8 ms·

Black Hat hacker details lethal wireless attack on insulin pumps

94 points by mrsebastian 15y ago

peterb 15y ago
Incredible. As a minimum I would have expected all communication to be encrypted.
- beaumartinez 15y ago
  But how secure would that be? It's security through obscurity. > Ultimately, these wireless control devices must simply be built with the assumption that hackers will eventually break in. > In the case of the insulin pump, it should contain hardware-level sanity checking.
  - deleted 15y ago
    [deleted]
  - StavrosK 15y ago
    Encryption is security through obscurity? Seriously?
    - Bootvis 15y ago
      Strictly speaking, yes. But it's the good kind (TM).
    - millerc 15y ago
      Yes. Tell me the algorithm you use and the bits from your decryption key, and we can decrypt everything. By the same token, the lock on your door is security by obscurity. Tell me the type of lock and the position of the 5 pins, and you're in. Take 5 seconds to communicate that over the phone, if you know what you're talking about.
      - burgerbrain 15y ago
        The phrase "security through obscurity" is a term of art that is defined such that secrecy of private key material does not count. By definition, you are incorrect. Now, if your security relies upon the attacker not knowing your encryption scheme, then yes. That is security through obscurity.
      - nate_meurer 15y ago
        To expound slightly on burgerbrain's comment, this phrase is universally used to refer to schemes whose security relies critically on the suppression of information about the system. The term simply does not apply to strong encryption with configurable keys. The term doesn't apply to door locks either, at least not in practice. If I were forever prevented from changing the locks on my house, then yes my security would depend critically on you never knowing about the key. In practice though, I can change the locks at will, and this is an effective remedy against the persistent threat posed by the release of the key. A good example of security though obsurity is the CSS system used on DVDs, which was designed such that once the key was discovered, the system became forever and irretrievably broken.
    - beaumartinez 15y ago
      I realise that the term Security Through Obscurity™ has a specific meaning (in the field of cryptography) which isn't the one I intended. However, you can crack any encryption scheme eventually. Encryption doesn't guarantee security—it simply makes the information harder to get at.
      - StavrosK 15y ago
        DRM is one thing, an encrypted wireless protocol is another. Think using WPA with user- or factory-settable keys to talk between the base/elements (I'm not sure how insulin pumps work).
- shabble 15y ago
  If it was, you run the risk of paramedics/different hospital not being able to get the key when you have some sort of critical incident, and need to adjust it. Or some super-secure nation (world?)-wide system that you can authenticate against and get the key for. (choke splutter) Given the state of most EPRs, you'd be lucky if your own doctor knew what the code was after a week or two.
  - peterb 15y ago
    This is for wireless communication to/from the device and not operating it from the control panel. For critical incidents paramedics would use their own tools (glucometer & needle).
    - uberuberuber 15y ago
      Most definitely. If the patient's presentation suggests hypoglycemia, it isn't uncommon for a medic to test the glucose level with their machine and administer oral glucose (D50 IV if obtunded) without even getting to a detailed physical that would reveal the implanted pump/monitor. If an amp of D50 failed to raise the blood sugar, then we'd start hunting for other causes like exogenous insulin overdose.
    - shabble 15y ago
      Hmm. Would the alternative method still be stable if someone had deliberately altered the internal pump to deliver in random, high-dosage spurts (or whatever else that would be hard to counter)? Of course, it starts getting a whole lot less stealthy then. Would paramedics/well-equippped ambulance ever go as far as trying to disable an internal pump before reaching the hospital? Edit: Also, what's the difference between the 'control panel' and the 'wireless [controller]'? My understanding was it was entirely implanted, with no external connections (and even recharged via induction loop, or surgical replacement). If that's the case, then all comms are, by necessity, wireless. NFC control might mitigate the threat a little, at least from a range perspective, but I can't see where there could otherwise be a difference.
hasslblad 15y ago
The parent article is doing it's round on the internet at the moment. It's linkbait. Scott Hanselman has a better rational breakdown of the article - http://www.hanselman.com/blog/HackersCanKillDiabeticsWithInsulinPumpsFromAHalfMileAwayUmNoFactsVsJournalisticFearMongering.aspx http://www.hanselman.com/blog/HackersCanKillDiabeticsWithIns...
- peterb 15y ago
  Thanks for the clarification. I hate it when I fall for this stuff.
  - timmyd 15y ago
    Tl;dr Scott's most relevant points: 1. "This is a key fob that looks like a car alarm beeper that some pump users use to discretely give themselves insulin doses. However, I feel the need to point out as a pump wearer myself that: Not every Insulin Pump has a remote control feature. Not every remote-controllable insulin pump has that feature turned on. Mine does not, for example." 2. "all he requires to perpetrate the hack is the target pump's serial number. This is like saying "I can open your garage door with a 3rd party garage door opener. Just give me the numbers off the side of your unit..." 3. If you are a diabetic on a pump who is concerned about this kind of thing, my suggestion is to turn off your pump's remote control feature (which is likely off anyway) and turn off your sensor radio when you are not wearing your CGM. Most of all, don't panic. Call the manufacturer and express your concern. In my experience, pump manufacturers do not mess around with this stuff. I'm not overly concerned.
    - burgerbrain 15y ago
