Slashdot Mirror
Johnson & Johnson Discloses That Its Insulin Pump Is Hackable (thestack.com)
An anonymous reader quotes a report from The Stack: Johnson and Johnson has revealed that its JJ Animas OneTouch Ping insulin pump is vulnerable to hackers, who could potentially force the device to overdose diabetic patients -- however, it declares that the risk of this happening is very low. Unnamed executives from the American multinational medical manufacturer said that they were taking the unprecedented step of warning customers about the vulnerability, particularly in light of recent controversies regarding attack vectors in cardiac equipment. In a letter to doctors and 114,000 patients, sent on Monday, the company wrote: "The probability of unauthorized access to the OneTouch Ping system is extremely low... It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the internet or to any external network." Even though the company's own technicians were able to hack the pump within a distance of 25 feet, Johnson and Johnson's chief medical officer Brian Levy observed that the hack would be extremely difficult to pull off, and said "We believe the OneTouch Ping system is safe and reliable. We urge patients to stay on the product."
Now people will hack into these just to prove they can. How many have to die because of J&J being cheap and not fixing them?
at least they made a public disclosure.
If both were to come to a bad end, there would be massive rejoicing...
Although it is unlikely that a hack will occur, hopefully J&J will look at security more thoroughly in the future. Obviously a person dying due to a faulty, or hacked insulin pump is less expensive than a recall and firmware update.
Maybe they could just post equipment in major cities that hack the new firmware onto the pumps! No recall, and probability of a hack goes down even further. What on earth could possibly go wrong?!
At least the quotes don't sound like they were written by a progressive, brand visionary, user centrist methodology PR company; they've admitted that there is a problem, and it wasn't spun to say it was in the best interest of the users (take note HP).
“The probability of unauthorized access to the OneTouch Ping system is extremely low It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the internet or to any external network.”
if someone was targeting you (especially a nation-state) and wanted to kill you, this would be a great way of doing it.
Anons need not reply. Questions end with a question mark.
I'm pretty sure most readers here will agree medical devices in critical applications need to be regulated and tested to a high degree. But the system was never designed around devices with internet connectivity and other communication technology. There isn't even a realistic way to upgrade the security or install patches on these devices without repeating the entire certification process in most cases. The medical community needs to update thier security in some sane and reasonable way. I mean they were almost unable to get 21st century databases (still don't in many cases) the security on devices should be the next big area to be reformed.
On one hand they are fulfilling their duty of care by disclosing this information to the public so they can make an informed decision; and
On the other hand they are protecting their shareholders by suggesting that the devices are safe and people can continue to use them.
It's a sad thing when the profit motive is put ahead of patient safety, however I suspect we will see a lot more of this as the 'Internet of Things' and 'eHealth' agendas collide on the desk of medical professionals who think they are experts but in fact are not.
Welcome to the impending risk of death by technology.
I'd like to point out, and this is refreshing, that because Johnson and Johnson disclosed this themselves, with some details, that the discussion on here is the right one. People are discussing severity, risk and impact.
Then the risk is not "extremely low". If it where that, they would just sweep their incompetence under the carpet...
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The pump shouldn't be connected to the internet... It doesn't need to be. It probably doesn't even need Bluetooth, but probably has some sort of remote diagnostic ability so it can dump log files.... But this whole thing is moot anyway. Didn't the FDA just approve a closed-loop artificial pancreas? It looks like a good time to upgrade, and feel better!
The pump uses a proprietary protocol on 900 MHz ISM band. It is nor Bluetooth neither uses TCP/IP. So to interfere with the device one has to be in the proximity and having a system to send fake commands: it's a lot like the problems one could have with garage door openers rather than the ones with IoT things. Luckily J&J didn't followed the easy route, mabye because the pumps has to run on a small 8 bit microcontroller and adding a TCP/IP stack was unfeasible.
