6 ms·

Insulin pump hack delivers fatal dosage over the air

34 points by sehugg 15y ago

anigbrowl 15y ago
That's disturbing, to say the least.
- nknight 15y ago
  No, it was disturbing 20+ years ago when the possibility was first raised of these kinds of attacks. Today it's just expected. And depressing. The sectors that need to understand information security the most are the ones that have absolutely no grasp of it. I see no sign of that changing. Every time an improvement is made to the security of one system, somebody pops up with a new one that has utterly failed to learn the lessons of the last one.
  - noonespecial 15y ago
    Add to that "shoot the messenger-ism" (pointing out an exploit is the same as exploiting it nefariously; punishment as follows), plus a good dose of information paralysis (we can't add that security feature, we can't prove its safe), and finally a dash of "the device we have now is already approved, we'd have to do it again and it took 8 years last time"... You've got a recipe for some choice badness.
losethos 15y ago
Have to bust some time travel on yer asses. Now, you die! ---------- Not randomly picked: Now a man named Ananias, together with his wife Sapphira, also sold a piece of property. 2 With his wife’s full knowledge he kept back part of the money for himself, but brought the rest and put it at the apostles’ feet. 3 Then Peter said, “Ananias, how is it that Satan has so filled your heart that you have lied to the Holy Spirit and have kept for yourself some of the money you received for the land? 4 Didn’t it belong to you before it was sold? And after it was sold, wasn’t the money at your disposal? What made you think of doing such a thing? You have not lied just to human beings but to God.” 5 When Ananias heard this, he fell down and died. And great fear seized all who heard what had happened. 6 Then some young men came forward, wrapped up his body, and carried him out and buried him. 7 About three hours later his wife came in, not knowing what had happened. 8 Peter asked her, “Tell me, is this the price you and Ananias got for the land?” “Yes,” she said, “that is the price.” 9 Peter said to her, “How could you conspire to test the Spirit of the Lord? Listen! The feet of the men who buried your husband are at the door, and they will carry you out also.” 10 At that moment she fell down at his feet and died. Then the young men came in and, finding her dead, carried her out and buried her beside her husband. 11 Great fear seized the whole church and all who heard about these events. ----------- God says... C:\TEXT\BIBLE.TXT ed over, and the priests, in the presence of the people. 4:12 And the children of Reuben, and the children of Gad, and half the tribe of Manasseh, passed over armed before the children of Israel, as Moses spake unto them: 4:13 About forty thousand prepared for war passed over before the LORD unto battle, to the plains of Jericho. 4:14 On that day the LORD magnified Joshua in the sight of all Israel; and they feared him, as they feared Moses, all the days of his life. 4:15 And the LORD spake u
weego 15y ago
wasn't this debunked in the previous article on the same subject? http://news.ycombinator.com/item?id=2849716 http://news.ycombinator.com/item?id=2849716
- nknight 15y ago
  Where do you see a "debunking" there? I sure don't. Just a downplaying of the risks of the previous type of attack. This is a new, MUCH worse attack from a different researcher -- one with significant existing credibility, I might add.
ramidarigaz 15y ago
I find it deeply disturbing that there isn't some simple sanity check that prevents the device from delivering a fatal dose.
- shabble 15y ago
  I don't know about diabetes and insulin specifically, but what constitutes a fatal dose might not be easily calculable up-front. Obviously, there'll be a dose that will be deadly in all cases - the LD100. But the statistical "half the people given this dose" LD50 measure could easily vary by ± 100% or more. Things like metabolic rate, body-weight, route of administration, insulin tolerance, and relative blood-sugar levels could all factor into the dosing system, and I'm guessing the whole point of having it remotely configurable is to minimise the processing effort on the embedded chunk.
  - carbocation 15y ago
    I see that your self-asserted lack of domain-specific knowledge did not prevent you from giving the correct answer. Good.
- joezydeco 15y ago
  If the hacker could bypass the software on board and directly control the pumps, then no sanity check would help.
Groxx 15y ago
A bit frightening, and then you realize that this is entirely unsurprising. Why would they spend the money to develop it, drain the battery more quickly, and complicate the whole setup to make it secure when people aren't going around exploiting them? It's just capitalism at work, people. Even if someone does use this to kill off a handful of people, the cheaper devices might just have saved 100x more before secure models start appearing. Is it a fair trade-off? People haven't been demanding their insulin pumps be secure, so apparently they think it is (edit: yes yes, ignorance - they don't have to be, ya know. I'd get to know the thing keeping me alive, personally).
- eps 15y ago
  It needs not have a full-blown PKI/TLS stack. In fact it does not need the encryption, it only needs authentication of the exchange and the replay protection. These are as simple as numbering messages with increasing IDs and HMAC'ing them with pre-shared key (that in turn can be generated on one side and passed to another during the pairing sequence). This is cheap in terms of CPU usage. I doubt the lack of security provisions is due to the $ matters. It is far more likely to be just the developers' ignorance on the subject... which is entirely unsurprising, totally agree here.
  - Jach 15y ago
    How many "see, capitalism makes people take short cuts!" can be explained better by "the company was just ignorant about this case"?
    - Groxx 15y ago
      How many ignorance cases can be explained better by delegation in the face of cost? They're essentially one and the same most of the time - unlimited time / money lets you be infinitely careful, but you have competitors. But yes, capitalism tends to encourage people to make cuts where they will be least noticed - like this one, until one person got it in their head that they might be hackable. They were fine for years prior to that occurrence.
  - 15y ago
jcampbell1 15y ago
What is the simplest solution to this problem from a non-technical user's perspective? Maybe: "hold the '+' button for 3 seconds to initiate a sync."? I don't fully understand the problem. Are these things always open to wireless communication? My friend's syncs with USB.
- nknight 15y ago
  Different models will work differently, the ones this guy worked on are apparently always open, despite the manufacturer's intent. The simplest solution that doesn't make ridiculous assumptions about the time and place is to just do HMAC + replay prevention, as has already been mentioned. Don't do infosec half-assed, they'll just get in through the other cheek.
jakeonthemove 15y ago
I doubt anyone will use this to kill someone, but it's good that the vulnerability was discovered so soon - the next models will have protection. Besides, people have been killing each other for millions of years - doing it with a wireless device instead of a knife doesn't change much.
sp332 15y ago
I know security researchers must do this stuff by reflex, but this "insight" seems useless. It's not like this could happen by accident. So for this to happen, you would need someone to want to kill you, and there are simpler ways to do that.
- Retric 15y ago
  True, but few ways to kill someone will look like a software glitch.
jusob 15y ago
You an check out Barnaby' previous work on hacking ATMs: http://www.youtube.com/watch?v=htDMu7USsZQ http://www.youtube.com/watch?v=htDMu7USsZQ