      "2. "all he requires to perpetrate the hack is the target pump's serial number." Do we know how much entropy is in those? They could very well be sequential or date derived.
      - timmyd 15y ago
        "Do we know how much entropy is in those? They could very well be sequential or date derived." Even if entropy is low are - how are you going to randomly select a person, and know their serial ID ? Unless you know what units are distributed to what hospitals/doctors - at exact times - at exact shipments and then from the sample delivered know the exact unit given to any person at any particular time. Sure, if you know a "set of id's" you could try each one sequentially until you finally get a hit - but even then, you must somehow ensure the person being targeted has remote connection turned on. I'm pretty sure walking up to them and saying "oh, hai 'dere! ... plz turn on ur remotz connetz'n 4 me?" [ said in this voice - http://www.youtube.com/watch?v=xh_9QhRzJEs http://www.youtube.com/watch?v=xh_9QhRzJEs ] - is going to make them pretty suspicious. There's a lot of "ifs" in there and frankly - if your aim was kill them - it would be a lot faster to do it some other way because to actually get all these things to line up perfectly .... your chances are pretty slim.
StavrosK 15y ago
How is this a black hat hacker if all he did was expose the vulnerability, rather than exploit it?
- omh 15y ago
  "Black Hat" refers to the security conference, currently happening in Vegas.
  - jhamburger 15y ago
    Seems odd to call him a "black hat hacker" just for being at the conference. He could very well just attend all of the security-related conferences. The headline implies to me that he plans to use this exploit nefariously.
    - StavrosK 15y ago
      Ah, the conference is called "Black Hat". They mean "a hacker who was attending Black Hat".
  - StavrosK 15y ago
    I see, thanks for the clarification.
tomjen3 15y ago
Fortunately it is very difficult to pull of an attack with a medical device since you need to know the exact make and model and then find a way to exploit it.
- Hoff 15y ago
  Which then implies issues with replication and scale and consistency. That many of the devices are different, with different UIs, different firmware, different sets of cryptic icons and different and obscure buttons. Unfortunately, some of the underlying bugs can be common, due to code re-use; the same RT operating system might be used, for instance. Which means that the vendors might not even immediately know what's vulnerable to what. "Fortunate" is not the word I'd use for the mess that is the medical device industry.
shabble 15y ago
I've managed to hard-crash a generic infusion pump via its "output only, entirely isolated and secure" serial connection. Not wireless, and at least the Oh God I'm Broken buzzer worked, but still.
hermannj314 15y ago
Let's say you find out how to make planes safer. You can cut fatalities in half or something. And let's say doing that will drive up the cost of air travel by $100/ticket. Well, you did a good job and saved X lives, but you ended up killing X+k people that stopped flying planes and started driving cars. So you did a good thing, you made planes safer and then you ended up killing people. It would be great if somehow everytime planes got safer we made cars more expensive, but I don't know how that would work. Anyway, for some reason I thought about that reading this article and I figured how tremendously interesting risk-management must be in the medical device industry for the same types of reasons.
DougWebb 15y ago
Can someone tell me why these devices have a range of more than just a few feet? The point of having a remote control is to avoid having a control cable poking through your skin. A control interface with a range of just a few inches would suffice.
- nate_meurer 15y ago
  There's no good way to reliably limit the range of a wireless signal like this. A sufficiently sensitive receiver will always be able to eavesdrop from a distance far greater than that in the design use-case. If we don't want the signal intercepted, the answer is stronger encryption. That said, any potential vulnerability here appears to mostly spring from the remote control functionality, more than the remote reporting functionality. Here again, encryption is the answer.
- dfox 15y ago
  Probably economies of scale. Various low power RF chipsets for ISM bands with range in hundreds of feet with simple RF matching circuit are used in many different applications and thus surprisingly cheap. Limiting range of that is going to induce significant additional costs (either you have to modify antenna and it's matching circuit or use completely different silicon).
ams6110 15y ago
If a person is intent on killing another, I don't think encrypted wireless for his insulin pump is going to stand in the way.
- tintin 15y ago
  Well, if the only proof is a 'broken' pump...
jivejones 15y ago
Why would anyone try to figure something like this out? I don't think any real hackers are going around trying to figure out how to kill people, they want money or something else of value (not to say a life doesn't have value). Why as a community are we allowing things like this to happen, even worse, publicizing them and acting like its 733t and impressive. If something like this happened at anything other than the 'Black hat' security conference this wouldn't be alright.
- kristofferR 15y ago
  Research like this is really important. For all we know this type of hacking may already have been used to assasinate someone. Now that this is public there will be a huge pressure on the manufacturer to secure their devices as quickly as possible. If this hadn't been released, there would have been no pressure on the manufacturer to fix it and the assasins could theoretically proceed undetected for a long time.
- daeken 15y ago
  People figure these things out because it's fun. Simple as that. It's the same motivation behind me hacking the various bits of hardware sitting around me, including a number of health-related devices. It's simple curiosity, and sometimes that leads down a path of "well, if I could do this, what could a malicious actor do?" Sometimes that answer isn't a good one.

