Hacked Medical Device Sparks Congressional Inquiry

Legislators demand answers after a security researcher remotely controlled his own insulin pump using a $20 radio frequency transmitter at Black Hat.

Slideshow: RFID In Healthcare (click image for larger view and for full slideshow)
Two members of Congress have asked the Government Accountability Office (GAO) to review the Federal Communications Commissions approach to medical devices with wireless capabilities to ensure that the devices are safe, reliable, and secure.
The
letter
to the GAO, from Reps. Anna G. Eshoo (D-Calif.) and Edward J. Markey (D-Mass.)--both members of the House communications and technology subcommittee--was sparked by a
medical device hacking demonstration
earlier this month at the Black Hat conference in Las Vegas.
While most Black Hat presentations typically detail
exploits launched against others
or more benign forms of
hardware hacking
, security researcher Jerome Radcliffe actually hacked--live and onstage--his own insulin pump, which he relies on to subcutaneously administer multiple doses of insulin per day. Radcliffe, 33, said he was diagnosed with diabetes at age 22.
Next came the medical device hardware hacking. Specifically, Radcliffe reverse-engineered the wireless commands sent from the small controller that ships with his pump, and which is used to tell the pump what dosage of insulin to administer. After decoding the communications protocol, Radcliffe was able to program a small radio frequency (RF) transmitter--easily available for $100 new, or $20 for a used one on eBay--to remotely control his insulin pump. In his demonstration, Radcliffe showed how he could use the remote transmitter both to administer arbitrary insulin doses, as well as to disable the pump.
Hacking the pump wasnt easy, he said, but the fact that he was able to crack the communications at all was due to its not being properly protected or encrypted. Theres no passwords, no authentication. All you need is the serial number, said Radcliffe. Thats a concern, since the manufacturer of his insulin pump, which he declined to name, probably reused the technology for other medical devices, such as pacemakers. Radcliffe said he was in communications with his pumps manufacturer about ways to improve the security of its devices.
Altering a diabetics insulin dosage could have fatal consequences. For example, a heavy user of insulin might require 80 units of insulin per day, whereas a child may be receiving doses measured in one-quarter units. Any variation in dosage could raise or lower blood-sugar levels in dangerous ways.
Radcliffe said he focused on his own insulin pump because it was at hand and because the cost of procuring other pumps--ranging in price from $5,000 to $10,000 each--was prohibitive.
Thankfully, not all medical devices can be wirelessly hacked--at least not with a $20 transmitter. For example, Radcliffe said he also wears a glucose monitor sensor on his body, which measure the conductivity of the fluid in his tissue to deduce blood sugar levels. This thing beacons every five minutes what that value is, he said. But although hes been able to intercept the signal it sends, he hasnt been able to decode what it means. From a security standpoint, of course, thats a good thing.
Likewise, not all insulin pumps can be remotely hacked. Other pump manufacturers that Ive talked to, theyre using SSL certificates to do communication ... and using more standardized, non-proprietary ways of communicating, he said. When you go proprietary, you go with obscurity, and it never works.
Beyond using standardized--and thus tested--techniques for encryption and communication, what else would Radcliffe have done to harden the insulin pump against hacking? First ... there should be some kind of verification. If something changes, the user should be made aware of it, he said. Second, the devices need to have unique PINs or passcodes. Without knowing the PIN, an attacker would have a more difficult time altering the devices dosage. Another option, he said, would be to use infrared communications instead of RF. While lining up an infrared transmitter and receiver is more difficult for the devices user, such communications are much more difficult to spoof.
The vendors, contractors, and other outside parties with which you do business can create a serious security risk. Heres how to keep this threat in check. Also in the new, all-digital issue of Dark Reading: Why focusing solely on your own companys security ignores the bigger picture.
Download it now
. (Free registration required.)

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Hacked Medical Device Sparks Congressional Inquiry