the serial number," said Radcliffe. That's a concern, since the manufacturer of his insulin pump, which he declined to name, probably reused the technology for other medical devices, such as pacemakers. Radcliffe said he was in communications with his pump's manufacturer about ways to improve the security of its devices.

Altering a diabetic's insulin dosage could have fatal consequences. For example, a heavy user of insulin might require 80 units of insulin per day, whereas a child may be receiving doses measured in one-quarter units. Any variation in dosage could raise or lower blood-sugar levels in dangerous ways.

Radcliffe said he focused on his own insulin pump because it was at hand and because the cost of procuring other pumps--ranging in price from $5,000 to $10,000 each--was prohibitive.

Thankfully, not all medical devices can be wirelessly hacked--at least not with a $20 transmitter. For example, Radcliffe said he also wears a glucose monitor sensor on his body, which measure the conductivity of the fluid in his tissue to deduce blood sugar levels. "This thing beacons every five minutes what that value is," he said. But although he's been able to intercept the signal it sends, he hasn't been able to decode what it means. From a security standpoint, of course, that's a good thing.

Likewise, not all insulin pumps can be remotely hacked. "Other pump manufacturers that I've talked to, they're using SSL certificates to do communication ... and using more standardized, non-proprietary ways of communicating," he said. "When you go proprietary, you go with obscurity, and it never works."

Beyond using standardized--and thus tested--techniques for encryption and communication, what else would Radcliffe have done to harden the insulin pump against hacking? "First ... there should be some kind of verification. If something changes, the user should be made aware of it," he said. "Second, the devices need to have unique PINs or passcodes." Without knowing the PIN, an attacker would have a more difficult time altering the device's dosage. Another option, he said, would be to use infrared communications instead of RF. While lining up an infrared transmitter and receiver is more difficult for the device's user, such communications are much more difficult to spoof.

The vendors, contractors, and other outside parties with which you do business can create a serious security risk. Here's how to keep this threat in check. Also in the new, all-digital issue of Dark Reading: Why focusing solely on your own company's security ignores the bigger picture. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-5084
Published: 2015-08-02
The Siemens SIMATIC WinCC Sm@rtClient and Sm@rtClient Lite applications before 01.00.01.00 for Android do not properly store passwords, which allows physically approximate attackers to obtain sensitive information via unspecified vectors.

CVE-2015-5352
Published: 2015-08-02
The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time ...

CVE-2015-5537
Published: 2015-08-02
The SSL layer of the HTTPS service in Siemens RuggedCom ROS before 4.2.0 and ROX II does not properly implement CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a different vulnerability than CVE-2014-3566.

CVE-2015-5600
Published: 2015-08-02
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumptio...

CVE-2015-1009
Published: 2015-07-31
Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file.

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!