94 points by mrsebastian 15y ago

peterb 15y ago

Incredible. As a minimum I would have expected all communication to be encrypted.

beaumartinez 15y ago
But how secure would that be? It's security through obscurity. > Ultimately, these wireless control devices must simply be built with the assumption that hackers will eventually break in. > In the case of the insulin pump, it should contain hardware-level sanity checking.
- deleted 15y ago
  [deleted]
- StavrosK 15y ago
  Encryption is security through obscurity? Seriously?
  - Bootvis 15y ago
    Strictly speaking, yes. But it's the good kind (TM).
  - millerc 15y ago
    Yes. Tell me the algorithm you use and the bits from your decryption key, and we can decrypt everything. By the same token, the lock on your door is security by obscurity. Tell me the type of lock and the position of the 5 pins, and you're in. Take 5 seconds to communicate that over the phone, if you know what you're talking about.
    - burgerbrain 15y ago
      The phrase "security through obscurity" is a term of art that is defined such that secrecy of private key material does not count. By definition, you are incorrect. Now, if your security relies upon the attacker not knowing your encryption scheme, then yes. That is security through obscurity.
    - nate_meurer 15y ago
      To expound slightly on burgerbrain's comment, this phrase is universally used to refer to schemes whose security relies critically on the suppression of information about the system. The term simply does not apply to strong encryption with configurable keys. The term doesn't apply to door locks either, at least not in practice. If I were forever prevented from changing the locks on my house, then yes my security would depend critically on you never knowing about the key. In practice though, I can change the locks at will, and this is an effective remedy against the persistent threat posed by the release of the key. A good example of security though obsurity is the CSS system used on DVDs, which was designed such that once the key was discovered, the system became forever and irretrievably broken.
  - beaumartinez 15y ago
    I realise that the term Security Through Obscurity™ has a specific meaning (in the field of cryptography) which isn't the one I intended. However, you can crack any encryption scheme eventually. Encryption doesn't guarantee security—it simply makes the information harder to get at.
    - StavrosK 15y ago
      DRM is one thing, an encrypted wireless protocol is another. Think using WPA with user- or factory-settable keys to talk between the base/elements (I'm not sure how insulin pumps work).
shabble 15y ago
If it was, you run the risk of paramedics/different hospital not being able to get the key when you have some sort of critical incident, and need to adjust it. Or some super-secure nation (world?)-wide system that you can authenticate against and get the key for. (choke splutter) Given the state of most EPRs, you'd be lucky if your own doctor knew what the code was after a week or two.
- peterb 15y ago
  This is for wireless communication to/from the device and not operating it from the control panel. For critical incidents paramedics would use their own tools (glucometer & needle).
  - uberuberuber 15y ago
    Most definitely. If the patient's presentation suggests hypoglycemia, it isn't uncommon for a medic to test the glucose level with their machine and administer oral glucose (D50 IV if obtunded) without even getting to a detailed physical that would reveal the implanted pump/monitor. If an amp of D50 failed to raise the blood sugar, then we'd start hunting for other causes like exogenous insulin overdose.
  - shabble 15y ago
    Hmm. Would the alternative method still be stable if someone had deliberately altered the internal pump to deliver in random, high-dosage spurts (or whatever else that would be hard to counter)? Of course, it starts getting a whole lot less stealthy then. Would paramedics/well-equippped ambulance ever go as far as trying to disable an internal pump before reaching the hospital? Edit: Also, what's the difference between the 'control panel' and the 'wireless [controller]'? My understanding was it was entirely implanted, with no external connections (and even recharged via induction loop, or surgical replacement). If that's the case, then all comms are, by necessity, wireless. NFC control might mitigate the threat a little, at least from a range perspective, but I can't see where there could otherwise be a difference.

