Preview Newsletter

OneTouch Update 10/5/16

International Top-Tier Coverage

Johnson & Johnson warns its insulin pump could be hacked to potentially cause an overdose
Oct 5, 2016 | International Business Times
By Hyacinth Mascarennas

Pharmaceutical firm Johnson & Johnson has warned diabetic patients that a security vulnerability discovered in one of its insulin pumps could be exploited by hackers and cause a potentially fatal overdose. The health care giant issued a warning on Tuesday (4 October) about a possible cybersecurity issue in its Animas OneTouch Ping insulin pump after researchers at security firm Rapid 7 discovered the vulnerabilities.
Johnson & Johnson says insulin pump 'could be hacked'
Oct 4, 2016 | BBC

Pharmaceutical firm Johnson & Johnson has warned that one of its insulin pumps for diabetics is at risk of being hacked, causing an overdose. The firm said the vulnerability concerned its OneTouch Ping pump which is only sold in the US and Canada.

International Trade Coverage

New insulin pump flaws highlights security risks from medical devices
Oct 5, 2016 | CSO
By Lucian Constantin

Medical device manufacturer Animas, a subsidiary of Johnson & Johnson, is warning diabetic patients who use its OneTouch Ping insulin pumps about security issues that could allow hackers to deliver unauthorized doses of insulin.
Johnson & Johnson warns that its insulin pump can be hacked
Oct 4, 2016 | IT Pro
By Dale Walker

Johnson & Johnson has contacted hospitals and patients after the company discovered a potentially fatal security vulnerability in one of their insulin pumps.

US Trade Coverage

Insulin Pump Can be Hacked: Johnson & Johnson
Oct 5, 2016 | WebMd

The OneTouch Ping insulin pump is vulnerable to hacking, Johnson & Johnson says.
Insulin Pump Vulnerable To Cyberattack: Hackers May Exploit Device To Overdose Diabetic Patients With Insulin, J&J Warns
Oct 5, 2016 | Tech Times
By Rhodi Lee

Johnson & Johnson has sent a warning to doctors and patients after it learned of a security vulnerability in one of its insulin pumps that hackers may possibly exploit to overdose diabetic patients with insulin.
Insulin pump from Animas can be sabotaged to deliver overdose; risk 'extremely low'
Oct 5, 2016 | SC Magazine
By Bradley Barth

The OneTouch Ping Insulin Pump system from medical device manufacturer Animas Corporation contains three vulnerabilities that could allow a remote attacker to trigger an overdose, warned Internet security firm Rapid7, in an announcement later confirmed by Animas.
Pharmalot, Pharmalittle: Bernie Sanders stumps for controversial California drug pricing bill
Oct 5, 2016 | STAT News
By Ed Silverman

Only Relevant Portions Included: Johnson & Johnson says a cyber security bug in its OneTouch Ping insulin pump could be hacked and cause diabetic patients to overdose with insulin, though the hacking risk is believed to be low, Reuters tells us. Last month, the health care giant wrote doctors and patients that a hacker could identify the specific frequency the device is using and then issue commands to the pump.
J&J’s Animas warns customers over cybersecurity risk with OneTouch Ping insulin pump
Oct 5, 2016 | MDBR

Johnson & Johnson’s (J&J) subsidiary Animas has alerted its customers over the cybersecurity issue with the OneTouch Ping insulin infusion pump.
Can Medical Devices Be Hacked? Johnson & Johnson Says Yes.
Oct 5, 2016 | Medical Device Investing News
By Chelsea Pratt

Johnson & Johnson (NYSE:JNJ) is warning customers that its Animas OneTouch Ping Insulin pump can be hacked—a cybersecurity vulnerability that could be deadly. And while the FDA says it knows of zero medical device hacking attempts to date, the subject is one of growing concern. In fact, St. Jude Medical (NYSE:STJ) was accused of ignoring serious cybersecurity vulnerabilities in its own medical devices just last month.
Johnson & Johnson’s (J&J) subsidiary Animas has alerted its customers over the cybersecurity issue with the OneTouch Ping insulin infusion pump. The company informed that it has investigated the cybersecurity issue and worked with the appropriate regulat
Oct 5, 2016 | iTech Post

