5 ms·

So would this preclude anyone with a medical device form working there? say like an insulin pump?

by sdmike1 8y ago

wild_preference 8y ago
Which part of the article makes it sound like they could be talking about insulin pumps?
- milesvp 8y ago
  The part where insulin pumps are electronic equipment. It's becomming more and more common for devices like insulin pumps to upload data automatically to other devices. It'd be hard to get location data I think from glucose logs. But SoCs are getting more and more features, and an insulin pump that also tracks steps is not a huge stretch of the imagination, especially if the power draw was tiny.
  - always_good 8y ago
    > The part where insulin pumps are electronic equipment. That's not a part of the article. The article and memo clearly focus on geolocation data. Not a feature I can find in insulin pumps after a cursory search.
    - acct1771 8y ago
      Not by default. An attacker could change that.
      - bpicolo 8y ago
        An attacker in the building could just keep geolocation on on their regular device. That's not the point of this exercise
- sdmike1 8y ago
  In SCIFs all non-approved transmitting devices are banned except for medical devices. So when you consider new ones use wirelessly communicate with continuous glucose monitors (mine uses 802.15.4) which it then uses to adjust delivery of insulin. This feedback loop has been shown to give measurably better outcomes so it not something I would want to disable. Toss in that they connect via USB for reporting upload they become a potentially attractive platform for data exfil.
astura 8y ago
If you insulin pump has alway-on GPS tracking, then yes. If you work in a secure facility consider the "insulin only" model.
- sdmike1 8y ago
  It doesn't have GPS tracking but it does have wireless communication with a continuous glucose monitor which it uses to adjust delivery of insulin which gives measurably better outcomes. It even connects to a computer via USB. In SCIFs all non-approved transmitting devices are banned, so if you are an attacker an insulin pump has a potentially excellent exfil method.

So would this preclude anyone with a medical device form working there? say like an insulin pump?

wild_preference 8y ago

Which part of the article makes it sound like they could be talking about insulin pumps?

milesvp 8y ago
The part where insulin pumps are electronic equipment. It's becomming more and more common for devices like insulin pumps to upload data automatically to other devices. It'd be hard to get location data I think from glucose logs. But SoCs are getting more and more features, and an insulin pump that also tracks steps is not a huge stretch of the imagination, especially if the power draw was tiny.
- always_good 8y ago
  > The part where insulin pumps are electronic equipment. That's not a part of the article. The article and memo clearly focus on geolocation data. Not a feature I can find in insulin pumps after a cursory search.
  - acct1771 8y ago
    Not by default. An attacker could change that.
    - bpicolo 8y ago
      An attacker in the building could just keep geolocation on on their regular device. That's not the point of this exercise
sdmike1 8y ago
In SCIFs all non-approved transmitting devices are banned except for medical devices. So when you consider new ones use wirelessly communicate with continuous glucose monitors (mine uses 802.15.4) which it then uses to adjust delivery of insulin. This feedback loop has been shown to give measurably better outcomes so it not something I would want to disable. Toss in that they connect via USB for reporting upload they become a potentially attractive platform for data exfil.

astura 8y ago

If you insulin pump has alway-on GPS tracking, then yes. If you work in a secure facility consider the "insulin only" model.

sdmike1 8y ago
It doesn't have GPS tracking but it does have wireless communication with a continuous glucose monitor which it uses to adjust delivery of insulin which gives measurably better outcomes. It even connects to a computer via USB. In SCIFs all non-approved transmitting devices are banned, so if you are an attacker an insulin pump has a potentially excellent exfil method.