The Animas OneTouch Ping insulin pump contains vulnerabilities that could be exploited by a malicious attacker to remotely trigger an insulin injection.
Security researcher Jay Radcliffe – who is himself a Type I diabetic – discovered the flaws and wrote about his findings.
What Radcliffe discovered was that there were security weaknesses in how the medical device communicated wirelessly. Specifically, a lack of encryption meant that instructions were being sent in cleartext. Combined with weak pairing between the remote and pump, this could open opportunities for remote attackers to spoof the controller and trigger unauthorized insulin injections.
If the user does not cancel the insulin delivery on the pump, there is the potential for an attacker to cause harm and potentially create a hypoglycemic reaction.
Although the risk of widespread exploitation of the flaws is considered relatively low, and no-one should panic, Animas's parent company Johnson & Johnson has issued an advisory to users of the insulin infusion pump:
“We have been notified of a cybersecurity issue with the OneTouch Ping®, specifically that a person could potentially gain unauthorized access to the pump through its unencrypted radio frequency communication system. We want you to know that Animas has investigated this issue and has worked with the appropriate regulatory authorities and security experts, as we are always evaluating ways to further ensure patient safety and security.”
The advice to users?
Well, you can of course mitigate the threat by turning off the pump's radio frequency feature. However, this means that your pump and meter can no longer communicate with each other, and blood glucose levels will need to be entered manually on the pump. That's clearly not an entirely satisfactory solution.
Animas also proposes that OneTouch Ping users enable the vibrating alert feature which will tell them if a dose is being administered remotely, and give them the option of canceling. Also, it's possible to program the OneTouch Ping pump to limit the amount of bolus insulin that can be delivered (either as a maximum or within certain time windows).
These mitigations are all very well, but they aren't a fix for the underlying problem: a failure by the device to use encrypted communications and proper authentication. The lack of an easy method for users to update the devices to improve their security is telling.
I asked Mark James, an ESET security specialist, why he felt vulnerabilities like this were being found in medical equipment:
“Quite often the problem with security in the medical or health industry is financially driven; cost is a major factor both in running and supplying the equipment used. In these instances the biggest factor is often making the equipment attainable for the masses who need it. The security of these products has to be factored into the cost and may even in some cases not be a factor at all. As we work towards an IoT environment where everything has to be connected, securing those devices in some cases is a secondary concern.
"Cost will always be a factor but nowadays security is just as important, the public need to feel safe using quite often the very things that keep them alive."
Despite his discovery, Radcliffe says that he does not believe people with diabetes should use the security concerns as a reason not to use the vulnerable equipment:
"Always take care of your diabetes first. We all know the dangers of high blood sugar and low blood sugar too. These risks often far outweigh the risks highlighted in this research."
"If any of my children became diabetic and the medical staff recommended putting them on a pump, I would not hesitate to put them on an OneTouch Ping. It is not perfect, but nothing is. In this process I have worked with Animas and its parent company, Johnson & Johnson, and know that they are focused on taking care of the patient and doing what is right."