Medical devices manufacturer Johnson & Johnson has warned diabetic patients when using their insulin pump. The company admitted that their Animas OneTouch Ping insulin pump faces a security issue. Apparently, it is vulnerable to attacks from hackers. This is after a security firm revealed the said flaw.
Insulin pump users warned of hacking risk, but probability of attack is 'extremely low'
Oct 5, 2016 | Medical Device Daily
By Amanda Pederson

Johnson & Johnson's diabetes unit warned patients this week that the Animas Onetouch Ping insulin pumps may be vulnerable to a cyberattack, but the probability of one of the devices actually being hacked is "extremely low," the company said.
J&J Says Insulin Device Can Be Hacked But Risk Is Low
Oct 4, 2016 | Law360
By Kat Greene

Johnson & Johnson warned users of its OneTouch Ping insulin pump that the technology is vulnerable to hackers who could potentially trigger insulin overdoses, according to a letter Tuesday that recommended taking precautions.
J&J warns patients about cybersecurity vulnerabilities in insulin pump
Oct 4, 2016 | Becker's Hospital Review
By Mackenzie Bean

New Brunswick, N.J.-based Johnson & Johnson identified a low-risk security issue in one of its insulin pumps that could allow hackers to overdose diabetic patients with insulin, reported Reuters.
Researcher Roots Out Security Flaws In Insulin Pumps
Oct 4, 2016 | Dark Reading
By Sara Peters

Jay Radcliffe, researcher and diabetic who found the flaws in Johnson & Johnson Animas OneTouch Ping insulin pump, 'would not hesitate' to allow his own children be treated by the device if they were diabetic and advised to do so by physicians.
Inside Scoop: J&J Confirms Insulin Pump Security Flaws
Oct 5, 2016 | Carreers Info Security
By Kolbasuk McGee

Vulnerabilities in certain Johnson & Johnson wireless insulin pumps put the devices at risk for hacker exploitations that could cause the delivery of an insulin overdose to patients, says cybersecurity researcher Jay Radcliffe, who discovered the flaws.
Will Johnson & Johnson (JNJ) Stock Be Hurt by Cyber Security Vulnerability?
Oct 4, 2016 | TheStreet
By Rachel Graf

Johnson & Johnson (JNJ) yesterday warned patients of a cyber security vulnerability in its Animas OneTouch Ping insulin pump that might allow hackers to overdose diabetics with insulin.
Johnson & Johnson (JNJ) Says Insulin Pump Can Be Hacked
Oct 5, 2016 | TheStreet
By Natalie Walters

Johnson & Johnson (JNJ) sent out a letter to users of its Animas OneTouch Ping insulin pump to warn them that it could be hacked, although the risk of that happening is extremely low. Reuters first broke the story earlier Tuesday.
Johnson & Johnson says insulin pump can be hacked
Oct 4, 2016 | FierceHealthcare
By Dan Bowman

Johnson & Johnson, it appears, has no interest in being run through the same gauntlet as fellow device maker St. Jude Medical for its cybersecurity sins.
Security flaws leave J&J insulin pumps vulnerable to hacking
Oct 4, 2016 | MedCity News
By Neil Versel

It’s not quite the “Rise of the Machines” depicted in the “Terminator” movies, but the Internet of Things does have its safety issues.
Oh, Great, Now It's Possible to Literally Hack Someone's Body
Oct 4, 2016 | Thrillist
By Christina Stiehl

Johnson & Johnson was just trying to help diabetes patients when it created its new Animas OneTouch Ping insulin pump, which allows people to control the amount of insulin delivered into their bodies with a simple touch of a wireless remote. It's easy, it's discreet, it allows patients to accurately control their insulin levels -- and it's vulnerable to hackers who secretly want to overdose people on insulin.

