Medtronic Pumps are Vulnerable to Hacking. Be Aware.
I have copy and pasted the article into the blog but you can click HERE to read it at it's original site.
Medtronic Pumps are Vulnerable to Hacking
Some Medtronic Inc. (MDT) insulin pumps are vulnerable to a hacking attack that could let someone break into the devices from hundreds of feet away, disable security alarms and dump insulin directly into diabetics’ bloodstreams, according to a computer-security researcher at McAfee Inc.
Barnaby Jack, who works as a professional hacker for McAfee, said he can remotely control several types of Medtronic pumps. After first discussing the vulnerability last year at a small hacker conference in Florida, he has discovered more ways to exploit the weakness, including overriding security features such as vibration warnings.
Barnaby Jack, a research architect for McAfee Inc., sits for a photograph in San Francisco. Photographer: David Paul Morris/Bloomberg
March 1 (Bloomberg) -- Some Medtronic Inc. insulin pumps are vulnerable to a hacking attack that could let someone break into the devices from hundreds of feet away, disable security alarms and dump insulin directly into diabetics’ bloodstreams, according to a computer-security researcher at McAfee Inc. Jon Erlichman reports on Bloomberg Television's "InsideTrack." (Source: Bloomberg)
Barnaby Jack, a research architect for McAfee Inc., stands for a photograph with a mannequin equipped with an insulin pump and a bag filled with water simulating a pancreas in San Francisco. Photographer: David Paul Morris/Bloomberg
A mannequin stands equipped with an insulin pump and a bag filled with water, simulating a pancreas, during a hacking demonstration of the pump in San Francisco. Photographer: David Paul Morris/Bloomberg
Jack, who plans to spotlight the flaw this week at the RSA security conference in San Francisco, is trying to increase awareness of the risks of medical devices. Insulin pumps are pager-sized gadgets that diabetics wear to dispense the lifesaving hormone into the body. Such technology is increasingly relying on wireless communications, making it vulnerable to the same hacking that afflicts personal computers.
“These are computers that are just as exploitable as your PC or Mac, but they’re not looked at as often,” Jack, 34, said in an interview. “When you actually look at these devices, the security vulnerabilities are quite shocking.”
Medtronic has responded to the risks by hiring security teams from three organizations to inspect its products. It’s also coordinating with the Department of Homeland Security to make changes, which may take years.
“Medtronic takes patient safety and device security very seriously,” the Minneapolis-based company said in a statement.
Medical-device security first became a flash point last year, when Jay Radcliffe, a diabetic patient in Idaho, showed that hackers could manipulate the best-selling brand of pump he used. Radcliffe got the attention of lawmakers, who pressed the Government Accountability Office to investigate whether the industry’s cybersecurity rules are tough enough. The report from that probe is due in July.
Jack’s work takes what Radcliffe did a step further. He has discovered a way to scan a public space from as much as 300 feet away, find vulnerable pumps made by Medtronic and force them to dispense fatal insulin doses. He said he doesn’t need to be close to the victim or do any kind of extra surveillance to acquire the serial number, as Radcliffe did.
There have been few public studies of medical devices’ susceptibility to computer attacks. Research from a consortium of academics in 2008 found that a popular pacemaker- defibrillator product could be remotely reprogrammed to deliver deadly shocks. The U.S. Food and Drug Administration, which regulates medical devices, has warned that any devices with wireless capabilities can be subject to breaches.
“Current adverse event data do not indicate that breaches of device security measures is a widespread problem,” the agency said in a statement. “However, we continue to closely monitor for safety or security problems.”
The work of Radcliffe and Jack is bringing public attention to flaws that have been discussed privately for years, said Nathanael Paul, a Type 1 diabetic and computer-security researcher specializing in medical devices.
Paul, who works with Oak Ridge National Laboratory, said his group had replicated many of the same findings in 2010 -- before Radcliffe went public with his research -- and presented them to the FDA and industry officials. It can take years for changes in medical devices to hit the market because of long product cycles and regulatory roadblocks, he said.
The risk of such research is that it could inspire others to pursue real-world attacks. Still, the technical skill required means that mass attacks are unlikely, Jack said. The real problem is a lack of foresight by device makers, he said.
“They didn’t foresee anyone breaking open these devices, spilling the code and figuring out what’s going on in there,” Jack said.
I'm the proud mother to three very sweet little girls. Morgan is 6 and Sydney is 8. Our latest sweet, little Hadlee is 1 1/2. Sydney has had Type 1 Diabetes since Feb. 2008. Much of my blogging deals with my musings as I attempt to parent a child with Type 1. I also use my blog to share our laughs and tears and to commiserate with my friends and family. This profile wouldn't be complete unless I mentioned that I'm married to a wonderful, amazing, sensitive, good-looking man and I am so happy to share my life with him. We have been married for 9 years. He is my best friend and I can't imagine riding this journey with anyone else! If you happened to have stumbled on this blog and have any questions, feel free to ask. There are also some links further down my page that answers some of the most FAQ about Type 1 Diabetes.