Preview Newsletter

Animas OneTouch Media Coverage, October 4, 2016

Top-Tier Coverage

EXCLUSIVE-J&J warns patients of insulin pump cyber bug, low hacking risk
Oct 4, 2016 | Reuters
By Jim Finkle

Johnson & Johnson is telling patients that it has learned of a cyber security bug in one of its insulin pumps that a hacker could exploit to overdose diabetic patients with insulin, though it describes the hacking risk as low.
TEXT-Johnson & Johnson letter on cyber bug in insulin pump
Oct 4, 2016 | Reuters

The following is the text of a letter mailed to patients on Monday by Johnson & Johnson's Animas diabetes unit describing a cyber security vulnerability in its Animas OneTouch Ping insulin pump:
Reuters (Video)
Oct 4, 2016 | Reuters

View full clip here: http://fw.to/k81M7fS
J&J Warns Insulin Pump Vulnerable to Cyber Hacking
Oct 4, 2016 | Wall Street Journal
By Jonathan Rockoff

Johnson & Johnson has warned diabetes patients and doctors that one of its insulin pumps is vulnerable to cyber hacking.
J&J Warns Diabetic Patients About Hacking Risks of Insulin Pumps
Oct 4, 2016 | Bloomberg
By Michelle Cortez and Tatiana Darie

Johnson & Johnson is warning users of its OneTouch Ping insulin pump that hackers could exploit a cybersecurity flaw to infuse additional doses of the diabetes drug without their knowledge, which could be life-threatening.
Johnson & Johnson warns of insulin pump hack risk
Oct 4, 2016 | USA Today
By Elizabeth Weise

A major maker of medical devices has for the first time issued a warning about a potential computer security flaw in a consumer product, but cautions that the danger to patients is extremely low.
Hackers may target insulin pumps
Oct 4, 2016 | CNN

Johnson and Johnson is warning more than 100,000 medical patients who use certain insulin pumps they could be targeted by hackers.

Regional Coverage

Johnson & Johnson says insulin pumps can be hacked, downplays risk among diabetics
Oct 4, 2016 | Washington Times
By Andrew Blake

Insulin pumps used by upwards of 114,000 diabetic patients across the United States and Canada contain security flaws that make them prone to hacking, Johnson & Johnson warned this week. Doctors and patients who use the Animas OneTouch Ping insulin pump were sent letters Monday informing them about the potential for the medical devices to be hacked — the first time a manufacturer has issued such a warning, according to a Reuters exclusive published Tuesday where the notice was made public.

Trade Coverage

Johnson & Johnson warns on low cyber risk with Animas OneTouch Ping insulin pump
Oct 4, 2016 | Mass Device
By Brad Perriello

Johnson & Johnson (NYSE:JNJ) is reportedly warning patients of a small risk that hackers will target its Animas OneTouch Ping insulin pump, after learning of the bug causing the potential cybersecurity risk.
Animas OneTouch Ping Insulin Pump System’s Security Warning
Oct 4, 2016 | A Sweet Life

Animas Inc. has issued a warning regarding the cyber security of its OneTouch Ping insulin pump system.
Johnson & Johnson Warns Patients Insulin Pump Is Hackable But “Low Risk” Of Attack
Oct 4, 2016 | Consumerist
By Kate Cox

Tech can be pretty great, and smart, connected tech can be really great. Miniaturization and the ability to control devices remotely has led to some fantastic advances in, for example, health care. But today in “wow, our glorious tech-driven future is so strange and dystopic some days,” we are reminded that anything that can be networked is vulnerable, and can be hacked.
Hackers can remotely exploit insulin pump for unauthorized insulin injections
Oct 4, 2016 | Network World

Rapid7 and Johnson & Johnson disclosed three vulnerabilities in the Animas OneTouch Ping insulin pump system, flaws which could be remotely exploited. However, the attack is sophisticated and both say the risk of exploitation is “relatively low.”
Johnson & Johnson discloses that its insulin pump is hackable
Oct 4, 2016 | The Stack
By Martin Anderson

Johnson & Johnson has revealed that its J&J Animas OneTouch Ping insulin pump is vulnerable to hackers, who could potentially force the device to overdose diabetic patients – however, it declares that the risk of this happening is very low.
J&J alerts patients to insulin pump cybersecurity flaws, but says risk is low
Oct 4, 2016 | FierceBiotech
By Amirah Al Idrus

On Monday, Johnson & Johnson’s Animas unit disclosed cybersecurity flaws in its wirelessly controlled insulin pump that hackers could exploit and potentially deliver unauthorized doses of insulin to patients. While such an attack could result in insulin overdose and hypoglycemia, Animas says the risk of attack is low.
Patients' insulin pumps are revealed to be hackable by J&J
Oct 4, 2016 | Pharmafile
By Ben Hargreaves

Johnson & Johnson have begun warning patients that their insulin pumps, that patients attach to their bodies and are controlled by wireless remote control, could potentially be hacked by enterprising hackers. It leaves open the possibility that the devices could be exploited to intentionally overdose diabetics with insulin.
Five things for pharma marketers to know: Tuesday, October 4, 2016
Oct 4, 2016 | Medical Marketing & Media
By Virginia Lau

Johnson & Johnson said one of its insulin pumps is at risk of being hacked and if that happened diabetes patients could be vulnerable to insulin overdose. The company sent warning letters to 114,000 patients in the U.S. and Canada who use the device with advice on how to fix the problem. (Fortune)
Hackers Could Harm Diabetics via Insulin Pump Attacks
Oct 4, 2016 | Security Week
By Eduard Kovacs

OneTouch Ping insulin pumps manufactured by Johnson & Johnson-owned Animas are plagued by several vulnerabilities that can be exploited by remote hackers to compromise devices and potentially harm the diabetic patients who use them. While the security holes are serious, the risk is considered relatively low and the vendor does not plan on releasing a firmware update.

Blog Coverage

R7-2016-07: Multiple Vulnerabilities in Animas OneTouch Ping Insulin Pump
Oct 4, 2016 | Rapid7
By Todd Beardsley

Today we are announcing three vulnerabilities in the Animas OneTouch Ping insulin pump system, a popular pump with a blood glucose meter that services as a remote control via RF communication. Before we get into the technical details, we want to flag that we believe the risk of wide scale exploitation of these insulin pump vulnerabilities is relatively low, and we don’t believe this is cause for panic. We recommend that users of the devices consult their healthcare providers before making major decisions regarding the use of these devices. More on that further down in this post.
Johnson & Johnson’s insulin pump is totally hackable
Oct 4, 2016 | The Next Web
By Matthew Hughes

Johnson & Johnson has warned its customers about a security vulnerability in one of its insulin pumps. If the flaw in the Animas OneTouch Ping insulin pump was exploited, it could allow an attacker to deliver a potentially fatal overdose of insulin.
NEWSBREAK: Patient Notification about Cybersecurity of OneTouch® Ping Insulin Delivery System
Oct 4, 2016 | DiabetesDad
By Tom Karlya

This was sent to me by Animas and I share it with you. I BELIEVE this is more of an informative advisory than anything else………oh yeah; and welcome to 2016

Broadcast Coverage

Fox Chicago News at Noon
Oct 4, 2016 | WFLD Fox Chicago

View clip here: http://beta.criticalmention.com/app/#clip/view/24375011?token=b998bbf2-51c6-465c-b793-1ad4405e5451
7 Action News at Noon
Oct 4, 2016 | WXYZ ABC Detroit

View clip here: http://beta.criticalmention.com/app/#clip/view/24374387?token=b998bbf2-51c6-465c-b793-1ad4405e5451
TWC News All Day
Oct 4, 2016 | TWC Albany

View clip here: http://beta.criticalmention.com/app/#clip/view/24374400?token=b998bbf2-51c6-465c-b793-1ad4405e5451
ABC15 Mornings
Oct 4, 2016 | KNXC-ABC Phoenix