34 points by sehugg 15y ago

anigbrowl 15y ago

That's disturbing, to say the least.

nknight 15y ago
No, it was disturbing 20+ years ago when the possibility was first raised of these kinds of attacks. Today it's just expected. And depressing. The sectors that need to understand information security the most are the ones that have absolutely no grasp of it. I see no sign of that changing. Every time an improvement is made to the security of one system, somebody pops up with a new one that has utterly failed to learn the lessons of the last one.
- noonespecial 15y ago
  Add to that "shoot the messenger-ism" (pointing out an exploit is the same as exploiting it nefariously; punishment as follows), plus a good dose of information paralysis (we can't add that security feature, we can't prove its safe), and finally a dash of "the device we have now is already approved, we'd have to do it again and it took 8 years last time"... You've got a recipe for some choice badness.

losethos 15y ago

Have to bust some time travel on yer asses. Now, you die! ---------- Not randomly picked: Now a man named Ananias, together with his wife Sapphira, also sold a piece of property. 2 With his wife’s full knowledge he kept back part of the money for himself, but brought the rest and put it at the apostles’ feet. 3 Then Peter said, “Ananias, how is it that Satan has so filled your heart that you have lied to the Holy Spirit and have kept for yourself some of the money you received for the land? 4 Didn’t it belong to you before it was sold? And after it was sold, wasn’t the money at your disposal? What made you think of doing such a thing? You have not lied just to human beings but to God.” 5 When Ananias heard this, he fell down and died. And great fear seized all who heard what had happened. 6 Then some young men came forward, wrapped up his body, and carried him out and buried him. 7 About three hours later his wife came in, not knowing what had happened. 8 Peter asked her, “Tell me, is this the price you and Ananias got for the land?” “Yes,” she said, “that is the price.” 9 Peter said to her, “How could you conspire to test the Spirit of the Lord? Listen! The feet of the men who buried your husband are at the door, and they will carry you out also.” 10 At that moment she fell down at his feet and died. Then the young men came in and, finding her dead, carried her out and buried her beside her husband. 11 Great fear seized the whole church and all who heard about these events. ----------- God says... C:\TEXT\BIBLE.TXT ed over, and the priests, in the presence of the people. 4:12 And the children of Reuben, and the children of Gad, and half the tribe of Manasseh, passed over armed before the children of Israel, as Moses spake unto them: 4:13 About forty thousand prepared for war passed over before the LORD unto battle, to the plains of Jericho. 4:14 On that day the LORD magnified Joshua in the sight of all Israel; and they feared him, as they feared Moses, all the days of his life. 4:15 And the LORD spake u