hasslblad 15y ago

The parent article is doing it's round on the internet at the moment. It's linkbait. Scott Hanselman has a better rational breakdown of the article - http://www.hanselman.com/blog/HackersCanKillDiabeticsWithInsulinPumpsFromAHalfMileAwayUmNoFactsVsJournalisticFearMongering.aspx http://www.hanselman.com/blog/HackersCanKillDiabeticsWithIns...

peterb 15y ago
Thanks for the clarification. I hate it when I fall for this stuff.
- timmyd 15y ago
  Tl;dr Scott's most relevant points: 1. "This is a key fob that looks like a car alarm beeper that some pump users use to discretely give themselves insulin doses. However, I feel the need to point out as a pump wearer myself that: Not every Insulin Pump has a remote control feature. Not every remote-controllable insulin pump has that feature turned on. Mine does not, for example." 2. "all he requires to perpetrate the hack is the target pump's serial number. This is like saying "I can open your garage door with a 3rd party garage door opener. Just give me the numbers off the side of your unit..." 3. If you are a diabetic on a pump who is concerned about this kind of thing, my suggestion is to turn off your pump's remote control feature (which is likely off anyway) and turn off your sensor radio when you are not wearing your CGM. Most of all, don't panic. Call the manufacturer and express your concern. In my experience, pump manufacturers do not mess around with this stuff. I'm not overly concerned.
  - burgerbrain 15y ago
    "2. "all he requires to perpetrate the hack is the target pump's serial number." Do we know how much entropy is in those? They could very well be sequential or date derived.
    - timmyd 15y ago
      "Do we know how much entropy is in those? They could very well be sequential or date derived." Even if entropy is low are - how are you going to randomly select a person, and know their serial ID ? Unless you know what units are distributed to what hospitals/doctors - at exact times - at exact shipments and then from the sample delivered know the exact unit given to any person at any particular time. Sure, if you know a "set of id's" you could try each one sequentially until you finally get a hit - but even then, you must somehow ensure the person being targeted has remote connection turned on. I'm pretty sure walking up to them and saying "oh, hai 'dere! ... plz turn on ur remotz connetz'n 4 me?" [ said in this voice - http://www.youtube.com/watch?v=xh_9QhRzJEs http://www.youtube.com/watch?v=xh_9QhRzJEs ] - is going to make them pretty suspicious. There's a lot of "ifs" in there and frankly - if your aim was kill them - it would be a lot faster to do it some other way because to actually get all these things to line up perfectly .... your chances are pretty slim.