View clip here: http://beta.criticalmention.com/app/#clip/view/24373365?token=b998bbf2-51c6-465c-b793-1ad4405e5451

Top-Tier Coverage

EXCLUSIVE-J&J warns patients of insulin pump cyber bug, low hacking risk

Oct 4, 2016 | Reuters

By Jim Finkle

Johnson & Johnson is telling patients that it has learned of a cyber security bug in one of its insulin pumps that a hacker could exploit to overdose diabetic patients with insulin, though it describes the hacking risk as low.
Medical device experts said they believe it was the first time a manufacturer had issued such a warning to patients about a cyber vulnerability, a hot topic in the industry following revelations last month about possible vulnerabilities in pacemakers and defibrillators.
J&J executives told Reuters they knew of no examples of attempted attacks on the device, the J&J Animas OneTouch Ping insulin pump. The company is nonetheless warning customers and providing advice on how to fix the problem.
"The probability of unauthorized access to the OneTouch Ping system is extremely low," the company said in letters mailed out on Monday to doctors and about 114,000 patients in the United States and Canada who use the device. A copy of the text of the letter was made available to Reuters.
The warning is being delivered a month after a prominent short seller and cyber security research firm went public with allegations of potentially life-threatening cyber vulnerabilities in heart devices from St. Jude Medical Inc .
St. Jude said the allegations were false as its shares tumbled and the U.S. Food and Drug Administration began an investigation.
The U.S. Food and Drug Administration is preparing to release formal guidance on how medical device makers should handle reports about cyber vulnerabilities. J&J said it reviewed the matter with the FDA before sending the letter.
An early draft of that guidance, which was released in January for public comments, calls for device makers to work with security researchers, identify steps to mitigate risks, and provide patients with information about bugs so they can "make informed decisions" about device use.
The FDA declined comment on J&J's handling of the vulnerability in the insulin pump, a medical device that patients attach to their bodies that injects insulin through catheters.
J&J executives told Reuters that they worked on the security problems with Jay Radcliffe, a diabetic and well-known medical-device hacking researcher with cyber security firm Rapid7 Inc who reported vulnerabilities in the pump to the company in April.
The Animas OneTouch Ping is sold with a wireless remote control that patients can use to order the pump to dose insulin so that they do not need access to the device itself, which is typically worn under clothing and could be awkward to reach.
Radcliffe said he identified ways for a hacker to spoof communications between the remote control and the OneTouch Ping insulin pump, potentially forcing it to deliver unauthorized insulin injections. Dosing a patient with too much insulin could cause hypoglycemia, or low blood sugar, which in extreme cases can be life threatening, said Brian Levy, chief medical officer with J&J's diabetes unit.
The system is vulnerable because those communications are not encrypted, or scrambled, to prevent hackers from gaining access to the device, Radcliffe said.
Company technicians were able to replicate Radcliffe's findings, confirming that a hacker could order the pump to dose insulin from a distance of up to 25 feet, Levy said. He said such attacks are difficult to pull off because they require specialized technical expertise and sophisticated equipment.
"We believe the OneTouch Ping system is safe and reliable. We urge patients to stay on the product," Levy said.
J&J's letter said that if patients were concerned, they could take several steps to thwart potential attacks. They include discontinuing use of a wireless remote control and programming the pump to limit the maximum insulin dose.
Radcliffe said he believed that OneTouch Ping users would be safe if they followed the steps outlined in the letter from J&J.
"They can give peace of mind to the patient or parent of a child using the device," he said.
J&J Chief Information Security Officer Marene Allison said her team would make sure other J&J products do not have similar bugs.
Radcliffe said he found vulnerabilities in the Animas OneTouch Ping, but not the Animas Vibe line of insulin pumps.
Suzanne Schwartz, an FDA official responsible for reviewing bugs in medical devices, said in a statement that she encourages collaboration between researchers and device manufacturers to identify, remediate and alert the public to vulnerabilities.
"It enables all stakeholders to better address device safety with the interest of patient health in mind," she said.
The FDA has said it knows of no cases where hackers have exploited cyber vulnerabilities to harm a patient.

The agency last year issued multiple warnings about cyber bugs in infusion pumps from Hospira, which has since been acquired by Pfizer Inc. (http://reut.rs/2duNuZK)

Return to headline | Return to top
TEXT-Johnson & Johnson letter on cyber bug in insulin pump

Oct 4, 2016 | Reuters

The following is the text of a letter mailed to patients on Monday by Johnson & Johnson's Animas diabetes unit describing a cyber security vulnerability in its Animas OneTouch Ping insulin pump:
"Dear Valued Animas OneTouch Ping Pump User,
Since 2008, the OneTouch Ping insulin pump system has been helping people with diabetes perform at their best, and we are committed to providing our customers with safe and reliable products.
We have been notified of a cybersecurity issue with the OneTouch Ping, specifically that a person could potentially gain unauthorized access to the pump through its unencrypted radio frequency communication system. We want you to know that Animas has investigated this issue and has worked with the appropriate regulatory authorities and security experts, as we are always evaluating ways to further ensure patient safety and security.
We also want to assure you that the probability of unauthorized access to the One Touch Ping System is extremely low. It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the internet or to any external network. In addition, the system has multiple safeguards to protect its integrity and prevent unauthorized action.
If you are concerned about unauthorized access for any reason, the pump's radio frequency feature can be turned off, which is explained in Chapter 2 of Section III of the OneTouch Ping Owner's Booklet. However, turning off this feature means that the pump and meter will no longer communicate and blood glucose readings will need to be entered manually on the pump.
If you choose to use the meter remote feature, another option for protection is to program the OneTouch Ping pump to limit the amount of bolus insulin that can be delivered. Bolus deliveries can be limited through a number of customizable settings (maximum bolus amount, 2-hour amount, and total daily dose). Any attempt to exceed or override these settings will trigger a pump alarm and prevent bolus insulin delivery. For more information, please see Chapter 10 of Section I of the OneTouch Ping Owner's Booklet.
We also suggest turning on the Vibrating Alert feature of the OneTouch Ping System, as described in Chapter 4 of Section I. This notifies the user that a bolus dose is being initiated by the meter remote, which gives the patient the option of canceling the bolus.

The bolus delivery alert and the customizable limits on bolus insulin can only be enabled on the pump and cannot be altered by the meter remote. This is also true of basal insulin. We also remind you that any insulin delivery and the source of the delivery (pump or meter remote) are recorded in the pump history, so you can review the bolus dosing.

Return to headline | Return to top
Reuters (Video)

Oct 4, 2016 | Reuters

View full clip here: http://fw.to/k81M7fS

Rough Transcript: a frightening prospect a hacker overdoses diabetic patients with insulin. Reuters has learned J&J is warning diabetic patients that a hacker could exploit a cyber security bug in one of its insulin pumps. At issue the J&J Animas OneTouch Ping, patients can use the wireless remote control to tell the pump to dose insulin. The hacking researcher who reported the vulnerability to J&J, Rapid7 senior security consultant Jay Radcliffe, said hackers can gain access because that communication is not encrypted. The company sent out letters on Monday to doctors and 114,000 patients in the U.S. saying: “The probability of unauthorized access to the OneTouch Ping system is extremely low.” J&J told Reuters the system is safe and reliable, it said users could prevent potential hacks by not using the remote control and by programming the pump to limit the maximum dose. Radcliffe was working with J&J on the issue agrees saying users would be safe if they followed J&J’s steps outlined in the letter. The FDA declined comment on J&J’s handling of the bug.

