6 ms·

Insulin Pumps, Decapped Chips and Software Defined Radios

243 points by colinprince 8y ago

zaroth 8y ago
This is the story of Hacking the Omnipod, worthy of the front page of Wired. What an amazing story, and with so many incredible details along the way. The proprietary technique for reading contents of the locked chip is pretty fascinating in the context of Secure Enclave... The reverse engineering efforts were stymied for months by a bug in Omnipod’s CRC calculation! The perseverence in bringing this all to fruition is one of the best things I’ve woken up to on HN in a long while. Both my kids have T1D and use Omnipods. I’ve been looking forward to this for years. EDIT: Is it just me, or is a bad title significantly holding back this post? This story is worth way more than 23 points in 5 hours.
- GiorgioG 8y ago
  Have you looked @ Tandem's upcoming (2nd half of this year) ControlIQ for their X2 pump? It probably won't be as user-tweakable as OpenAPS. I couldn't convince myself to try OpenAPS for my 7 year old T1D. He recently switched to a Tandem pump and we are eagerly awaiting this software update.
  - beached_whale 8y ago
    This is more Loop. Does OpenAPS work with RileyLink and Omnipod now?
Odenwaelder 8y ago
I'd be interested how they test a Class C medical device that can kill you if you send the wrong commands. It surely is an amazing story and a great write-up, but I'd be wary of hacking insulin pumps, let alone using them.
- couchand 8y ago
  OTOH if the OEM can't code the CRC right, one might be better off packing their own parachute...
  - Odenwaelder 8y ago
    No, you're not better off. If you want to get a medical product like this licensed, you have to prove that you performed rigorous, multi-staged testing and document all your development including all emerging risks. I have participated in such licensing efforts and I doubt that an open source project has the means of providing such rigorous testing.
    - stefan_ 8y ago
      The result of this diligent process, of course, is how a broken CRC16 routine got shipped in this medical product. It's the most trivial thing. Copy a public domain CRC16 routine, add a unit test with a test vector.
      - joezydeco 8y ago
        Can you be sure it wasn’t a badly implemented form of obsfucatiom? It certainly slowed down the reverse engineers. If they didn’t get to the object code what would the next step have been? Cryptographic analysis?
        stefan_ 8y ago
        5 of the bits were never set in their "obfuscated" variant? If you want to obfuscate CRC16 you would just choose a randomized starting value.
        joezydeco 8y ago
        I didn't say it was implemented well. Perhaps they should changing shift operators would quietly change the values without any disturbance to checksum integrity.
cflat 8y ago
I wonder what would be necessary to spin up a device lab for proper TDD for the Loop? This is such an amazing story of classical "hacking". This is what makes technology fun.
cflat 8y ago
For those who aren't initiated in the world of T1D there is some amazing research coming out of the Faustman lab (MGH). There is both a promising cure (BCG vaccine), but also research which indicates that islet cells _do_ regenerate for decades after diagnoses. Islet cells are the part of the pancreas that generates insulin - needed to store/save sugar. That means, that the pancreas is constantly trying to repair the damage from the immune system. Let that sink in. Many diabetics suffer from 'random' lows or highs that can't be explained. Not because they aren't doing the right things - because they are - but more likely because their body is bringing islet cells online, producing extra insulin, then the immune system promptly kills them and knocks off the extra production. It's a war within the body! This is why Loop is sooo amazing and needed. You need a closed loop system that monitors and calibrates to these kinds of bio and environmental changes. Unexpected sprint for two blocks to get to class in time? no problem. Unexpected insulin production in the blood stream? no problem. This project is truly hero work. As a spouse to a T1D, life is sometimes scary. I, like many partners always have a backup plan in the back of our minds for that that fateful day of an extreme low will not be caught in time. It's scary. I for one, look forward to life with a bionic partner.
- beached_whale 8y ago
  I've been five years from a cure for a lot of years. The research on islet cells and cures like like watching the development of fusion power.
  - cflat 8y ago
    Totally agree. To be clear, I wasn’t trying to overhype the ‘cure’ but rather emphasize that the problem is way more complicated than many believe because of the islet regeneration. That’s why I’m a believer in the tech we have now because it’s the most viable path to long term management.