US Regional Coverage

Boston company says some insulin pumps open to cyberattack
Oct 5, 2016 | Boston Globe
By Curt Woodward

Johnson & Johnson warned consumers Tuesday about security vulnerabilities in an insulin pump after Boston cybersecurity company Rapid7 Inc. discovered the device’s remote control could be hacked by a digital attacker, potentially delivering extra doses of insulin.

US National Broadcast Coverage

Squawk Box
Oct 5, 2016 | CNBC

View clip here: http://beta.criticalmention.com/app/#clip/view/24382543?token=5c174860-e2ba-4942-8b66-b6a4b80438ef
Varney & Company
Oct 5, 2016 | Fox Business

View clip here: http://beta.criticalmention.com/app/#clip/view/24382924?token=5c174860-e2ba-4942-8b66-b6a4b80438ef
Nightly Business Report
Oct 4, 2016 | PBS

View clip here: http://beta.criticalmention.com/app/#clip/view/24381991?token=5c174860-e2ba-4942-8b66-b6a4b80438ef
ABC World News Tonight with David Muir
Oct 5, 2016 | ABC

View clip here: http://beta.criticalmention.com/app/#clip/view/24382336?token=5c174860-e2ba-4942-8b66-b6a4b80438ef
Closing Bell
Oct 4, 2016 | CNBC

View clip here: http://beta.criticalmention.com/app/#clip/view/24382183?token=5c174860-e2ba-4942-8b66-b6a4b80438ef
Bloombeg Markets
Oct 4, 2016 | Bloomberg TV

View clip here: http://beta.criticalmention.com/app/#clip/view/24382561?token=5c174860-e2ba-4942-8b66-b6a4b80438ef

International Top-Tier Coverage

Johnson & Johnson warns its insulin pump could be hacked to potentially cause an overdose

Oct 5, 2016 | International Business Times

By Hyacinth Mascarennas

Pharmaceutical firm Johnson & Johnson has warned diabetic patients that a security vulnerability discovered in one of its insulin pumps could be exploited by hackers and cause a potentially fatal overdose. The health care giant issued a warning on Tuesday (4 October) about a possible cybersecurity issue in its Animas OneTouch Ping insulin pump after researchers at security firm Rapid 7 discovered the vulnerabilities.
Launched in 2008, the Animas OneTouch Ping pump allows diabetic patients to give themselves a dose of insulin using a Wi-Fi remote control that wirelessly communicates with the insulin pump from up to 10 feet away using an unencrypted radio frequency communication system.
The company said there have been no reported attacks and described the risk as "extremely low."
"It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the internet or to any external network," the company wrote in a letter, obtained by Reuters, mailed to 114,000 customers throughout US and Canada, as well as doctors who may prescribe the device. "In addition, the system has multiple safeguards to protect its integrity and prevent unauthorized action."
Jay Radcliff, a diabetic and researcher at Rapid7, said he discovered the vulnerabilities back in April and disclosed them in a blog post published on 28 September. He found that hackers could potentially hijack communications between the pump and its radio frequency remote from up to 25 feet away, allowing a malicious intruder to potentially administer unauthorised additional doses of the diabetes drug.
"The OneTouch Ping insulin pump system uses cleartext communications rather than encrypted communications, in its proprietary wireless management protocol," the firm wrote. "Due to this lack of encryption, Rapid7 researcher Jay Radcliffe discovered that a remote attacker can spoof the Meter Remote and trigger unauthorized insulin injections."
Johnson & Johnson said they confirmed Radcliffe's report, but maintained that the pump is still "safe and reliable." The company said patients worried about the risks could take additional precautions such as turning off the pump's radio frequency feature or limiting the amount of insulin delivered.
The latest announcement comes amid rising concerns surrounding the risk of medical device hacks, given the rise in automation and the Internet of Things that offer more connected solutions that are often more vulnerable to cyberattacks.
In February, a senior researcher at security firm Kaspersky Lab demonstrated how he could easily hack into a hospital's critical network, with permission, and access an MRI device.
The US Food and Drug Administration has also encouraged medical device manufacturers to work closely with security researchers to mitigate risks of cyberattacks and provide patients with vital information about device bugs to allow them to "make informed decisions" regarding the products.
"As these devices get more advanced, and eventually connect to the internet (directly or indirectly), the level of risk goes up dramatically," Radcliff wrote. "This research highlights why it is so important to wait for vendors, regulators and researchers to fully work on these highly complex devices. This is not something to be rushed into as there is a patient's life on the line."

