Vulnerabilities / Threats

10:16 AM

Hacked Medical Device Sparks Congressional Inquiry

Legislators demand answers after a security researcher remotely controlled his own insulin pump using a $20 radio frequency transmitter at Black Hat.

Slideshow: RFID In Healthcare
Slideshow: RFID In Healthcare
(click image for larger view and for full slideshow)
Two members of Congress have asked the Government Accountability Office (GAO) to review the Federal Communications Commission's approach to medical devices with wireless capabilities to ensure that the devices are "safe, reliable, and secure."

The letter to the GAO, from Reps. Anna G. Eshoo (D-Calif.) and Edward J. Markey (D-Mass.)--both members of the House communications and technology subcommittee--was sparked by a medical device hacking demonstration earlier this month at the Black Hat conference in Las Vegas.

While most Black Hat presentations typically detail exploits launched against others or more benign forms of hardware hacking, security researcher Jerome Radcliffe actually hacked--live and onstage--his own insulin pump, which he relies on to subcutaneously administer multiple doses of insulin per day. Radcliffe, 33, said he was diagnosed with diabetes at age 22.

Next came the medical device hardware hacking. Specifically, Radcliffe reverse-engineered the wireless commands sent from the small controller that ships with his pump, and which is used to tell the pump what dosage of insulin to administer. After decoding the communications protocol, Radcliffe was able to program a small radio frequency (RF) transmitter--easily available for $100 new, or $20 for a used one on eBay--to remotely control his insulin pump. In his demonstration, Radcliffe showed how he could use the remote transmitter both to administer arbitrary insulin doses, as well as to disable the pump.

Hacking the pump wasn't easy, he said, but the fact that he was able to crack the communications at all was due to its not being properly protected or encrypted. "There's no passwords, no authentication. All you need is the serial number," said Radcliffe. That's a concern, since the manufacturer of his insulin pump, which he declined to name, probably reused the technology for other medical devices, such as pacemakers. Radcliffe said he was in communications with his pump's manufacturer about ways to improve the security of its devices.

Altering a diabetic's insulin dosage could have fatal consequences. For example, a heavy user of insulin might require 80 units of insulin per day, whereas a child may be receiving doses measured in one-quarter units. Any variation in dosage could raise or lower blood-sugar levels in dangerous ways.

Radcliffe said he focused on his own insulin pump because it was at hand and because the cost of procuring other pumps--ranging in price from $5,000 to $10,000 each--was prohibitive.

Thankfully, not all medical devices can be wirelessly hacked--at least not with a $20 transmitter. For example, Radcliffe said he also wears a glucose monitor sensor on his body, which measure the conductivity of the fluid in his tissue to deduce blood sugar levels. "This thing beacons every five minutes what that value is," he said. But although he's been able to intercept the signal it sends, he hasn't been able to decode what it means. From a security standpoint, of course, that's a good thing.

Likewise, not all insulin pumps can be remotely hacked. "Other pump manufacturers that I've talked to, they're using SSL certificates to do communication ... and using more standardized, non-proprietary ways of communicating," he said. "When you go proprietary, you go with obscurity, and it never works."

Beyond using standardized--and thus tested--techniques for encryption and communication, what else would Radcliffe have done to harden the insulin pump against hacking? "First ... there should be some kind of verification. If something changes, the user should be made aware of it," he said. "Second, the devices need to have unique PINs or passcodes." Without knowing the PIN, an attacker would have a more difficult time altering the device's dosage. Another option, he said, would be to use infrared communications instead of RF. While lining up an infrared transmitter and receiver is more difficult for the device's user, such communications are much more difficult to spoof.

The vendors, contractors, and other outside parties with which you do business can create a serious security risk. Here's how to keep this threat in check. Also in the new, all-digital issue of Dark Reading: Why focusing solely on your own company's security ignores the bigger picture. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
Who Does What in Cybersecurity at the C-Level
Steve Zurier, Freelance Writer,  3/16/2018
The Case for Integrating Physical Security & Cybersecurity
Paul Kurtz, CEO & Cofounder, TruSTAR Technology,  3/20/2018
A Look at Cybercrime's Banal Nature
Curtis Franklin Jr., Executive Editor, Technical Content,  3/20/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.