Return to headline | Return to top
J&J Warns Insulin Pump Vulnerable to Cyber Hacking

Oct 4, 2016 | Wall Street Journal

By Jonathan Rockoff

Johnson & Johnson has warned diabetes patients and doctors that one of its insulin pumps is vulnerable to cyber hacking.
A hacker in close proximity to the OneTouch Ping insulin pump system could use sophisticated equipment to find the unencrypted radio signal used by the device and program the pump to supply insulin, J&J officials said.
“The risk to patients is extremely, extremely low,” said Brian Levy, chief medical officer of J&J’s diabetes-care business. “The more important thing is people use their meters and pumps because this is an important part of their health care.”
J&J’s Animas unit has sold 114,000 of the OneTouch Ping systems in the U.S. and Canada, mostly for Type 1 diabetes patients. J&J doesn’t break out revenue numbers for the device, though Dr. Levy characterized it as a “very good seller.”
Parents like the convenience of the systems, which include a pump for delivering insulin and a meter for measuring blood-sugar levels that can also be used as a remote to program the pump. The meter communicates with the pump, from as far as 25 feet away, over unencrypted radio frequencies.
Late last month, the company sent a letter to doctors and patients warning a hacker could identify the specific frequency the device is using and then issue commands to the pump.
The warning, first reported by Reuters, is the latest indication of the susceptibility of medical devices to computer hacking, a mounting worry as they are increasingly connected to the internet, hospital computer networks and to other medical devices.
So far, the fears haven’t been realized. No instances of medical-device hacking have been disclosed, consultants and industry officials say, though firms that advise companies how to reduce their risks of cyberattacks have found and publicized vulnerabilities.
St. Jude Medical Inc. shares fell in August after a short seller and a cybersecurity firm that were working together said they found bugs in some of the company’s pacemakers and implantable defibrillators, allegations that St. Jude called “irresponsible, misleading.” St. Jude said last month that it sued the two parties for intentionally disseminating “false and misleading information to lower the value” of the company’s stock.
Yet the health risk to patients from a cyberattack on a medical device is serious enough that regulators and companies have been taking steps to upgrade security.
This year, the Food and Drug Administration issued draft rules for identifying and addressing weaknesses. The agency later issued warnings about the vulnerabilities of some infusion pump systems, made by Pfizer Inc.’s Hospira business, that deliver drugs intravenously to patients.
Following the agency’s recommendations, J&J set up a website in April to receive reports of medical-device vulnerabilities. Shortly afterward, a cybersecurity consulting firm reported the OneTouch Ping’s flaws, said Marene Allison, J&J’s chief information security officer.
At that time, the New Brunswick, N.J., company confirmed the weakness, notified authorities and then sent the letter to patients and doctors on Sept. 27.
Dr. Levy said the company hasn’t found any vulnerabilities in another system, Animas Vibe, in which a blood-sugar measuring device sends readings to the insulin-deliver pump using radio frequencies.
The OmniPod insulin pump system, made by Insulet Corp., also includes a device that communicates wirelessly to deliver insulin. A spokeswoman for the Billerica, Mass., company didn't respond to requests for comment.

Return to headline | Return to top
J&J Warns Diabetic Patients About Hacking Risks of Insulin Pumps

Oct 4, 2016 | Bloomberg

By Michelle Cortez and Tatiana Darie

Johnson & Johnson is warning users of its OneTouch Ping insulin pump that hackers could exploit a cybersecurity flaw to infuse additional doses of the diabetes drug without their knowledge, which could be life-threatening.
“The probability of unauthorized access to the OneTouch Ping System is extremely low,” the company said in a letter to patients alerting them to the risk. “It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the Internet or to any external network.”
The New Brunswick, New Jersey-based device maker said it has worked to address the issues and laid out steps patients can take to reduce their risk, such as turning off the pump’s wireless connection to a blood sugar meter, or setting a limit on the amount of insulin that can be delivered. While the potential risk with insulin pumps has been known since at least 2011 when a security conference in Las Vegas featured the hack of a Medtronic Plc device, the issue has gained attention as more devices include wireless technology to make them easier to use.
A cybersecurity researcher brought the risks to J&J’s attention in April after identifying ways to hack the device, according to Reuters, which first reported the weakness. That allowed the company to investigate and work with U.S. regulators and the hacker, the same security researcher who earlier exposed the issue with Medtronic’s pump.
J&J fell less than 1 percent to $118.66 at 11:29 a.m. in New York.
The experience with J&J’s device stands in sharp contrast to the disclosure of similar potential vulnerabilities with St. Jude Medical Inc.’s pacemakers and defibrillators in August. Short-seller Carson Block and his Muddy Waters Capital LLC investment firm issued a report with MedSec LLC, a cybersecurity company, alleging possible cybersecurity flaws in St. Jude’s products. The investment company made a simultaneous short call on St. Jude’s shares that allowed it to profit if the stock fell.
Block and his colleagues said they didn’t give St. Jude early warning about the potential risks, which has traditionally been the standard in the cyber community, because the deficiencies were so great and St. Jude had been negligent in ignoring them.
St. Jude countered that the deficiencies identified by Muddy Waters and MedSec were actually a safety feature, and that the device the firms tested was functioning normally. Abbott Laboratories, which agreed in April to buy St. Jude for $25 billion, has said it remains committed to the transaction.

Return to headline | Return to top
Johnson & Johnson warns of insulin pump hack risk

Oct 4, 2016 | USA Today

By Elizabeth Weise

A major maker of medical devices has for the first time issued a warning about a potential computer security flaw in a consumer product, but cautions that the danger to patients is extremely low.
Johnson & Johnson on Tuesday issued a warning about a possible cybersecurity issue with its Animas OneTouch Ping Insulin Infusion Pump. The problem was first reported by Reuters.
Computer security firm Rapid 7 discovered that it might be possible to take control of the pump via its an unencrypted radio frequency communication system that allows it to send commands and information via a wireless remote control. The company alerted Johnson & Johnson, which issued the warning.
Getting too high or too low a dose of insulin could severely sicken or even kill.
Insulin pumps are used to control diabetes. They are worn on the body and deliver insulin into the body via a catheter placed under the skin. They are overwhelmingly used by patients with Type 1 diabetes, the least common type in the United States.
In the OneTouch Ping device, the user can order the pump to give them a dose of insulin via a wireless remote control which talks to the insulin pump via an unencrypted radio frequency communication system.
However to do so would require that the potential hacker were within 25 feet of the device and would require technical expertise and sophisticated equipment, Animas said in a statement Tuesday. Animas is owned by Johnson & Johnson.
While there are many diabetics in the United States, 29.1 million according to the American Diabetes Association, the vast majority of them have Type 2 diabetes. Just 4%, or 1.25 million Americans, have Type 1 diabetes, which is caused by an autoimmune disorder that destroys the cells that release insulin.
There are 114,000 OneTouch Ping insulin delivery systems in circulation in the United States and Canada, according to Johnson and Johnson.
Type 2 diabetics don’t typically need the sophisticated and frequent insulin delivery that an insulin pump offers, said Sarah Kim, who directs the diabetes clinic at Zuckerberg San Francisco General Hospital.
“Someone would have to go to extreme measures to hack in and command the insulin pump without the person’s knowledge. At this point it seems like an unnecessary worry,” she said.

In its release, Animas said that users of its insulin pump can turn off the radio frequency feature. They can also set the pump to vibrate when an insulin dose begins to be delivered, giving them time to cancel the order if they themselves did not give it.

Return to headline | Return to top
Hackers may target insulin pumps

Oct 4, 2016 | CNN

Johnson and Johnson is warning more than 100,000 medical patients who use certain insulin pumps they could be targeted by hackers.
In a letter, the company said its Animas OneTouch Ping insulin pump has a bug causing a potential cybersecurity risk.
Hackers could hijack the device and force it to deliver unauthorized, and possibly lethal, insulin doses.
But the company said the probability of that happening is extremely low. There have not been any reports of actual attempts to hack the Animas OneTouch Ping device.

Johnson and Johnson also said the pump has features for advanced protection should patients be concerned.