Return to headline | Return to top
Johnson & Johnson says insulin pump 'could be hacked'

Oct 4, 2016 | BBC

Pharmaceutical firm Johnson & Johnson has warned that one of its insulin pumps for diabetics is at risk of being hacked, causing an overdose.
The firm said the vulnerability concerned its OneTouch Ping pump which is only sold in the US and Canada.
However, it told the BBC there had been no reported attacks and the risk was "extremely low".
"It would require technical expertise, sophisticated equipment and proximity to the pump," it said.
The disclosure was made in a letter to patients on 27 September, the firm said.
The Animas OneTouch Ping pump, which was launched in 2008, enables diabetics to dose themselves with insulin using a Wi-Fi remote control. This removes the hassle of directly accessing the device, which can be worn under the patient's clothes.
Johnson & Johnson said the pump was not connected to the internet or to any external network.
But Jay Radcliffe - a diabetic and researcher with cyber security firm Rapid7 - said he had discovered it could still be hacked from a distance of 25 feet.
He found communications between the pump and its radio frequency remote could be hijacked - in theory allowing a hacker to administer unauthorised injections.'Low risk'
Johnson & Johnson (J&J) said it had confirmed Mr Radcliffe's findings but that the pump remained "safe and reliable".
It said worried patients could take precautions, such as not using the pump's remote and programming the device to limit its maximum dose.
There are growing concerns over the risk of medical device hacks.
In February, cyber security firm Kaspersky Lab revealed it had hacked into a hospital's IT infrastructure - with its permission - and was able to access an MRI device.
And the US Food & Drug Administration is said to be preparing formal guidance for manufacturers on how to respond to reports of cyber attacks.
The agency has previously urged medical firms to work with cyber security experts to mitigate risks - however it says it knows of no cases where criminals have hacked a device to cause harm.

