Vulnerabilities / Threats
8/23/2011
10:16 AM
Connect Directly
RSS
E-Mail
50%
50%

Hacked Medical Device Sparks Congressional Inquiry

Legislators demand answers after a security researcher remotely controlled his own insulin pump using a $20 radio frequency transmitter at Black Hat.

Slideshow: RFID In Healthcare
Slideshow: RFID In Healthcare
(click image for larger view and for full slideshow)
Two members of Congress have asked the Government Accountability Office (GAO) to review the Federal Communications Commission's approach to medical devices with wireless capabilities to ensure that the devices are "safe, reliable, and secure."

The letter to the GAO, from Reps. Anna G. Eshoo (D-Calif.) and Edward J. Markey (D-Mass.)--both members of the House communications and technology subcommittee--was sparked by a medical device hacking demonstration earlier this month at the Black Hat conference in Las Vegas.

While most Black Hat presentations typically detail exploits launched against others or more benign forms of hardware hacking, security researcher Jerome Radcliffe actually hacked--live and onstage--his own insulin pump, which he relies on to subcutaneously administer multiple doses of insulin per day. Radcliffe, 33, said he was diagnosed with diabetes at age 22.

Next came the medical device hardware hacking. Specifically, Radcliffe reverse-engineered the wireless commands sent from the small controller that ships with his pump, and which is used to tell the pump what dosage of insulin to administer. After decoding the communications protocol, Radcliffe was able to program a small radio frequency (RF) transmitter--easily available for $100 new, or $20 for a used one on eBay--to remotely control his insulin pump. In his demonstration, Radcliffe showed how he could use the remote transmitter both to administer arbitrary insulin doses, as well as to disable the pump.

Hacking the pump wasn't easy, he said, but the fact that he was able to crack the communications at all was due to its not being properly protected or encrypted. "There's no passwords, no authentication. All you need is the serial number," said Radcliffe. That's a concern, since the manufacturer of his insulin pump, which he declined to name, probably reused the technology for other medical devices, such as pacemakers. Radcliffe said he was in communications with his pump's manufacturer about ways to improve the security of its devices.

Altering a diabetic's insulin dosage could have fatal consequences. For example, a heavy user of insulin might require 80 units of insulin per day, whereas a child may be receiving doses measured in one-quarter units. Any variation in dosage could raise or lower blood-sugar levels in dangerous ways.

Radcliffe said he focused on his own insulin pump because it was at hand and because the cost of procuring other pumps--ranging in price from $5,000 to $10,000 each--was prohibitive.

Thankfully, not all medical devices can be wirelessly hacked--at least not with a $20 transmitter. For example, Radcliffe said he also wears a glucose monitor sensor on his body, which measure the conductivity of the fluid in his tissue to deduce blood sugar levels. "This thing beacons every five minutes what that value is," he said. But although he's been able to intercept the signal it sends, he hasn't been able to decode what it means. From a security standpoint, of course, that's a good thing.

Likewise, not all insulin pumps can be remotely hacked. "Other pump manufacturers that I've talked to, they're using SSL certificates to do communication ... and using more standardized, non-proprietary ways of communicating," he said. "When you go proprietary, you go with obscurity, and it never works."

Beyond using standardized--and thus tested--techniques for encryption and communication, what else would Radcliffe have done to harden the insulin pump against hacking? "First ... there should be some kind of verification. If something changes, the user should be made aware of it," he said. "Second, the devices need to have unique PINs or passcodes." Without knowing the PIN, an attacker would have a more difficult time altering the device's dosage. Another option, he said, would be to use infrared communications instead of RF. While lining up an infrared transmitter and receiver is more difficult for the device's user, such communications are much more difficult to spoof.

The vendors, contractors, and other outside parties with which you do business can create a serious security risk. Here's how to keep this threat in check. Also in the new, all-digital issue of Dark Reading: Why focusing solely on your own company's security ignores the bigger picture. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2886
Published: 2014-09-18
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during ins...

CVE-2014-4352
Published: 2014-09-18
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.

CVE-2014-4353
Published: 2014-09-18
Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.

CVE-2014-4354
Published: 2014-09-18
Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.

CVE-2014-4356
Published: 2014-09-18
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.

Best of the Web
Dark Reading Radio