Johnson & Johnson Discloses That Its Insulin Pump Is Hackable (thestack.com) 79
An anonymous reader quotes a report from The Stack: Johnson and Johnson has revealed that its JJ Animas OneTouch Ping insulin pump is vulnerable to hackers, who could potentially force the device to overdose diabetic patients -- however, it declares that the risk of this happening is very low. Unnamed executives from the American multinational medical manufacturer said that they were taking the unprecedented step of warning customers about the vulnerability, particularly in light of recent controversies regarding attack vectors in cardiac equipment. In a letter to doctors and 114,000 patients, sent on Monday, the company wrote: "The probability of unauthorized access to the OneTouch Ping system is extremely low... It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the internet or to any external network." Even though the company's own technicians were able to hack the pump within a distance of 25 feet, Johnson and Johnson's chief medical officer Brian Levy observed that the hack would be extremely difficult to pull off, and said "We believe the OneTouch Ping system is safe and reliable. We urge patients to stay on the product."
The gauntlet has been thrown (Score:2, Insightful)
Now people will hack into these just to prove they can. How many have to die because of J&J being cheap and not fixing them?
Re:The gauntlet has been thrown (Score:4, Insightful)
Re: (Score:2)
Considering the proximty and time required for a successful hack, the hacker would stand a high risk of being caught and charged with murder or attempted murder.
I'm not sure that's true. I don't see anything in the article saying that it takes very long to carry out, and 25 feet is well within the range of "sitting nearby at a coffee shop."
Additionally,
it is believed these attacks could be performed from one to two kilometers away, if not substantially further, using sufficient elevation and off-the-shelf radio transmission gear available to ham radio hobbyists.
Re: (Score:3)
Yikes! I wonder if that's a line-of-sight thing or if you could just drop every diabetic in a 2km range ... you know, for plausible deniability.
Re: (Score:3)
Yikes! I wonder if that's a line-of-sight thing or if you could just drop every diabetic in a 2km range
Only if every diabetic within range of your hacking device is using an insulin pump that your device can hack. Not all diabetics are on insulin, not all diabetics on insulin use insulin pumps, and not all diabetics using insulin pumps are all using the same model with similarly-hackable firmware.
Re: (Score:2)
It's of more concern to organisations with diabetic VIPs. Governments, businesses, organized crime (but I repeat myself).
I seem to recall that certain members of the US government have special medical devices with the radios disabled. Anyone who might be the target of assassination should be worried.
Re: (Score:2)
No. It's RF, so line of sight isn't required, but the article says the range is about 25 feet.
In addition, you have to capture packets from the remote in order to get the pairing key in order to spoof commands to the pump. Every pump in the vicinity would have to have been paired with the same remote in order for one broadcast to affect them all.
Re: (Score:2)
Considering the proximty and time required for a successful hack, the hacker would stand a high risk of being caught and charged with murder or attempted murder.
I'm not sure that's true. I don't see anything in the article saying that it takes very long to carry out, and 25 feet is well within the range of "sitting nearby at a coffee shop."
Additionally,
it is believed these attacks could be performed from one to two kilometers away, if not substantially further, using sufficient elevation and off-the-shelf radio transmission gear available to ham radio hobbyists.
Both those situations present a pretty good risk of getting caught. Only so many people in those areas at a given time would have the knowledge of the victim and the capability.
Re: (Score:2)
You mean like North Korea is trying to do with that plutonium hack...
Re: (Score:2)
"Time required" is dependent on how often the devices generate the packets you'd need to hack. Odds are if you park yourself in the middle of a food court or restaurant you'll find a few victims quite easily since pump users need to tweak settings when they sit down to eat.
As far as proximity or someone being smart enough to do it... it doesn't sound like rocket science and I wouldn't bet against it. A laptop with a $10 RTL2832U/R820T2 dongle i
Re: (Score:2)
p>As far as proximity or someone being smart enough to do it... it doesn't sound like rocket science and I wouldn't bet against it. A laptop with a $10 RTL2832U/R820T2 dongle is enough to mess with 900MHz signals, so if someone comes up with a script then it's a good bet that a bored dipshit would find it funny to fire it up somewhere.
Funny that type of thing never seems to happen in the real world. Its not like there aren't a lot of opportunities to pull off similar life threatening hacks already, be it cars, medical devices, medical devices. etc. Or even non life threatening ones. Yet I keep hearing this talk like there are these stereotypical bored computer geeks are roving the streets with hacking gear looking to pull off this type of thing.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
That we know of.
But no, I don't think it's happening much yet. Their wireless tech is still quite primitive. I don't think it's going to be a real problem until manufacturers start putting these things on the Internet and open them up to the same people turning IP cameras into botnets. They'll be adding smartphone integration first, of course (most of these devices upload data via USB currently), but inevitably they'll add wifi integration. If
Re: (Score:2)
Re: (Score:2)
If people are dying because of hacked devices, we'd be hearing about it.
Maybe not....
They hacked the hearing aids too..
Re:The gauntlet has been thrown (Score:4, Informative)
I wouldn't be so sure. Consider what evidence is left on a device that's been hacked remotely. (I don't know at all, just speculating of course.)
