Medical Device Security: Hijacking an Insulin Pump

In this talk, we present preliminary results of the publicly funded BSI project ManiMed - Manipulating Medical Devices. We focus on vulnerabilities discovered in an insulin pump that may cause serious harm to the patients as an insulin bolus can be administered by hijacking the pump. All vulnerabilities have been responsibly disclosed to the vendor and security advisories with corresponding fixes have been or will be published.

Please note that in alignment with our professional and ethical principles we are not going to disclose technically deep details of the vulnerabilities until a fix is rolled out by the manufacturer.

Digital networking is already widespread in many areas of life. In the healthcare industry, more and more medical devices are networked, so that the number of medical high-tech devices in hospitals is steadily increasing. Although this often allows patients to quickly check their current health status or to apply drugs in an automated way, also a defective or manipulated device poses a massive risk to a patient’s life.

The Federal Office for Information Security (BSI), in its role as the central IT security authority in Germany, aims to sensitize manufacturers and the public regarding the IT security risks of networked medical devices. To this end, the BSI initiated the Medical Device Manipulation Project – ManiMed, in which an analysis of the IT security of these products is carried out through security assessments of selected medical devices.

In this talk we present preliminary results of the publicly funded BSI project ManiMed - Manipulating Medical Devices. We first report on our procurement process of the medical devices. Next, we focus on the assessment and the identified vulnerabilities in one of these devices, an insulin pump. These vulnerabilities may cause serious harm to the patients as an insulin bolus can be administered by hijacking the pump. Therefore, temporary measures for patients to fully eliminate the risk of an attack are presented. Finally, a few notes on the disclosure process are given as all vulnerabilities have been responsibly disclosed to the vendor and security advisories with corresponding fixes have been published. Besides, an outlook for future medical device security assessments is given.

Please note that in alignment with our professional and ethical principles, we are not going to disclose technically deep details of the vulnerabilities until a fix is rolled out by the manufacturer.