Return to headline | Return to top

Regional Coverage

Johnson & Johnson says insulin pumps can be hacked, downplays risk among diabetics

Oct 4, 2016 | Washington Times

By Andrew Blake

Insulin pumps used by upwards of 114,000 diabetic patients across the United States and Canada contain security flaws that make them prone to hacking, Johnson & Johnson warned this week.
Doctors and patients who use the Animas OneTouch Ping insulin pump were sent letters Monday informing them about the potential for the medical devices to be hacked — the first time a manufacturer has issued such a warning, according to a Reuters exclusive published Tuesday where the notice was made public.
The flaws stem from the use of unencrypted radio transmissions to broadcast communications between the insulin pump and a wireless remote control sold alongside it, said Jay Radcliffe, a security researcher and Type 1 diabetic who reported the problems to Johnson & Johnson earlier this year.
By interfering with those communications, a hacker with the proper equipment and expertise could remotely send malicious commands to a patient’s implanted pump, said Mr. Radcliffe, a researcher with Rapid7, a Boston-based security firm.
In a worst-case scenario, a hacker acting as a pump’s remote control could force a patient to be injected with potentially lethal amounts of insulin from as far as two kilometers away, he explained.

Because of the sophistication required to wage such an attack, however, both the security researcher and the device’s manufacturer believe the issues pose little risk to patients.

Return to headline | Return to top

Trade Coverage

Johnson & Johnson warns on low cyber risk with Animas OneTouch Ping insulin pump

Oct 4, 2016 | Mass Device

By Brad Perriello

Johnson & Johnson (NYSE:JNJ) is reportedly warning patients of a small risk that hackers will target its Animas OneTouch Ping insulin pump, after learning of the bug causing the potential cybersecurity risk.
There haven’t been any reports of actual attempts to hack the Animas OneTouch Ping device, company executives told Reuters about what’s believed to be the 1st instance of a medical device company warned patients about the potential for a malicious hacking attack.
“The probability of unauthorized access to the OneTouch Ping system is extremely low,” the company said in letters mailed out yesterday to doctors and about 114,000 patients in the U.S. and Canada who use the device, according to the news service.
The incident is unfolding in stark contrast to allegations made in August by notorious short-selling firm Muddy Waters Consulting about major flaws in some of the cardiac rhythm management devices made by St. Jude Medical (NYSE:STJ). St. Jude later sued Muddy Waters and the hacking shop behind the report, after the sides traded accusations about its accuracy (which independent researchers found had “major flaws” – but not before STJ shares lost about 5% of their value, although the stock has since recovered somewhat).
New Brunswick, N.J.-based J&J told Reuters that it consulted with the FDA before sending the letter about its insulin pump. The company worked with well-known “white hat” hacking researcher Jay Radcliffe, a diabetic who reported vulnerabilities in the pump to the company in April, the executives said.
Radcliffe said he discovered that hackers could hijack the unencrypted communications between the Animas OneTouch Ping’s remote control and insulin pump, potentially forcing it to deliver unauthorized – and possibly lethal – insulin doses. Johnson & Johnson researchers confirmed the finding but noted that the hackers would have to be within 25 feet of the device. Dr. Brian Levy, chief medical officer for J&J’s diabetes unit, said such an attack would be difficult to enact because of the expertise and sophistication it requires.
“We believe the OneTouch Ping system is safe and reliable. We urge patients to stay on the product,” Levy told Reuters. Patients can stop using the wireless remote and program the insulin pump to limit the maximum dose, Johnson & Johnson said in the letter. Radcliffe said those measures would keep patients safe from the potential hack, Reuters reported.
“They can give peace of mind to the patient or parent of a child using the device,” he said, noting that the vulnerability does not affect J&J’s Animas Vibe line. The company’s chief information security officer, Marene Allison, told the news service that her team would make sure other J&J products don’t have similar bugs.

Return to headline | Return to top
Animas OneTouch Ping Insulin Pump System’s Security Warning

Oct 4, 2016 | A Sweet Life

Animas Inc. has issued a warning regarding the cyber security of its OneTouch Ping insulin pump system.
The company was notified of a cybersecurity issue with the OneTouch Ping, specifically that a person could potentially gain unauthorized access to the pump through its unencrypted radio frequency communication system. Animas says it has investigated this issue and has worked with the appropriate regulatory authorities and security experts to further ensure patient safety and security.
Animas says that the probability of unauthorized access to the One Touch Ping System is extremely low and would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the internet or to any external network. In addition, the system has multiple safeguards to protect its integrity and prevent unauthorized action.
If you are concerned about unauthorized access for any reason, the pump’sradio frequency feature can be turned off (as explained in Chapter 2 of Section III of the OneTouch Ping Owner’s Booklet). However, turning off this feature means that the pump and meter will no longer communicate and blood glucose readings will need to be entered manually on the pump.
If you choose to use the meter remote feature, another option for protection is to program the pump to limit the amount of bolus insulin that can be delivered. Bolus deliveries can be limited through a number of customizable settings (maximum bolus amount, 2-hour amount, and total daily dose). Any attempt to exceed or override these settings will trigger a pump alarm and prevent bolus insulin delivery. (For more information, please see Chapter 10 of Section I of the OneTouch Ping Owner’s Booklet).
The company also suggests turning on the Vibrating Alert feature of the OneTouch Ping System (as described in Chapter 4 of Section I). This notifies the user that a bolus dose is being initiated by the meter remote, which gives the patient the option of canceling the bolus.
The bolus delivery alert and the customizable limits on bolus insulin can only be enabled on the pump and cannot be altered by the meter remote. This is also true of basal insulin. Any insulin delivery and the source of the delivery (pump or meter remote) are recorded in the pump history, so you can review the bolus dosing.

For questions and Information on this issue please contact Animas Customer Technical Support at mailto:RA-ANMUS- CustomSupp@its.jnj.com or 1-877-937-7867.

Return to headline | Return to top
Johnson & Johnson Warns Patients Insulin Pump Is Hackable But “Low Risk” Of Attack

Oct 4, 2016 | Consumerist

By Kate Cox

Tech can be pretty great, and smart, connected tech can be really great. Miniaturization and the ability to control devices remotely has led to some fantastic advances in, for example, health care. But today in “wow, our glorious tech-driven future is so strange and dystopic some days,” we are reminded that anything that can be networked is vulnerable, and can be hacked.
Reuters reports this morning that Johnson & Johnson has found that one of its medical devices has a bug in it that can leave it vulnerable to remote intrusion — i.e., hacking.
While it’s strange to think of the company best known for Band-Aids and baby shampoo — decidedly non-digital products — as hackable, J&J also makes and sells a whole range of medical devices to hospitals and doctors. One of those devices is a line of insulin pumps, the One Touch Ping, to help patients manage diabetes.
The One Touch Ping is a two-part system. One part is the pump, that a patient wears; the other part is a remote that lets them control how much insulin the pump delivers. The two-part delivery means that folks managing their diabetes don’t have to fiddle with a device under their clothes, or excuse themselves to a private room, to manage insulin dosing — discretion that many patients value.
But that means that the actual pump part, by definition, can be accessed wirelessly. And that’s where the bug comes in: the person holding the authorized remote isn’t the only person who can do that accessing. Communications inside the system are not encrypted, so hacker can fake signals between the remote control and the pump, forcing the pump to deliver unauthorized insulin injections. Deliver a high enough insulin dose from up to 25′ away, using a hacked pump, and, well, it could become a perfect locked-room murder mystery.
A medical-device hacking researcher, himself diabetic, discovered and reported the vulnerability in April; J&J internal researchers tested and confirmed the flaw before communicating to their customers.
Johnson & Johnson sent letters this week to 114,000 patients in the U.S. and Canada informing them of the vulnerability in the device, Reuters says. Executives for the company told Reuters they knew of no actual hacking attempts on the device, and the letter described the probability of unauthorized access as “extremely low.”
One company executive explained to Reuters that a hack, while possible, would be difficult to pull off because it required specialized expertise and equipment. “We believe the OneTouch Ping system is safe and reliable. We urge patients to stay on the product,” he told Reuters.
There are as yet no formal rules in the U.S. on how medical device makers must handle software security problems. The FDA has a draft set of guidance out for public comment, but there is not yet any rule.
However, as internet-capable and -connected health devices continue to proliferate, stories about firmware bugs will only continue to become more common. That means consumers and patients would benefit from a strong rule about it sooner rather than later.