    - beached_whale 8y ago
      I'll get my hopes up when something is released. For now it's Loop and some other things. One trend that I don't like is fully automatic without a way to do manual override of all things. The variation between people and needs and even the same person is too great and hasn't been codified. Loop with Omnipod is somewhat on this side currently, but it is still new too.
loocsinus 8y ago
Too much insulin pumped into human body can literally kill a person. I don't think it is safe for hobbyist to hack a medical device like this.
- ron0c 8y ago
  Too much of anything is bad, that is the definition of 'too much'.
  - GiorgioG 8y ago
    An single extra unit (or less) of insulin can kill a type 1 diabetic. I don't expect non-diabetics to understand what that means, but it's not more than a few drops of insulin.
    - Adirael 8y ago
      What ISF does your kid have that a single unit will kill him/her? A single unit is barely noticeable on the graph for me. I've been using Loop for a few weeks now and the improvements in quality of life are so huge that any concerns I had about safety went away. Reading the docs, which are a great example on how documentation should be written, helped a lot with that too.
      - ineedasername 8y ago
        The typical level of sensitivity is absolutely in range for a single unit to produce a catastrophic event. It sounds like you may have a low sensitivity factor. The usual starting point for estimating this, along with using the "1800 rule", puts typical sensitivity around a drop of 50 points in blood sugar for every unit of insulin. This based on a weight around 65-70 kilos and 0.5 units/day/kilo. Of course it depends on other details too, even time of day. (My wife, who uses a medtronic pump, clocks in at right about this level but is less sensitive in mornings and more so later on. her pump is programmed for these time-dependent sensitivity fluctuations ) This level of sensitivity absolutely has lethal potential with a single-unit swing. If you're in the low end of normal at 75 points and take another unit dropping it to 25, this is plenty low to cause a person to pass out and thereby be unable to take corrective action, with lethal consequences, especially if the pump is still delivering a basal dose inching levels even lower. You might argue that careful people shouldn't encounter this situation, and you'd be right. But it still can and does happen, meaning a hobbyist setup that gets something even a little bit wrong has that same potential.
joshstrange 8y ago
My boyfriend is T1D and uses Omnipods so this is exciting news. He has also used a Dexcom (G6 I think) to monitor glucose levels. Unfortunately the Dexcom's are a bit pricy and so he can't always afford them. I have talked to him about Nightscout and closed loops or even semi-closed loops and while he is interested I haven't pursued it heavily because he isn't as technically inclined (or interested) as I am. If I were a T1D I would using some form of a closed loop system but I worry too much about bugs or problems he might run into that he wouldn't be able to solve or diagnose quickly. While nightscout is pretty mature and the pumps/monitors they've cracked fairly reliable I think he will probably just wait for some of the closed loop systems that are starting to enter the market (or are they still just semi-closed, or maybe they call them hybrid, I can't remember). Even then I'm sure it will be a few years yet until they are affordable enough.
- Guest42 8y ago
  If he is on Android I'd recommend xDrip+ for the CGM readings. It is really nice to have on the phone with control over the data and ability to upload if he wants. Also great to be able to snooze and set the alarms as desired.
  - Guest42 8y ago
    Similar program Spike for ios
deleted 8y ago
[deleted]
CamperBob2 8y ago
Gotta believe that at some point it's easier, as well as safer, to just design a new "open pod" from scratch. This was a truly heroic reverse-engineering effort, and the people behind it are more than equal to the task of designing a new product. (Or at least they'd better be.) The company can and will invalidate all of this hard work with the click of a mouse button. What's the long-term goal here?
Lowkeyloki 8y ago
Hats off to the author! This is an incredible story and you're made of stronger stuff than I. I'd be too afraid of the consequences of screwing up to attempt something like this.
looperhacks 8y ago
My girlfriend has a Medtronic 640g pump and I still hope that one day, she can use it to close the loop. I looked into the wireless communication (which can read the current glucose levels and send boluses), but apparently the protocol is encrypted. I would like to work at the protocol, but decrypting a wireless protocol seems too hard for me. But I still hope that some day, the Medtronic pumps will be hacked, too.

