Getting Root On The Human Body

Black Hat researcher shows it is possible to remotely control a diabetics insulin pump without persons knowledge

BLACK HAT USA 2011 -- Las Vegas -- A security researcher at Black Hat yesterday demonstrated how a hacker could remotely turn off a diabetic persons insulin pump without his knowledge. The findings came after months of research delving into the security of the portable medical devices that monitor diabetics blood-sugar levels and those that deliver the body-chemistry-balancing insulin necessary to keep those levels in check throughout the day.
A SCADA security expert by day, Jerome Radcliffe himself is a diabetic and had been curious about the security of the devices that keep him alive. He looked into both continuous glucose monitors (CGMs) and insulin pumps within his research, with the findings from his pump-tinkering offering the most dramatic hackability.
According to Radcliffe, it is possible for a hacker to not only illicitly turn off the pump remotely, with the device only offering a small chirp as a response, but also to remotely manipulate any setting on the pump without it notifying the user at all.
Its basically like having root on the device, and thats like having root on the chemistry of the human body, he said.
Diabetics today measure their glucose levels either by using blood-testing kits or a CGM that attaches a wire in the body and wirelessly transmits readings to a small pager-like device. Using those findings, a diabetic would then manually trigger the insulin pump he wears throughout the day to deliver the appropriate amount to keep blood-sugar levels stable. When a diabetic doesnt get enough insulin, he can suffer from a potentially fatal high-blood sugar level. But too much insulin can also cause fatally low-blood sugar, and once it is delivered to the body it cant be taken out.
The ability to fully control insulin delivery to a person is scary because of the precarious balance a diabetic must walk with the drug in order to stay alive.
In addition to his hack of the insulin pump, Radcliffe also learned how to listen into the transmissions of a CGM device using an oscilloscope. Though he wasnt able to fully hack the device in order to deliver precise false readings, he says the possibility is technically possible, and he was still able to disrupt and jam the device.
Radcliffe says that medical device manufacturers in this space need to be thinking of these types of vulnerabilities as the industry begins to move to support the Juvenile Diabetes Research Foundations Artificial Pancreas Project. This project hopes to develop the toolset to the point where it is possible to link CGM data directly to insulin pumps to completely automate the insulin-delivery process. It sounds convenient, but if it is possible for hackers to own either device, the diabetics life could be in grave danger.
This makes the secure transmission of the CGM much more important, Radcliffe says. Weve got to think about how these technologies talk to each other.
Have a comment on this story? Please click Discuss below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Getting Root On The Human Body