Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Getting Root On The Human Body

Black Hat researcher shows it is possible to remotely control a diabetic's insulin pump without person's knowledge

BLACK HAT USA 2011 -- Las Vegas -- A security researcher at Black Hat yesterday demonstrated how a hacker could remotely turn off a diabetic person's insulin pump without his knowledge. The findings came after months of research delving into the security of the portable medical devices that monitor diabetics' blood-sugar levels and those that deliver the body-chemistry-balancing insulin necessary to keep those levels in check throughout the day.

Click here for more of Dark Reading's Black Hat articles.

A SCADA security expert by day, Jerome Radcliffe himself is a diabetic and had been curious about the security of the devices that keep him alive. He looked into both continuous glucose monitors (CGMs) and insulin pumps within his research, with the findings from his pump-tinkering offering the most dramatic hackability.

According to Radcliffe, it is possible for a hacker to not only illicitly turn off the pump remotely, with the device only offering a small chirp as a response, but also to remotely manipulate any setting on the pump without it notifying the user at all.

"It's basically like having root on the device, and that's like having root on the chemistry of the human body," he said.

Diabetics today measure their glucose levels either by using blood-testing kits or a CGM that attaches a wire in the body and wirelessly transmits readings to a small pager-like device. Using those findings, a diabetic would then manually trigger the insulin pump he wears throughout the day to deliver the appropriate amount to keep blood-sugar levels stable. When a diabetic doesn't get enough insulin, he can suffer from a potentially fatal high-blood sugar level. But too much insulin can also cause fatally low-blood sugar, and once it is delivered to the body it can't be taken out.

The ability to fully control insulin delivery to a person is "scary" because of the precarious balance a diabetic must walk with the drug in order to stay alive.

In addition to his hack of the insulin pump, Radcliffe also learned how to listen into the transmissions of a CGM device using an oscilloscope. Though he wasn't able to fully hack the device in order to deliver precise false readings, he says the possibility is technically possible, and he was still able to disrupt and jam the device.

Radcliffe says that medical device manufacturers in this space need to be thinking of these types of vulnerabilities as the industry begins to move to support the Juvenile Diabetes Research Foundation's Artificial Pancreas Project. This project hopes to develop the toolset to the point where it is possible to link CGM data directly to insulin pumps to completely automate the insulin-delivery process. It sounds convenient, but if it is possible for hackers to own either device, the diabetic's life could be in grave danger.

"This makes the secure transmission of the CGM much more important," Radcliffe says. "We've got to think about how these technologies talk to each other."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16772
PUBLISHED: 2019-12-07
The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.to...
CVE-2019-9464
PUBLISHED: 2019-12-06
In various functions of RecentLocationApps.java, DevicePolicyManagerService.java, and RecognitionService.java, there is an incorrect warning indicating an app accessed the user's location. This could dissolve the trust in the platform's permission system, with no additional execution privileges need...
CVE-2019-2220
PUBLISHED: 2019-12-06
In checkOperation of AppOpsService.java, there is a possible bypass of user interaction requirements due to mishandling application suspend. This could lead to local information disclosure no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVers...
CVE-2019-2221
PUBLISHED: 2019-12-06
In hasActivityInVisibleTask of WindowProcessController.java there?s a possible bypass of user interaction requirements due to incorrect handling of top activities in INITIALIZING state. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...
CVE-2019-2222
PUBLISHED: 2019-12-06
n ihevcd_parse_slice_data of ihevcd_parse_slice.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android...