Return to headline | Return to top

International Trade Coverage

New insulin pump flaws highlights security risks from medical devices

Oct 5, 2016 | CSO

By Lucian Constantin

Medical device manufacturer Animas, a subsidiary of Johnson & Johnson, is warning diabetic patients who use its OneTouch Ping insulin pumps about security issues that could allow hackers to deliver unauthorized doses of insulin.CSO Threat Intelligence Survival Guide
If enterprises want to understand how they can better invest in security defenses, build the necessaryREAD NOW
The vulnerabilities were discovered by Jay Radcliffe, a security researcher at Rapid7 who is a Type I diabetic and user of the pump. The flaws primarily stem from a lack of encryption in the communication between the device's two parts: the insulin pump itself and the meter-remote that monitors blood sugar levels and remotely tells the pump how much insulin to administer.
The pump and the meter use a proprietary wireless management protocol through radio frequency communications that are not encrypted. This exposes the system to several attacks.
First, passive attackers can snoop on the traffic and read the blood glucose results and insulin dosage data. Then, they can trivially spoof the meter to the pump because the key used to pair the two devices is transmitted in clear text.
"This vulnerability can be used to remotely dispense insulin and potentially cause the patient to have a hypoglycemic reaction," the Rapid7 researchers said in a blog post.
A third issue is that the pump lacks protection against so-called relay attacks, where a legitimate command is intercepted and then is played back by the attacker at a later time. This allows attackers to perform an insulin bolus without special knowledge, the researchers said.
While the meter-remote is advertised to work from up to 10 meters away, it is technically possible to launch spoofing attacks from much greater distances with more powerful radio transmission gear like that used by ham radio hobbyists.
Animas has published a security notice on its website with recommendations and will also send letters to customers.
The company views the probability of unauthorized access to the One Touch Ping system as very low, saying these attacks "would require technical expertise, sophisticated equipment, and proximity to the pump."
Concerned users can turn off the pump's radio frequency feature, but patients will then have to enter the blood glucose readings manually because the meter will no longer be able to transmit them.
Additionally, the pump can be programmed to limit the amount of bolus insulin that can be delivered at once, over a two-hour period and per day. Attempts to exceed these settings will trigger a pump alarm and prevent bolus insulin delivery, Animas said.
The high or low blood sugar risks a diabetic has to deal with every day are more serious than the risks introduced by these vulnerabilities, Radcliffe said. Removing an insulin pump from a diabetic over the security issues would be comparable to never flying in an airplane because it might crash, he said.
However, "as these devices get more advanced, and eventually connect to the internet (directly or indirectly), the level of risk goes up dramatically," the researcher warned. "This research highlights why it is so important to wait for vendors, regulators, and researchers to fully work on these highly complex devices."
Before going public, Radcliffe worked with Animas and parent company, Johnson & Johnson, to help them understand the flaws and develop mitigations. This is in stark contrast to researchers from a company called MedSec who recently chose to share information about vulnerabilities in heart devices from St. Jude Medical with an investment research firm so the firm could short the device maker's stock.
The security of medical devices has been a hot topic in the security research community for the past several years. Some vendors have taken notice and have launched vulnerability coordination programs, and the U.S. Food and Drug Administration actively encourages medical device manufacturers to work with security researchers.

Return to headline | Return to top
Johnson & Johnson warns that its insulin pump can be hacked

Oct 4, 2016 | IT Pro

By Dale Walker

Johnson & Johnson has contacted hospitals and patients after the company discovered a potentially fatal security vulnerability in one of their insulin pumps.
The pharmaceutical and manufacturing giant delivered a letter to users of the pump, a copy of which Reuters received.
Almost 114,000 patients use the device in the United States and Canada.
Johnson & Johnson discovered that a hacker could potentially manipulate the amount of insulin a patient receives, which could lead to dangerously lowered blood sugar, or life-threatening hypoglycemia.
The vulnerability affects the Animas OneTouch Ping insulin pump, which was launched in 2008. This model is sold with a wireless control allowing patients to remotely operate the pump when insulin is needed.
Speaking to Reuters, Rapid 7 researcher Jay Radcliffe explained he had identified a way for a hacker to manipulate the communications between the remote control and pump, in order to give a higher than normal dose of insulin.
Radcliffe, who is a diabetic, explained to Reuters that the lack of encryption on these communications is the cause of this vulnerability.
In the letter released today, Johnson & Johnson outlined several steps patients can take to prevent potential attacks.
The company recommended that customers should either stop using the remote control device or reprogram the pump manually to limit insulin dosage.
Despite the possible security flaw, Johnson & Johnson believes the device is safe and is urging customers to keep using the product.
As the pump is not connected to the internet and operates with a maximum reach, the company believes a hack would be unlikely.
Its letter stated that: "The probability of unauthorized access to the OneTouch Ping system is extremely low. It would require technical expertise, sophisticated equipment and proximity to the pump..."
So far the Johnson & Johnson Animas OneTouch Ping is the only model identified as having a security flaw.
A Johnson & Johnson spokesperson said: "We are not issuing a recall as we are confident that the Animas OneTouch Ping insulin delivery system is safe and reliable for use. Animas has contacted patients and health care providers about this issue to assure them that the probability of unauthorized access to the One Touch Ping System is extremely low, as it would require technical expertise, sophisticated equipment and proximity to the pump.
"We have also informed patients and health care providers how to enable various pump features for advanced protection should they be concerned."