243 points by colinprince 8y ago

This is the story of Hacking the Omnipod, worthy of the front page of Wired. What an amazing story, and with so many incredible details along the way. The proprietary technique for reading contents of the locked chip is pretty fascinating in the context of Secure Enclave... The reverse engineering efforts were stymied for months by a bug in Omnipod’s CRC calculation! The perseverence in bringing this all to fruition is one of the best things I’ve woken up to on HN in a long while. Both my kids have T1D and use Omnipods. I’ve been looking forward to this for years. EDIT: Is it just me, or is a bad title significantly holding back this post? This story is worth way more than 23 points in 5 hours.

GiorgioG 8y ago
Have you looked @ Tandem's upcoming (2nd half of this year) ControlIQ for their X2 pump? It probably won't be as user-tweakable as OpenAPS. I couldn't convince myself to try OpenAPS for my 7 year old T1D. He recently switched to a Tandem pump and we are eagerly awaiting this software update.
- beached_whale 8y ago
  This is more Loop. Does OpenAPS work with RileyLink and Omnipod now?

Odenwaelder 8y ago

I'd be interested how they test a Class C medical device that can kill you if you send the wrong commands. It surely is an amazing story and a great write-up, but I'd be wary of hacking insulin pumps, let alone using them.

couchand 8y ago
OTOH if the OEM can't code the CRC right, one might be better off packing their own parachute...
- Odenwaelder 8y ago
  No, you're not better off. If you want to get a medical product like this licensed, you have to prove that you performed rigorous, multi-staged testing and document all your development including all emerging risks. I have participated in such licensing efforts and I doubt that an open source project has the means of providing such rigorous testing.
  - stefan_ 8y ago
    The result of this diligent process, of course, is how a broken CRC16 routine got shipped in this medical product. It's the most trivial thing. Copy a public domain CRC16 routine, add a unit test with a test vector.
    - joezydeco 8y ago
      Can you be sure it wasn’t a badly implemented form of obsfucatiom? It certainly slowed down the reverse engineers. If they didn’t get to the object code what would the next step have been? Cryptographic analysis?
      - stefan_ 8y ago
        5 of the bits were never set in their "obfuscated" variant? If you want to obfuscate CRC16 you would just choose a randomized starting value.
        joezydeco 8y ago
        I didn't say it was implemented well. Perhaps they should changing shift operators would quietly change the values without any disturbance to checksum integrity.

cflat 8y ago

I wonder what would be necessary to spin up a device lab for proper TDD for the Loop? This is such an amazing story of classical "hacking". This is what makes technology fun.

cflat 8y ago

For those who aren't initiated in the world of T1D there is some amazing research coming out of the Faustman lab (MGH). There is both a promising cure (BCG vaccine), but also research which indicates that islet cells _do_ regenerate for decades after diagnoses. Islet cells are the part of the pancreas that generates insulin - needed to store/save sugar. That means, that the pancreas is constantly trying to repair the damage from the immune system. Let that sink in. Many diabetics suffer from 'random' lows or highs that can't be explained. Not because they aren't doing the right things - because they are - but more likely because their body is bringing islet cells online, producing extra insulin, then the immune system promptly kills them and knocks off the extra production. It's a war within the body! This is why Loop is sooo amazing and needed. You need a closed loop system that monitors and calibrates to these kinds of bio and environmental changes. Unexpected sprint for two blocks to get to class in time? no problem. Unexpected insulin production in the blood stream? no problem. This project is truly hero work. As a spouse to a T1D, life is sometimes scary. I, like many partners always have a backup plan in the back of our minds for that that fateful day of an extreme low will not be caught in time. It's scary. I for one, look forward to life with a bionic partner.

beached_whale 8y ago
I've been five years from a cure for a lot of years. The research on islet cells and cures like like watching the development of fusion power.
- cflat 8y ago
  Totally agree. To be clear, I wasn’t trying to overhype the ‘cure’ but rather emphasize that the problem is way more complicated than many believe because of the islet regeneration. That’s why I’m a believer in the tech we have now because it’s the most viable path to long term management.
  - beached_whale 8y ago
    I'll get my hopes up when something is released. For now it's Loop and some other things. One trend that I don't like is fully automatic without a way to do manual override of all things. The variation between people and needs and even the same person is too great and hasn't been codified. Loop with Omnipod is somewhat on this side currently, but it is still new too.