Return to headline | Return to top
Hackers can remotely exploit insulin pump for unauthorized insulin injections

Oct 4, 2016 | Network World

Rapid7 and Johnson & Johnson disclosed three vulnerabilities in the Animas OneTouch Ping insulin pump system, flaws which could be remotely exploited. However, the attack is sophisticated and both say the risk of exploitation is “relatively low.”
OneTouch Ping is a medical device which comes with a wireless remote control that patients can use to deliver insulin instead of accessing the device under their clothes. The Johnson & Johnson Animas device is described as a “two-part system;” the pump and a meter remote which communicates wirelessly via RF communication “to deliver insulin from the pump.”
The flaws were discovered by Jay Radcliffe, a security researcher at Rapid7 as well as a diabetic who has previously disclosed vulnerabilities in an insulin device. This time, Radcliffe discovered the OneTouch Ping insulin pump system doesn’t use encryption to communicate. An attacker could spoof communications between the pump and the remote in order to force doses of insulin.
Rapid7 explained that because the communications are in cleartext, “a remote attacker can spoof the Meter Remote and trigger unauthorized insulin injections.”
Johnson & Johnson took an unprecedented step since the manufacturer is the first to issue a warning about cyber-vulnerabilities.
According to Reuters, Johnson & Johnson sent letters (pdf) to doctors and about 114,000 patients in the United States and Canada; it said, “The probability of unauthorized access to the OneTouch Ping system is extremely low.”
Animus was able to exploit the vulnerabilities disclosed in Radcliffe’s research and confirmed “that a hacker could order the pump to dose insulin from a distance of up to 25 feet.”
Rapid7 said, “It is believed these attacks could be performed from one to two kilometers away, if not substantially further, using sufficient elevation and off-the-shelf radio transmission gear available to ham radio hobbyists.”
Not wanting non-technical diabetics to panic, Radcliffe clarified, “Most people are at limited risk of any of the issues related to this research. These are sophisticated attacks that require being physically close to a pump. Some people will choose to see this as significant, and for that they can turn off the RF/remote features of the pump and eliminate that risk.”
He advised against freaking out and removing the pump, since “removing an insulin pump from a diabetic over this risk is similar to never taking an airplane because it might crash.”
He added that if his kids were to become diabetics, then he “would not hesitate to put them on a OneTouch Ping. It is not perfect, but nothing is. In this process I have worked with Animas and its parent company, Johnson & Johnson, and know that they are focused on taking care of the patient and doing what is right.”
Radcliffe did 90 percent of his research on the device which was attached to him for years. He wants medical devices to be safe in the future, urging vendors, regulators and researchers to work together. “As these devices get more advanced, and eventually connect to the internet (directly or indirectly), the level of risk goes up dramatically.
Rapid7 first reached out to the vendor in April. In September, Johnson & Johnson provided mitigations. Today, October 4, the vulnerabilities were revealed to the public.
Radcliffe told Reuters that OneTouch Ping users should follow the steps in the letter from Johnson & Johnson in order to be safe. It explained how to turn off the pump’s radio frequency feature. Users who wish to leave RF on can limit the amount of bolus insulin that can be delivered as well as turn on vibrating alerts; the alerts notify a patient that a dose is being initiated by the meter remote and gives them an option to cancel the dose.

You can find Rapid7’s full findings about the “communications transmitted in cleartext, weak pairing between remote and pump, and lack of replay attack prevention or transmission assurance” here. Additionally, there is a demonstration video of an attack on the Animas OneTouch Ping.

Return to headline | Return to top
Johnson & Johnson discloses that its insulin pump is hackable

Oct 4, 2016 | The Stack

By Martin Anderson

Johnson & Johnson has revealed that its J&J Animas OneTouch Ping insulin pump is vulnerable to hackers, who could potentially force the device to overdose diabetic patients – however, it declares that the risk of this happening is very low.
Speaking to Reuters, unnamed executives from the American multinational medical manufacturer said that they were taking the unprecedented step of warning customers about the vulnerability, particularly in light of recent controversies regarding attack vectors in cardiac equipment.
In a letter to doctors and 114,000 patients, sent on Monday, the company wrote:
“The probability of unauthorized access to the OneTouch Ping system is extremely low… It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the internet or to any external network.”
The letter also advised patients who might be concerned by the news that it is possible to mitigate the threat by ceasing to use the remote device and setting the pump to limit the maximum possible insulin dose (presumably not a default setting).
Diabetic security researcher Jay Radcliffe had identified a method by which a hacker could imitate legitimate communications between the pump and the patient’s remote control for it, and noted that no physical access to the device was needed.
The company’s own technicians were able to replicate the hack and confirmed that it was possible to manipulate the pump within a distance of 25 feet. Brian Levy, Johnson & Johnson’s chief medical officer observed that the hack would be extremely difficult to pull off, and said “We believe the OneTouch Ping system is safe and reliable. We urge patients to stay on the product.”
Johnson & Johnson has said that it will work with the researcher on addressing the problem.
In 2011 Radcliffe presaged this possibility by reverse-engineering his own insulin pump and formulating an effective overdose attack. He presented the work, entitled ‘Hacking Medical Devices for Fun and Insulin: Breaking the Human SCADA System’ at the 2011 Black Hat security conference.
The same year, McAfee researcher Barnaby Jack demonstrated an effective attack on local insulin pumps at the Hacker Halted conference in Miami. He commented at the time “With this device I created and the software I created, I could actually instruct the pump to perform all manner of commands… I could make it dispense its entire reservoir of insulin, which is about 300 units. I just scan for any devices in the vicinity and they will respond with the serial number of the device.” Barnaby passed away in San Francisco days before he was scheduled to demonstrate an effective analogous hack on a pacemaker.
In August of 2015, the U.S. Food and Drug administration (FDA) issued a warning to hospitals to discontinue use of the Symbic Infusion Medication System due to cyber-vulnerabilities.
In 2014 the U.S. Department of Homeland Security investigated 24 cases of suspected cybersecurity exploits in hospital equipment and assorted medical devices. A senior DHS official a the time made reference to the most popular fictitious representation of a medical cyber-attack, which occurred in the show Homeland.

Return to headline | Return to top
J&J alerts patients to insulin pump cybersecurity flaws, but says risk is low