Return to headline | Return to top

US Trade Coverage

Insulin Pump Can be Hacked: Johnson & Johnson

Oct 5, 2016 | WebMd

The OneTouch Ping insulin pump is vulnerable to hacking, Johnson & Johnson says.
A cybersecurity flaw in the device could allow hackers to infuse potentially life-threatening additional doses of insulin without a patient's knowledge, Bloomberg News reported.
"The probability of unauthorized access to the OneTouch Ping System is extremely low," the company said in a letter to patients. "It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the Internet or to any external network."
Johnson & Johnson said it has taken steps to correct the problem and outlined how patients can reduce their risks, Bloomberg reported.

Return to headline | Return to top
Insulin Pump Vulnerable To Cyberattack: Hackers May Exploit Device To Overdose Diabetic Patients With Insulin, J&J Warns

Oct 5, 2016 | Tech Times

By Rhodi Lee

Johnson & Johnson has sent a warning to doctors and patients after it learned of a security vulnerability in one of its insulin pumps that hackers may possibly exploit to overdose diabetic patients with insulin.
The company, however, said that it has not yet learned of any instance that a hacking attempt was made on the Animas OneTouch Ping insulin pump. Johnson & Johnson also said that it is working with security experts and regulatory experts to ensure patient safety and security.
"We also want to assure you that the probability of unauthorized access to the One Touch Ping System is extremely low," the company said in a statement addressed to users of the device.
The company added that sophisticated equipment, technical expertise and proximity to the device would be needed for such an attack since the OneTouch Ping system is not connected to any external network such as the internet.
"In addition, the system has multiple safeguards to protect its integrity and prevent unauthorized action."
Diabetic patients can use the wireless remote control that communicates with the Animas OneTouch Ping to order the pump to give them a dose of insulin without having to access the device itself. The medical device is typically worn under the clothing and can be awkward to reach.
Security firm Rapid7 Inc. researcher Jay Radcliffe, a diabetic himself, however, found out that there are possible ways for a hacker to spoof the communication between the insulin pump and the remote control, which could potentially cause the pump to deliver unauthorized injection.
Radcliffe said that the system is vulnerable since the communications are not encrypted to prevent hackers from gaining unauthorized access to the device.
"The OneTouch Ping insulin pump system uses cleartext communications rather than encrypted communications, in its proprietary wireless management protocol," Rapid7 reported in a blog post dated Sept. 28.
About 114,000 patients in Canada and the U.S. use the OneTouch Ping insulin delivery systems. Users of the device were advised to turn off the radio frequency feature or to set the pump to vibrate when an insulin dose is being delivered so they would know and be able to cancel an unauthorized order.
Marene Allison, Johnson & Johnson's chief information security officer, said that future insulin delivery pumps will come with security measures. Johnson & Johnson has also been working with the U.S. Food and Drug Administration (FDA) on medical device cybersecurity guidelines.

Return to headline | Return to top
Insulin pump from Animas can be sabotaged to deliver overdose; risk 'extremely low'