StavrosK 15y ago

How is this a black hat hacker if all he did was expose the vulnerability, rather than exploit it?

omh 15y ago
"Black Hat" refers to the security conference, currently happening in Vegas.
- jhamburger 15y ago
  Seems odd to call him a "black hat hacker" just for being at the conference. He could very well just attend all of the security-related conferences. The headline implies to me that he plans to use this exploit nefariously.
  - StavrosK 15y ago
    Ah, the conference is called "Black Hat". They mean "a hacker who was attending Black Hat".
- StavrosK 15y ago
  I see, thanks for the clarification.

tomjen3 15y ago

Fortunately it is very difficult to pull of an attack with a medical device since you need to know the exact make and model and then find a way to exploit it.

Hoff 15y ago
Which then implies issues with replication and scale and consistency. That many of the devices are different, with different UIs, different firmware, different sets of cryptic icons and different and obscure buttons. Unfortunately, some of the underlying bugs can be common, due to code re-use; the same RT operating system might be used, for instance. Which means that the vendors might not even immediately know what's vulnerable to what. "Fortunate" is not the word I'd use for the mess that is the medical device industry.

shabble 15y ago

I've managed to hard-crash a generic infusion pump via its "output only, entirely isolated and secure" serial connection. Not wireless, and at least the Oh God I'm Broken buzzer worked, but still.

hermannj314 15y ago

Let's say you find out how to make planes safer. You can cut fatalities in half or something. And let's say doing that will drive up the cost of air travel by $100/ticket. Well, you did a good job and saved X lives, but you ended up killing X+k people that stopped flying planes and started driving cars. So you did a good thing, you made planes safer and then you ended up killing people. It would be great if somehow everytime planes got safer we made cars more expensive, but I don't know how that would work. Anyway, for some reason I thought about that reading this article and I figured how tremendously interesting risk-management must be in the medical device industry for the same types of reasons.

DougWebb 15y ago

Can someone tell me why these devices have a range of more than just a few feet? The point of having a remote control is to avoid having a control cable poking through your skin. A control interface with a range of just a few inches would suffice.

nate_meurer 15y ago
There's no good way to reliably limit the range of a wireless signal like this. A sufficiently sensitive receiver will always be able to eavesdrop from a distance far greater than that in the design use-case. If we don't want the signal intercepted, the answer is stronger encryption. That said, any potential vulnerability here appears to mostly spring from the remote control functionality, more than the remote reporting functionality. Here again, encryption is the answer.
dfox 15y ago
Probably economies of scale. Various low power RF chipsets for ISM bands with range in hundreds of feet with simple RF matching circuit are used in many different applications and thus surprisingly cheap. Limiting range of that is going to induce significant additional costs (either you have to modify antenna and it's matching circuit or use completely different silicon).

ams6110 15y ago

If a person is intent on killing another, I don't think encrypted wireless for his insulin pump is going to stand in the way.

tintin 15y ago
Well, if the only proof is a 'broken' pump...

jivejones 15y ago

Why would anyone try to figure something like this out? I don't think any real hackers are going around trying to figure out how to kill people, they want money or something else of value (not to say a life doesn't have value). Why as a community are we allowing things like this to happen, even worse, publicizing them and acting like its 733t and impressive. If something like this happened at anything other than the 'Black hat' security conference this wouldn't be alright.

kristofferR 15y ago
Research like this is really important. For all we know this type of hacking may already have been used to assasinate someone. Now that this is public there will be a huge pressure on the manufacturer to secure their devices as quickly as possible. If this hadn't been released, there would have been no pressure on the manufacturer to fix it and the assasins could theoretically proceed undetected for a long time.
daeken 15y ago
People figure these things out because it's fun. Simple as that. It's the same motivation behind me hacking the various bits of hardware sitting around me, including a number of health-related devices. It's simple curiosity, and sometimes that leads down a path of "well, if I could do this, what could a malicious actor do?" Sometimes that answer isn't a good one.