weego 15y ago

wasn't this debunked in the previous article on the same subject? http://news.ycombinator.com/item?id=2849716 http://news.ycombinator.com/item?id=2849716

nknight 15y ago
Where do you see a "debunking" there? I sure don't. Just a downplaying of the risks of the previous type of attack. This is a new, MUCH worse attack from a different researcher -- one with significant existing credibility, I might add.

ramidarigaz 15y ago

I find it deeply disturbing that there isn't some simple sanity check that prevents the device from delivering a fatal dose.

shabble 15y ago
I don't know about diabetes and insulin specifically, but what constitutes a fatal dose might not be easily calculable up-front. Obviously, there'll be a dose that will be deadly in all cases - the LD100. But the statistical "half the people given this dose" LD50 measure could easily vary by ± 100% or more. Things like metabolic rate, body-weight, route of administration, insulin tolerance, and relative blood-sugar levels could all factor into the dosing system, and I'm guessing the whole point of having it remotely configurable is to minimise the processing effort on the embedded chunk.
- carbocation 15y ago
  I see that your self-asserted lack of domain-specific knowledge did not prevent you from giving the correct answer. Good.
joezydeco 15y ago
If the hacker could bypass the software on board and directly control the pumps, then no sanity check would help.

Groxx 15y ago

A bit frightening, and then you realize that this is entirely unsurprising. Why would they spend the money to develop it, drain the battery more quickly, and complicate the whole setup to make it secure when people aren't going around exploiting them? It's just capitalism at work, people. Even if someone does use this to kill off a handful of people, the cheaper devices might just have saved 100x more before secure models start appearing. Is it a fair trade-off? People haven't been demanding their insulin pumps be secure, so apparently they think it is (edit: yes yes, ignorance - they don't have to be, ya know. I'd get to know the thing keeping me alive, personally).

eps 15y ago
It needs not have a full-blown PKI/TLS stack. In fact it does not need the encryption, it only needs authentication of the exchange and the replay protection. These are as simple as numbering messages with increasing IDs and HMAC'ing them with pre-shared key (that in turn can be generated on one side and passed to another during the pairing sequence). This is cheap in terms of CPU usage. I doubt the lack of security provisions is due to the $ matters. It is far more likely to be just the developers' ignorance on the subject... which is entirely unsurprising, totally agree here.
- Jach 15y ago
  How many "see, capitalism makes people take short cuts!" can be explained better by "the company was just ignorant about this case"?
  - Groxx 15y ago
    How many ignorance cases can be explained better by delegation in the face of cost? They're essentially one and the same most of the time - unlimited time / money lets you be infinitely careful, but you have competitors. But yes, capitalism tends to encourage people to make cuts where they will be least noticed - like this one, until one person got it in their head that they might be hackable. They were fine for years prior to that occurrence.
- 15y ago

jcampbell1 15y ago

What is the simplest solution to this problem from a non-technical user's perspective? Maybe: "hold the '+' button for 3 seconds to initiate a sync."? I don't fully understand the problem. Are these things always open to wireless communication? My friend's syncs with USB.

nknight 15y ago
Different models will work differently, the ones this guy worked on are apparently always open, despite the manufacturer's intent. The simplest solution that doesn't make ridiculous assumptions about the time and place is to just do HMAC + replay prevention, as has already been mentioned. Don't do infosec half-assed, they'll just get in through the other cheek.

jakeonthemove 15y ago

I doubt anyone will use this to kill someone, but it's good that the vulnerability was discovered so soon - the next models will have protection. Besides, people have been killing each other for millions of years - doing it with a wireless device instead of a knife doesn't change much.

sp332 15y ago

I know security researchers must do this stuff by reflex, but this "insight" seems useless. It's not like this could happen by accident. So for this to happen, you would need someone to want to kill you, and there are simpler ways to do that.

Retric 15y ago
True, but few ways to kill someone will look like a software glitch.

jusob 15y ago

You an check out Barnaby' previous work on hacking ATMs: http://www.youtube.com/watch?v=htDMu7USsZQ http://www.youtube.com/watch?v=htDMu7USsZQ