loocsinus 8y ago

Too much insulin pumped into human body can literally kill a person. I don't think it is safe for hobbyist to hack a medical device like this.

ron0c 8y ago
Too much of anything is bad, that is the definition of 'too much'.
- GiorgioG 8y ago
  An single extra unit (or less) of insulin can kill a type 1 diabetic. I don't expect non-diabetics to understand what that means, but it's not more than a few drops of insulin.
  - Adirael 8y ago
    What ISF does your kid have that a single unit will kill him/her? A single unit is barely noticeable on the graph for me. I've been using Loop for a few weeks now and the improvements in quality of life are so huge that any concerns I had about safety went away. Reading the docs, which are a great example on how documentation should be written, helped a lot with that too.
    - ineedasername 8y ago
      The typical level of sensitivity is absolutely in range for a single unit to produce a catastrophic event. It sounds like you may have a low sensitivity factor. The usual starting point for estimating this, along with using the "1800 rule", puts typical sensitivity around a drop of 50 points in blood sugar for every unit of insulin. This based on a weight around 65-70 kilos and 0.5 units/day/kilo. Of course it depends on other details too, even time of day. (My wife, who uses a medtronic pump, clocks in at right about this level but is less sensitive in mornings and more so later on. her pump is programmed for these time-dependent sensitivity fluctuations ) This level of sensitivity absolutely has lethal potential with a single-unit swing. If you're in the low end of normal at 75 points and take another unit dropping it to 25, this is plenty low to cause a person to pass out and thereby be unable to take corrective action, with lethal consequences, especially if the pump is still delivering a basal dose inching levels even lower. You might argue that careful people shouldn't encounter this situation, and you'd be right. But it still can and does happen, meaning a hobbyist setup that gets something even a little bit wrong has that same potential.

joshstrange 8y ago

My boyfriend is T1D and uses Omnipods so this is exciting news. He has also used a Dexcom (G6 I think) to monitor glucose levels. Unfortunately the Dexcom's are a bit pricy and so he can't always afford them. I have talked to him about Nightscout and closed loops or even semi-closed loops and while he is interested I haven't pursued it heavily because he isn't as technically inclined (or interested) as I am. If I were a T1D I would using some form of a closed loop system but I worry too much about bugs or problems he might run into that he wouldn't be able to solve or diagnose quickly. While nightscout is pretty mature and the pumps/monitors they've cracked fairly reliable I think he will probably just wait for some of the closed loop systems that are starting to enter the market (or are they still just semi-closed, or maybe they call them hybrid, I can't remember). Even then I'm sure it will be a few years yet until they are affordable enough.

Guest42 8y ago
If he is on Android I'd recommend xDrip+ for the CGM readings. It is really nice to have on the phone with control over the data and ability to upload if he wants. Also great to be able to snooze and set the alarms as desired.
- Guest42 8y ago
  Similar program Spike for ios

deleted 8y ago

[deleted]

CamperBob2 8y ago

Gotta believe that at some point it's easier, as well as safer, to just design a new "open pod" from scratch. This was a truly heroic reverse-engineering effort, and the people behind it are more than equal to the task of designing a new product. (Or at least they'd better be.) The company can and will invalidate all of this hard work with the click of a mouse button. What's the long-term goal here?

Lowkeyloki 8y ago

Hats off to the author! This is an incredible story and you're made of stronger stuff than I. I'd be too afraid of the consequences of screwing up to attempt something like this.

looperhacks 8y ago

My girlfriend has a Medtronic 640g pump and I still hope that one day, she can use it to close the loop. I looked into the wireless communication (which can read the current glucose levels and send boluses), but apparently the protocol is encrypted. I would like to work at the protocol, but decrypting a wireless protocol seems too hard for me. But I still hope that some day, the Medtronic pumps will be hacked, too.