Oct 4, 2016 | FierceBiotech

By Amirah Al Idrus

On Monday, Johnson & Johnson’s Animas unit disclosed cybersecurity flaws in its wirelessly controlled insulin pump that hackers could exploit and potentially deliver unauthorized doses of insulin to patients. While such an attack could result in insulin overdose and hypoglycemia, Animas says the risk of attack is low.
The OneTouch Ping Glucose Management System comprises an insulin pump worn by the patient and a remote that uses a radio frequency communication system to wirelessly tell the pump to deliver insulin. Cybersecurity firm Rapid7 first identified the security issues earlier this year and communicated them to Animas in April.
The major vulnerability is that there is not any protection against a replay attack, Jay Radcliffe, a senior security researcher at Rapid7, told FierceMedicalDevices. If a person is in range of the device and can pick up its communications, they could “replay” those signals to cause the pump to do things that the user doesn’t command it to do, he said. Such an attack is possible because the transmissions between the remote and pump are not encrypted. They don’t use sequence numbers either, which are unique numbers for each communication that allow the device components to talk to each other, but would ensure a hacker couldn’t carry out a replay attack.
Animas disclosed the security issues in a letter to customers on Monday. “We also want to assure you that the probability of unauthorized access to the One Touch Ping System is extremely low,” the company wrote. Animas did not respond to a request for comment by press time, but told Reuters that it considered the device to be “safe and reliable.”
“We urge patients to stay on the product," said Brian Levy, chief medical officer with J&J's diabetes unit, as quoted by Reuters. Rapid7’s Radcliffe worked with Animas on the security issues and underscored the importance of understanding risk: “Removing an insulin pump from a diabetic over this risk is similar to never taking an airplane because it might crash,” he wrote in a blog post.
But if patients were concerned, they could disable the pump’s radiofrequency features and instead manually enter blood glucose readings into the system, Animas said in the letter. If they choose to continue using the wireless remote, patients could also program a limit to the amount of insulin that the pump can deliver before triggering an alarm and preventing further insulin delivery, the company said.
While using encryption technology or sequence numbers in pairing the pump and the remote would address these vulnerabilities, Radcliffe said it would not be easy to do so with this device. “It would be a pretty significant undertaking,” he said. “ … These devices aren’t really designed to have an update like the iPhone. You can’t push a new operating system or patch to it. Any changes like that would require the device to be completely recalled.”
As we look to the future, more and more medical devices will connect to mobile devices and computers in a bid to improve patient care. This increased connectivity will help doctors keep up with their patients’ treatment and even make adjustments to treatment remotely. But linking to other devices via the internet opens up the risk to cyberattacks, Radcliffe said. As we move forward, companies and patients should think more closely about what safety mechanisms they have in place and what device testing they may perform.

Return to headline | Return to top
Patients' insulin pumps are revealed to be hackable by J&J

Oct 4, 2016 | Pharmafile

By Ben Hargreaves

Johnson & Johnson have begun warning patients that their insulin pumps, that patients attach to their bodies and are controlled by wireless remote control, could potentially be hacked by enterprising hackers. It leaves open the possibility that the devices could be exploited to intentionally overdose diabetics with insulin.
The company has been keen to stress that the likelihood of this event happening is unlikely, they reassured in letters sent to patients. The letters stated that "The probability of unauthorized access to the OneTouch Ping system is extremely low…It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the internet or to any external network."
The particular insulin pump in question is the Animas OneTouch Ping, which was launched in 2008. The system is vulnerable because communications between the wireless remote and the insulin pump are not encrypted or scrambled, safety features that typically prevent hackers from being able to interfere with such devices.
In accordance with their own independent findings, that suggested the device was vulnerable, Johnson & Johnson have released safety advice to manually limit the amount of insulin that is possible to be released by the device and to discontinue use of the remote control.
Suzanne Schwartz, an FDA official responsible for reviewing bugs in medical devices, said in a statement that she encourages collaboration between researchers and device manufacturers to identify, remediate and alert the public to vulnerabilities.
"It enables all stakeholders to better address device safety with the interest of patient health in mind," she said.
The FDA released a statement claiming that it knows of no known cases where hackers have managed exploit vulnerabilities in such devices to harm patients.

Return to headline | Return to top
Five things for pharma marketers to know: Tuesday, October 4, 2016

Oct 4, 2016 | Medical Marketing & Media

By Virginia Lau

1. Johnson & Johnson said one of its insulin pumps is at risk of being hacked and if that happened diabetes patients could be vulnerable to insulin overdose. The company sent warning letters to 114,000 patients in the U.S. and Canada who use the device with advice on how to fix the problem. (Fortune)
2. Japanese scientist Yoshinori Ohsumi won the 2016 Nobel Prize for his discoveries in autophagy, a process by which cells detoxify and recycle. Experts believe his discoveries may lead to advances in treatments for Alzheimer's disease, Parkinson's disease, and cancer. (WSJ)
3. Merrimack CEO Robert Mulroy left the company and chairman Gary Crocker was named interim chief until the drugmaker finds a permanent replacement. The company, which markets pancreatic cancer drug Onivyde, also said it plans to cut 22% of its workforce. (WSJ)
4. Sarepta Therapeutics partnered with Summit Therapeutics to license Summit's Duchenne muscular dystrophy drug. The deal gives Sarepta access to Summit's utrophin modulator pipeline, which includes its leading experimental Duchenne therapy, in Europe, Turkey, and several other countries. (Reuters)

5. Roche said its lung-cancer treatment, Alecensa, its anaplastic lymphoma kinase inhibitor, received its second Breakthrough Therapy designation. The designation is for the treatment of adult patients with advanced ALK-positive non-small cell lung cancer. (Reuters)

Return to headline | Return to top
Hackers Could Harm Diabetics via Insulin Pump Attacks

Oct 4, 2016 | Security Week

By Eduard Kovacs

OneTouch Ping insulin pumps manufactured by Johnson & Johnson-owned Animas are plagued by several vulnerabilities that can be exploited by remote hackers to compromise devices and potentially harm the diabetic patients who use them. While the security holes are serious, the risk is considered relatively low and the vendor does not plan on releasing a firmware update.
Rapid7 researcher Jay Radcliffe, who has been a Type I diabetic for 17 years, analyzedAnimas’ OneTouch Ping insulin pumps. The product has two main components: the actual insulin pump and a remote that controls the pump’s functions from up to 10 feet away.
The four major vulnerabilities found by Radcliffe in the OneTouch Ping product have been detailed in a Rapid7 blog post and an advisory published by the Department of Homeland Security’s CERT Coordination Center.
The researcher discovered that the remote and the pump communicate over an unencrypted channel (CVE-2016-5084), allowing a man-in-the-middle (MitM) attacker to intercept patient treatment and device data. The vendor pointed out that while some data is exposed, it does not include any personally identifiable information.
Another vulnerability identified by Radcliffe is related to the setup process where the pump is paired with the remote – pairing is needed to prevent the pump from accidentally accepting commands from other remotes. The key used by the devices when they exchange information is based on serial numbers and some header information and it’s transmitted without any form of encryption.
This weak pairing (CVE-2016-5085) allows an attacker to spoof the remote and issue commands to arbitrarily dispense insulin, which could lead to the patient having a hypoglycemic reaction.
The researcher also noticed that OneTouch Ping pumps lack protection against replay (CVE-2016-5086) and spoofing (CVE-2016-5686) attacks. These vulnerabilities can be exploited to capture packets and replay them at a later time, or send spoofed packets with arbitrary commands to the pump. In both cases, the attacker can instruct the device to dispense insulin and potentially harm the user.
The OneTouch Ping pump and its remote are not connected to the Internet so these attacks cannot be carried out over very long distances. However, special radio transmission equipment could allow attacks to be conducted from hundreds of feet and possibly even up to one mile, researchers warned.
While these are serious vulnerabilities, Radcliffe said the risk is relatively low and the goal of the research is to raise awareness, allow users to make informed decisions, and get manufacturers to focus more on security when designing their products.
“Removing an insulin pump from a diabetic over this risk is similar to never taking an airplane because it might crash,” the expert noted.
Johnson & Johnson, which notified patients and healthcare professionals of Rapid7’s findings via physical mail, said it does not plan on releasing a firmware update to address the vulnerabilities. However, the company has provided instructions on how attacks can be mitigated using various features available in the OneTouch Ping product.
Rapid7’s approach contrasts with the path taken in August by medical device security firm MedSec, which decided to disclose vulnerabilities found in St. Jude Medical products without notifying the vendor. MedSec decided to team up with an investment research company that used the findings as part of an investment strategy, which led to St. Jude filing a lawsuit.

