McAfee Claims Successful Insulin Pump Attack

judgecorp writes "Intel security subsidiary McAfee has claimed a successful wireless attack on insulin pumps that diabetics rely on to control blood sugar. While previous attempts to attack insulin pumps have met with mixed success, McAfee's Barnaby Jack says he has persuaded an insulin pump to deliver 45 days worth of insulin in one go, without triggering the pump's vibrating alert safety feature. All security experts still say that surgical implants are a benefit overall."

Comments

Murder by computer virus?

[quangdog]

Usual run-of-the-mill computer viruses and exploits don't usually harm one's health in the say that this has the potential to do. I mean, seriously - a virus could infect your insulin pump and kill you??

I know it's naïve to even ask, but would this be used in the wild? What special sort of sicko would do this for kicks?

Re:Murder by computer virus?

[Nidi62]

I know it's naïve to even ask, but would this be used in the wild? What special sort of sicko would do this for kicks?

The Darzhavna Sigurnost (Bulgarian Secret Police) and the KGB killed Georgi Markov on a bridge in London by stabbing him in the back with an umbrella that fired a ricin filled pellet. The ability to assassinate someone by infecting their insulin pump would be a goldmine.

Re:internet

[Samantha Wright]

Who needs a high-value target when you could hold any diabetic hostage for ransom? All it takes is a vulnerable wireless router with a sufficiently flexible transmitter, and the ability to scan for a nearby victim. Barring the implacable reality of device incompatibility, this is scary stuff.

Re:Wow

[dgatwood]

Try essentially impossible to investigate. How many people do you walk within twenty feet of in any given week? Any given year? Now imagine that any one of those people might have been the person who injected code that waits a predetermined period of time, does something bad, and then erases the location where the time delay is stored so that the original value cannot be recovered after the fact.... Or worse, overwrites the time delay with a value that implicates someone else.