What if a hacked command to send a lethal overdose looks exactly like the user pressing the buttons to deliver the same dose? Any legal risk minded investigation team is going to be falling over themselves to label that either an "accidental" overdose or perhaps even a suicide rather than let it go down as a security issue in their device that allowed someone to murder the user at a distance by twiddling some buttons. My (cynical) guess would be if the security of an embedded device is such that it can take unauthorized commands over the wire, odds are pretty good it's not going to successfully audit what happened in any meaningful way.
If it happened en mass, sure. People would put it together, and we'd get a Made for Lifetime movie about the intrepid hero who wouldn't accept the party line and pushed through to discover the horrible truth... Or somesuch drek... But one or two, here & there? We've all seen the bit about automotive recalls at the beginning of that movie we don't talk about, right?
Re: (Score:2)
Re: The gauntlet has been thrown (Score:1)
Re: (Score:2)
That's because besides the need for some hardware, technical expertese and the right location, you'd also need a psychopathic murderer who can't think of an easier way to kill people.
Re: (Score:2)
ToF protection to make NFC truly NFC is still very rare, even though the silicon cost is negligible and it should have been part of the standard from day 1, most of the time a larger antenna is enough to increase distance.
Re: (Score:2)
Today there is no excuse since the hardware is far more capable.
On the contrary (Score:2)
Re: (Score:2)
Re: (Score:2)
Proximity required? Like, say, in a school cafeteria where some geek prankster who doesn't even know what damage he might do could give it a try?
Kids don't give a shit about consequences. But fortunately, kids being killed by improper medial equipment cause enough of a stir to get things done. I guess some minor will have to croak so we see something being done, but hey, at least it's not going to kill someone whose education already costed an arm and a leg. From an economic point of view, better some snott
Re: (Score:2)
Re: (Score:2)
Because in direct confrontations, geeks are usually not really the ones that come out on top.
Re: (Score:2)
Re: (Score:2)
And now we have one more. Yay.
Re: (Score:2)
Actually, the effort required to do this hack is quite high and the risks to the patient is quite low from this hack.
An overdoes of insulin is indeed dangerous and can cause death if left untreated for an extended time, but diagnosis is easy (a finger prick blood glucose test) and treatment is easier (Drink some juice or a sugared soda).
So with the extremely high technical requirements to perform the hack from a distance, especially without the victim knowing and the ease of diagnosis and treatment from t
Re: (Score:2)
Re: (Score:2)
Actually, the effort required to do this hack is quite high and the risks to the patient is quite low from this hack.
I'm with J&J, It's just NOT worth the replacement risks.... General Anesthesia has significant risks, much more than somebody hacking your insulin pump on the subway.
I am with JJ but this does not require surgery to replace.
It is external and connects to the body with an infusion set with standard Luer connector.
I can see a software update to the paired system.
Two devices a blood glucose meter and the infuser.
Re: (Score:2)
Not it isn't.
Actually, I don't know for sure either way, but you have to be a fool to bet that it is. History has shown very consistently that security holes in any given product are always easier to exploit than the vendor will admit to, and they become less and less difficult as time passes without a proper fix.
Off hand, from the attack demo video the guy is running it off a Pi with a USB RF dongle... probably an obvious application of RTL-SDR.
Re: (Score:2)
With that in mind maybe he could have one installed in HIM. Bonus points if he walks into a Defcon wearing a name badge.
A majority of board members joining him would show the company is truly committed to the product...
I would imagine a few of the biggest investors would also want in on the action, just to bolster stock prices.
</delusion>
Re: (Score:2)
Now people will hack into these just to prove they can.
How many have to die because of J&J being cheap and not fixing them?
So these pumps are where? Google google google.
Cool it is outside the body and connected by a simple Infusion set with standard Luer connector.
That makes it easy to replace.
All these bluetooth family of short distance devices are a risk...
time will tell what JJ does.
Re: (Score:2)
While the problem does need to be fixed, it's highly unlikely that anyone will die due to a random hacker messing with their device.
Despite the Hollywood movie stereotype of evil hackers who unleash chaos and destruction on the world, the truth is that most hackers are just curious about how things work and have no desire to cause damage, much less kill people. The closest thing that exists to the stereotype are the hackers who are trying to make a profit without regard to the cost to others, but there's n
Re: (Score:2)
at least they made a public disclosure.
EXACTLY.
After all, EVERYTHING is hackable.
Just don't say you weren't warned by J & J.
Re: (Score:2)
No. Bullshit. Not everything is hackable. Not by a long shot. And certainly not without direct physical access.
Want proof? Here's my laptop. It comes with a physical switch that turns WiFi off. Try to hack it remotely. Oh, you might be able when I turn WiFi on, true, but how about I only do that in a controlled environment, with shielded walls surrounding me and the laptop's peer so I can ensure that only these two devices communicate while WiFi is turned on, and outside the controlled environment, I turn a
Re: (Score:2)
Re: (Score:2)
You think that recertification will be less expensive after someone died?