Return to headline | Return to top

Blog Coverage

R7-2016-07: Multiple Vulnerabilities in Animas OneTouch Ping Insulin Pump

Oct 4, 2016 | Rapid7

By Todd Beardsley

Today we are announcing three vulnerabilities in the Animas OneTouch Ping insulin pump system, a popular pump with a blood glucose meter that services as a remote control via RF communication. Before we get into the technical details, we want to flag that we believe the risk of wide scale exploitation of these insulin pump vulnerabilities is relatively low, and we don’t believe this is cause for panic. We recommend that users of the devices consult their healthcare providers before making major decisions regarding the use of these devices. More on that further down in this post.
Users should also be receiving notification of this issue, along with details for mitigating it, directly from Animas Corporation, via physical mail. We recommend you pay close attention to this communication.
Product description
The OneTouch Ping is a popular medical device used by diabetic patients to self-administer insulin. According to the vendor's website, it is a "two-part system" that "communicates wirelessly to deliver insulin." The two devices communicate in the 900mhz band using a proprietary management protocol.
Summary of findings
The OneTouch Ping insulin pump system uses cleartext communications rather than encrypted communications, in its proprietary wireless management protocol. Due to this lack of encryption, Rapid7 researcher Jay Radcliffe discovered that a remote attacker can spoof the Meter Remote and trigger unauthorized insulin injections.
Due to these insulin vulnerabilities, an adversary within sufficient proximity (which can depend on the radio transmission equipment being used) can remotely harm users of the system and potentially cause them to have hypoglycemic reaction, if he or she does not cancel the insulin delivery on the pump.
These issues have been reported to the vendor, Animas Corporation, CERT/CC, the FDA and DHS. Animas has been highly responsive and is proactively notifying users of the devices, and recommending mitigations for the risks.
Findings and analysis
Three major findings were discovered during the analysis of the product. For raw, uncommented packet data, please see the addendum at the end of this advisory.
R7-2016-07.1: Communications transmitted in cleartext (CVE-2016-5084)
Packet captures demonstrate that the communications between the remote and the pump are transmitted in the clear. During the normal course of operation, de-identified blood glucose results and insulin dosage data is being leaked out for eavesdroppers to remotely receive.
R7-2016-07.2: Weak pairing between remote and pump (CVE-2016-5085)
There is a pairing process that is done during the setup of the pump that partners the pump with a remote. This is to prevent the pump from taking commands from other remotes that it might accidentally pick up transmissions from. The pairing process is done through a 5 packet exchange in the clear where the two devices exchange serial numbers and some header information. This is used to generate a CRC32 "key" (for lack of a better term). This key is used by the remote and pump in all future transmissions and is transmitted in the clear. The 5 packets are identical every time pairing process is done between the remote and insulin pump. This eliminates the possibility of the devices using encryption. Animas patent documents do not outline what exactly is used in the CRC generation, but it includes no encryption.
Attackers can trivially sniff the remote/pump key and then spoof being the remote or the pump. This can be done without knowledge of how the key is generated. This vulnerability can be used to remotely dispense insulin and potentially cause the patient to have a hypoglycemic reaction.
R7-2016-07.3: Lack of replay attack prevention or transmission assurance (CVE-2016-5086)
Communication between the pump and remote have no sequence numbers, timestamps, or other forms of defense against replay attacks. Because of this, attackers can capture remote transmissions and replay them later to perform an insulin bolus without special knowledge, which can potentially cause them to have hypoglycemic reaction.
In addition, the protocol the remote meter and pump use to communicate does not have elements that guarantee the devices have received the packets in a certain order or at all. It is believed that the weakness in this protocol would allow an attacker to perform a spoofed remote attack from a considerable distance from the user/patient. This would be done by a sufficiently powered remote sending commands to the pump in the blind, without needing to hear the acknowledgement packets.
This video demonstrates an attack on the Animas OneTouch Ping.
[Video can be viewed directly on blog post]
Attack range
The OneTouch Ping does not communicate on 802.11 WiFi, or otherwise communicate on the internet. However, it is believed these attacks could be performed from one to two kilometers away, if not substantially further, using sufficient elevation and off-the-shelf radio transmission gear available to ham radio hobbyists.
While the normal use case between the remote and pump is approximately 10 meters. In 2011, Barnaby Jack of McAfee, Inc. claimed an ability to perform a 900mHz band attack from 90 meters away with an external directional antenna (a commercial 3 element yagi), however he did not execute this attack against the OneTouch Ping.
Mitigations
Using industry standard encryption with a unique key pair would mitigate these issues.
Affected users can avoid these issues entirely by disabling the radio (RF) functionality of the device. On the OneTouch Ping Insulin Pump, this is done through the Setup -> Advanced -> Meter/10 screen, and selecting "RF = OFF".
In addition, the vendor has provided other mitigations for these issues, described on their website and in letters being sent to all patients using the pump and health care professionals.
Patients should consult with their own endocrinologist about any aspect of their ongoing medical care.
Researcher's note regarding mitigations
I am Jay Radcliffe, security researcher at Rapid7 and Type I diabetic. Five years ago when I first disclosed security vulnerabilities in an insulin device, I was shocked and overwhelmed with the number of concerned users that came to me looking for advice and help. Here we are again with new research on a medical device. If you are not technical and read the security advisory, you are probably more than worried. I would be too. So let me help clarify and explain some things from a patient perspective. Know that the device I did 90% of my research on, was the device I had attached to me for several years; I know how important this device is to a diabetic’s health.
First, know that we take risks every day. We leave the house. We drive a car. We eat a muffin. We guess the amount of carbs. All entail risk. This research uncovers a previously unknown risk. This is similar to saying that there is risk of an asteroid hitting you, a car accident occurring or miscalculating the amount of insulin for that muffin you ate. Some of those risks are low (asteroid) some are high (insulin). This knowledge of risk allows individuals to make personal decisions. Most people are at limited risk of any of the issues related to this research. These are sophisticated attacks that require being physically close to a pump. Some people will choose to see this as significant, and for that they can turn off the rf/remote features of the pump and eliminate that risk.
Second, always take care of your diabetes first. We all know the dangers of high blood sugar and low blood sugar too. These risks often far outweigh the risks highlighted in this research. If you are concerned, work with your endocrinologist and device vendor to make sure you are making the best choices. Removing an insulin pump from a diabetic over this risk is similar to never taking an airplane because it might crash.
Third, this research is done to make sure the future of our devices are safe. As these devices get more advanced, and eventually connect to the internet (directly or indirectly), the level of risk goes up dramatically. This research highlights why it is so important to wait for vendors, regulators and researchers to fully work on these highly complex devices. This is not something to be rushed into as there is a patient’s life on the line. We all want the best technology right away, but done in a reckless, haphazard way puts the whole process back for everyone.
I do not pump right now. I take shots manually. Not because of the security risks of insulin pumps, but because that is what my doctor and I have chosen. If any of my children became diabetic and the medical staff recommended putting them on a pump, I would not hesitate to put them on an OneTouch Ping. It is not perfect, but nothing is. In this process I have worked with Animas and its parent company, Johnson & Johnson, and know that they are focused on taking care of the patient and doing what is right.
Finally, please know that neither Animas nor Johnson & Johnson has paid me or Rapid7 for any of the research done on the device described here. This is just the advice of one parent and a person who has spent 17 years counting carbs and taking a risk on how much insulin is right.
Disclosure Timeline
This vulnerability advisory was prepared in accordance with Rapid7's disclosure policy.
Thu, Apr 14, 2016: Attempted to contact the vendor at security@animas.com, security@johnsonandjohnson.com, and several other aliases at both domains.
Thu, Apr 21, 2016: Details disclosed to the vendor at productsecurity@its.jnj.com (PGP KeyID: 0xEC69B12DFF06A1CA)
Mon, Apr 25, 2016: Animas initiated complaint handling process
Fri, May 06, 2016: Further clarified details with vendor
Mon, May 09, 2016: Details disclosed to CERT
Thu, Jun 16, 2016: CVEs assigned by CERT
Jul-Sep, 2016: Worked with Animas on validating the reported vulnerabilities
Wed, Sep 21, 2016: Mitigations provided by the vendor
Tue, Oct 04, 2016: Public disclosure