That is nearly 8 meter. So you only need to be in proximity doing nothing reading a book while your conspicuously hidden laptop is doing the job, with scripts already prepared is trying. Then once the max dose of insuline is given you can simply safely go. Remember that the effect will not be *immediate* has if it was cyanide administered, the blood sugar will take a bit of time to be absorbed. So yeah. The risk of being charged is actually much lower than you think it is. If nobody catch you red handed with a laptop, then once symptom start to apepar just calmly head for the exit, and wipeout your laptop.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
I would skip the requirement for testing and instead just propose self-certification process
- DH for handshake.
- All communication encrypted with at least a AES256 key (from the DH handshake)
- Encryption key refresh time should be X minutes or Y bytes (whatever comes first).... (X and Y TBD)
- All packages sent containing counters to prevent a replay-attacks. ( ie similar parts to that in TCP used for reliability )
- When pairing devices new private/public keypairs should be generated on the fly via a HW based RNG ( rng requirements TBD )
- Pairing of devices should require physical contact between them. (i2c port or similar) for the public key sharing.
- Pairing must be done via storing a sha256 of the public key or storing the full public key of the paired device locally.
- If the communication channel for the devices is broken the vendor of the device will have to pay $5M in fines and $5M in finder's-fee to the security researcher that managed to exploit it. Vendor would also be responsible for updating or replacing all used devices in the field at no cost to the end user. ( disclosure method TBD )
If this were to happen i can see that there would be a big boom both in the electronics-business to provide SoC's suitable for the purpose, and can also see security-companies developing standardized stacks that then can be used by multiple companies..
What's happening right now is the worst possible situation where you have a crap-load of companies producing things and implementing their own security-schemes.. and they probably ignore the developers asking for a security-review of the stuff they wrote..
Can someone explain why it even has a radio communication system? Why not just have a USB port for reprogramming?
I appreciate that wireless is convenient, but it's also a huge attack surface, and it appears that if there was any authentication at all then it's extremely weak.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
The problem is that the device and communication layer are not separate. The system that FDA cares about most should be the pump and controller -- those have to be right for the device to function with sufficient accuracy and precision. Then the transit layer for communicating with the device should be a *separate* system serving as an information router with hair trigger firewall. If there's a problem with the communication layer security then you want to "remote disable" and only allow re-enable if you have physical access to the device. Yes, it means a hacker could, in principle disable the device connection (DOS attack). But a separation of the responsibilities means the pump controller can be designed to do the right thing (DTRT) if the comm system goes away ... some applications that could be turning off, or it could be staying the course.
Yes, although calling it an artificial pancreas is a lot like calling an iron lung an artificial lung. The device works in conjunction with an insulin pump and continuous glucose monitor, sampling every 5 minutes glucose levels and dosing insulin in response. It's a hybrid system though that only handles basal insulin while bolus insulin from meals needs to be manually specified, as well as periods of exercising.
The FDA specifically worked with MedTronic to accelerate the pre-market compliance testing that usually grinds development slowly.
As a type-2 diabetic, the system isn't designed for me yet, but it is exciting to see development in the area. Maybe one day I can just wear a watch like device that takes care of all my monitoring and dosing and missed injections and going hypo- or hyper-glycemic will be a thing of the past.
Can someone explain why it even has a radio communication system? Why not just have a USB port for reprogramming?
I appreciate that wireless is convenient, but it's also a huge attack surface, and it appears that if there was any authentication at all then it's extremely weak.
Sure, I can quote the article for you:
The Animas OneTouch Ping, which was launched in 2008, is sold with a wireless remote control that patients can use to order the pump to dose insulin so that they do not need access to the device itself, which is typically worn under clothing and can be awkward to reach.
Wait, so a major design change like adding wireless networking requires re-certification? Crazy!
Seriously, though, I think it makes sense to require re-certification. And, clearly, certification needs some sort of security component as well today. If the certification is unnecessarily onerous, though, that is something we should address.