Re: (Score:2)
It might be honestly. Might be able to convince the FDA to agree to an accelerated process because of the emergency situation. Never let a good catastrophe go to waste...
Probabaly easier to sell the cost to stock holders and others who don't get security too when they "have to" do it, as opposed to spending just proactively suring up security that hasn't been broken yet, at least not practically for reals. Anyone in infosec knows firefighting is easier to get funding for than prevention...
Re: (Score:2)
Sadly this is absolutely logical and most likely correct. Thanks, now I can go home depressed...
Re: (Score:2)
Sadly this is absolutely logical and most likely correct. Thanks, now I can go home depressed...
Amen.
Human nature is bug in every design implementation.
Perhaps that makes it Art.
Do Trump AND Hillary use it? (Score:2)
If both were to come to a bad end, there would be massive rejoicing...
Re: (Score:3)
Not really. Have you even looked at the VP candidates.
*TODO: Insert Subject* (Score:1)
Although it is unlikely that a hack will occur, hopefully J&J will look at security more thoroughly in the future. Obviously a person dying due to a faulty, or hacked insulin pump is less expensive than a recall and firmware update.
Maybe they could just post equipment in major cities that hack the new firmware onto the pumps! No recall, and probability of a hack goes down even further. What on earth could possibly go wrong?!
At least the quotes don't sound like they were written by a progressive, brand
yes, no and kinda (Score:2)
“The probability of unauthorized access to the OneTouch Ping system is extremely low It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the internet or to any external network.”
if someone was targeting you (especially a nation-state) and wanted to kill you, this would be a great way of doing it.
Re: (Score:2)
My wife's Medtronic Insulin pump requires actually pushing an acknowledgment button before it will deliver insulin.
Re: (Score:2)
that's nice but when it's hacked to deliver the wrong amount?
Re:yes, no and kinda (Score:4, Informative)
Well, it gets the reading remotely from the blood glucose meter and calculates the dose. It then displays the amount of insulin for the bolus delivery. You look at it and generally, if you've been using a pump or doing injections you know about what range you usually end up taking. If it's off a lot it should be obvious as long as you're actually alert. When it comes to things like that being observant is important.
Re: (Score:2)
Ah...anonymous coward, I understand that while anything is possible, some things are so remotely possible as to be very nearly impossible. There is no way to make something absolutely impossible to hack. You simply make it so hard that people get tired and go find the low hanging fruit.
Re: (Score:2)
Well, it gets the reading remotely from the blood glucose meter and calculates the dose. It then displays the amount of insulin for the bolus delivery. You look at it and generally, if you've been using a pump or doing injections you know about what range you usually end up taking. If it's off a lot it should be obvious as long as you're actually alert. When it comes to things like that being observant is important.
Using the bolus wizard is one path through the menus but is not the only one. If you have remotely connected to the pump you can tell it to deliver without requiring the user to press any buttons. Medtronic have turned off some of the remote ability with the firmware in their later pumps, unfortunately that has also denied access to projects such as OpenAPS. I would like to see some ability to pair known devices together rather than cutting off all access completely.
Re: (Score:2)
I know my wife doesn't use the remote. She has one but it's just too easy to pull the pump up, look at it and okay the dose. The remote adds complexity and of course while hacking would not be that easy it could be done.
Re: (Score:2)
My wife just switched to an OmniPod, which doesn't have a UI of any sort on the pump unit itself. The controller commnunicates with the pump using what I believe is 433MHz FSK coding, and quite frankly I'm a terrified to start playing with a 433MHz capture board within range of her because I have a bad feeling about what I'll find...
That main thing that prevents a bolus overdose attack is that
Part of the problem is archaic compliance testing (Score:2, Interesting)
Re: (Score:2)
Re: (Score:2)
Yes, although calling it an artificial pancreas is a lot like calling an iron lung an artificial lung. The device works in conjunction with an insulin pump and continuous glucose monitor, sampling every 5 minutes glucose levels and dosing insulin in response. It's a hybrid system though that only handles basal insulin while bolus insulin from meals needs to be manually specified, as well as periods of exercising.
The FDA specifically worked with
Re: (Score:2)
Re: (Score:2)
Can someone explain why it even has a radio communication system? Why not just have a USB port for reprogramming?
I appreciate that wireless is convenient, but it's also a huge attack surface, and it appears that if there was any authentication at all then it's extremely weak.
Playing both sides? (Score:2)
On one hand they are fulfilling their duty of care by disclosing this information to the public so they can make an informed decision; and
On the other hand they are protecting their shareholders by suggesting that the devices are safe and people can continue to use them.
It's a sad thing when the profit motive is put ahead of patient safety, however I suspect we will see a lot more of this as the 'Internet of Things' and 'eHealth' agendas collide on the desk of medical
The Right Discussion (Score:1)
I'd like to point out, and this is refreshing, that because Johnson and Johnson disclosed this themselves, with some details, that the discussion on here is the right one. People are discussing severity, risk and impact.
If they inform customers... (Score:2)
Then the risk is not "extremely low". If it where that, they would just sweep their incompetence under the carpet...