Addendum: Sample Packet Data
The following describes several packet sequences captured between the insulin pump and the remote meter.
Status-1 REMOTE: 00 00 00 04 A3 5A 92 B2 4C 00 0E 0F .....Z..L... REMOTE: 00 00 00 04 A3 5A 92 B2 4C 00 0E 0F .....Z..L... PUMP: 00 00 FF 00 1A D1 81 81 ........ REMOTE: 20 00 0E 00 BF DB CC 6F ......o PUMP: 03 00 F1 04 16 B9 B9 87 2C 01 00 00 ........,... REMOTE: 03 00 F8 00 31 FD C9 EE ....1... PUMP: 03 00 07 04 88 76 DA DD 2C 01 00 00 .....v..,... REMOTE: 03 00 12 00 F0 30 0E FC .....0.. PUMP: 20 00 ED 12 E7 BC 93 43 01 01 27 05 26 02 8F 00 ......C..'.&... PUMP: 57 45 45 4B 44 41 59 00 00 00 WEEKDAY...
PUMP: 05 00 EA 00 D5 8F 84 B3

Return to headline | Return to top
Johnson & Johnson’s insulin pump is totally hackable

Oct 4, 2016 | The Next Web

By Matthew Hughes

Johnson & Johnson has warned its customers about a security vulnerability in one of its insulin pumps. If the flaw in the Animas OneTouch Ping insulin pump was exploited, it could allow an attacker to deliver a potentially fatal overdose of insulin.
The warnings were mailed to 114,000 customers throughout the United States and Canada, as well as doctors who might prescribe the device. It is believed that it is the first time a pharmaceutical company has warned its customers about a security vulnerability.
Johnson & Johnson were eager to emphasize that the chance of someone executing the vulnerability is “extremely low.”
“It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the internet or to any external network.”
The company said that if customers were concerned, they could take a number of steps in order to negate any risk. These include discontinuing use of the accompanying wireless remote, and programming the pump to limit the maximum dose of insulin.
The flaw in the device was identified by Jay Radcliffe, a security researcher with Rapid 7 who himself is diabetic.
He identified that communications between the pump and the remote were not encrypted or scrambled. This means that is possible for an attacker to spoof communications between the two components. This attack can be performed from a distance of 25 feet.
More and more medical devices are incorporating digital elements. This allows greater precision and automation. But it’s inevitable that we will see more and more security threats, which could potentially have life threatening consequences.

Return to headline | Return to top
NEWSBREAK: Patient Notification about Cybersecurity of OneTouch® Ping Insulin Delivery System

Oct 4, 2016 | DiabetesDad

By Tom Karlya

This was sent to me by Animas and I share it with you. I BELIEVE this is more of an informative advisory than anything else………oh yeah; and welcome to 2016
October 4, 2016
Important Information about the cybersecurity of your OneTouch® Ping® Insulin Infusion Pump
Dear Valued Animas® OneTouch® Ping® Pump User,
Since 2008, the OneTouch® Ping® insulin pump system has been helping people with diabetes perform at their best, and we are committed to providing our customers with safe and reliable products. We have been notified of a cybersecurity issue with the OneTouch® Ping®, specifically that a person could potentially gain unauthorized access to the pump through its unencrypted radio frequency communication system.
We want you to know that Animas has investigated this issue and has worked with the appropriate regulatory authorities and security experts, as we are always evaluating ways to further ensure patient safety and security. We also want to assure you that the probability of unauthorized access to the One Touch® Ping® System is extremely low. It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping® system is not connected to the internet or to any external network. In addition, the system has multiple safeguards to protect its integrity and prevent unauthorized action.
If you are concerned about unauthorized access for any reason, the pump’s radio frequency feature can be turned off, which is explained in Chapter 2 of Section III of the OneTouch® Ping® Owner’s Booklet. However, turning off this feature means that the pump and meter will no longer communicate and blood glucose readings will need to be entered manually on the pump.
If you choose to use the meter remote feature, another option for protection is to program the OneTouch® Ping® pump to limit the amount of bolus insulin that can be delivered. Bolus deliveries can be limited through a number of customizable settings (maximum bolus amount, 2-hour amount, and total daily dose).
Any attempt to exceed or override these settings will trigger a pump alarm and prevent bolus insulin delivery. For more information, please see Chapter 10 of Section I of the OneTouch® Ping® Owner’s Booklet. We also suggest turning on the Vibrating Alert feature of the OneTouch® Ping® System, as described in Chapter 4 of Section I. This notifies the user that a bolus dose is being initiated by the meter remote, which gives the patient the option of canceling the bolus.
The bolus delivery alert and the customizable limits on bolus insulin can only be enabled on the pump and cannot be altered by the meter remote. This is also true of basal insulin. We also remind you that any insulin delivery and the source of the delivery (pump or meter remote) are recorded in the pump history, so you can review the bolus dosing. The OneTouch® Ping® System continues to be safe and effective for helping you manage your diabetes.
If you have any questions, please contact Animas Customer Technical Support at emailto:RA-ANMUSCustomSupp@its.jnj.com or 1-877-937-7867.
Sincerely, Animas Corporation 965 Chesterbrook Boulevard Wayne, PA 19087
I am a DiabetesDad.
Please visit my Diabetes Dad FB Page and hit ‘like’.

Return to headline | Return to top

Broadcast Coverage

Fox Chicago News at Noon

Oct 4, 2016 | WFLD Fox Chicago

View clip here: http://beta.criticalmention.com/app/#clip/view/24375011?token=b998bbf2-51c6-465c-b793-1ad4405e5451

Rough transcript: johnson and johnson is warning patients that a hacker could potentially overdose them with insulin. It says the risk is low, but medical experts believe this is actually the first time that manufacturer has issued warning about cyber vulnerability. About 114,000 people use the device in U.S. and Canada. The manufacture is vulnerable because communications are not encrypted to stop hackers from gaining access. Now if a hacker were to do this it would take sophisticated equipment and a lot of technical expertise.

Return to headline | Return to top
7 Action News at Noon

Oct 4, 2016 | WXYZ ABC Detroit

View clip here: http://beta.criticalmention.com/app/#clip/view/24374387?token=b998bbf2-51c6-465c-b793-1ad4405e5451

Rough transcript: a warning from johnson and johnson this noon. Turns out there's a security vulnerability in one touch ping insulin pump and it could be deadly. Johnson & Johnson says a hacker could potentially get in and overdose a diabetic patient with insulin. That said the company is reassuring patients saying the chances are extremely low. right now 114,000 patients use the device here in the US. Letters are being sent to them explaining in detail how to protect their device from hackers.

Return to headline | Return to top
TWC News All Day

Oct 4, 2016 | TWC Albany

View clip here: http://beta.criticalmention.com/app/#clip/view/24374400?token=b998bbf2-51c6-465c-b793-1ad4405e5451
Rough transcript: a warning from johnson and johnson today to diabetic patients. the company is alerting users of its one touch ping insulin pump that hackers can access a cybersecurity flaw to trigger additional doses of the drug without their knowledge. but j&j says "the probablilty of unauthorized access ..is extremely low." the company says it would require technical know- how, sophisticated equipment, and proximity. johnson and johnson says patients can lower their exposure risk by turning off the pump's wireless connection to a blood sugar meter or set a limit on the amount of insulin delivered.

Return to headline | Return to top
ABC15 Mornings

Oct 4, 2016 | KNXC-ABC Phoenix

View clip here: http://beta.criticalmention.com/app/#clip/view/24373365?token=b998bbf2-51c6-465c-b793-1ad4405e5451
Rough transcript: for those of you with insulin pumps, maybe friends of family with them, listen up. johnson & johnson is revealing one type is vulnerable to hackers and it all started with reuters saying a hacker could overdose a patient. Johnson & johnson say the one touch ping could be hacked but the risk is very low. Medical device experts say this is the first time a manufacturer has issued a warning. About 114,000 use that device in North America, scary stuff here dan.

Return to headline | Return to top

Add recipients

Suggested