Oct 5, 2016 | SC Magazine

By Bradley Barth

The OneTouch Ping Insulin Pump system from medical device manufacturer Animas Corporation contains three vulnerabilities that could allow a remote attacker to trigger an overdose, warned Internet security firm Rapid7, in an announcement later confirmed by Animas.
Rapid7 took steps to allay the public's fears, noting that such a scenario is highly unlikely and could only be carried out against a targeted victim by an attacker located in proximity. “These devices use proprietary communications in their own little ecosphere. It's not like you could create a worm and attack all of them,” said Jay Radcliffe, senior security consultant and researcher at Rapid7, who discovered the vulnerabilities. “This is an exceptionally low-risk situation for patients,” he added, in an interview with SCMagazine.com.
Still, the potentially fatal ramifications are serious enough that Animas has gone public and suggested mitigations for customers with concerns.
The OneTouch Ping system is actually comprised of two devices in one: the insulin pump itself, as well as a blood glucose meter that allows users to control the pump remotely via wireless radio frequency signals, using a proprietary management protocol operating in the 900MHz band. According to an advisory published earlier this week by Rapid7, bad actors with access to radio transmission gear typically used by ham radio hobbyists can potentially intercept and modify these signals from a distance of one to two kilometers, or further depending on factors such as elevation.
Two of the vulnerabilities are the result of a lack of encryption between the remote and pump during their interactions. For starters, all communications between the remote and the pump – including de-identified blood glucose results and insulin dosage data – are broadcast in the clear, leaving them accessible to wireless eavesdroppers, warned Rapid7. Secondly, the pairing process that wirelessly marries the two devices and prevents the pump from receiving transmissions from foreign sources, consists of a five-packet exchange that also does not use encryption.
The exchange, which is exactly the same every time the pairing is initiated, essentially creates a key that enables transmissions between the two devices. According to Rapid7, “Attackers can trivially sniff the remote/pump key and then spoof being the remote or the pump. This can be done without knowledge of how the key is generated. This vulnerability can be used to remotely dispense insulin and potentially cause the patient to have a hypoglycemic reaction.”
Finally, communication between the two devices has no built-in defenses against replay attacks in which attackers intercept the remote meter's transmissions and then resend them later – perhaps multiple times – in order to administer insulin at dangerous levels. Moreover, Rapid7 reported, “the protocol the remote meter and pump use to communicate does not have elements that guarantee the devices have received the packets in a certain order or at all. It is believed that the weakness in this protocol would allow an attacker to perform a spoofed remote attack from a considerable distance from the user/patient. This would be done by a sufficiently powered remote sending commands to the pump in the blind, without needing to hear the acknowledgement packets.”
Radcliffe is himself a Type 1 diabetic who at one time used the OneTouch Ping product until he began taking insulin shots manually instead (not because of security reasons). Naturally, his past experience with the product triggered his curiosity about its security. “I think that's the most important aspect of me being a diabetic –understanding how the treatment works. If you don't have an understanding of how these devices impact the human body – a person's health – it's really hard to put that in the context of what these technology vulnerabilities would do and how they put a person or patient at risk,” Radcliffe told SCMagazine.com.
Radcliffe and Rapid7 initially notified Animas of the vulnerabilities in April 2016, also contacting the CERT Coordination Center, the FDA and DHS. “I feel very comfortable with Johnson & Johnson's response, and if my children needed insulin, I would not hesitate to use Animas,” said Radcliffe.
“…The probability of unauthorized access to the OneTouch Ping System is extremely low,” reads an online statement published today by West Chester, Pennsylvania-based Animas, a division of Johnson & Johnson. “It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the Internet or to any external network. In addition, the system has multiple safeguards to protect its integrity and prevent unauthorized action.”
To mitigate its product's flaws, Animas suggested that users program the pump to limit the amount of insulin delivered within a given period of time. (Under such a setting, an alarm would go off if the pump exceeded the limit.) Users can also enable a Vibration Alert feature that indicates whenever the pump is initiating a dose – thus preventing a would-be attacker from secretly administering insulin.
Alternatively, the user can simply turn the pump's RF feature off, although that would render the remote useless, forcing the patient to operate the pump manually.
The Rapid7 advisory also noted that Animas itself could mitigate these issues by “using industry standard encryption with a unique key pair.”

In this particular instance, the medical product in question is not Internet-enabled. But as more of these devices become connected online, additional precautions will be necessary, cautioned Eve Maler, VP of innovation and emerging technology at digital identity company ForgeRock, in comments emailed to SCMagazine.com. “We believe that in the very short term, IoT systems will begin implementing identity-centric security and privacy controls from the device out to the cloud,” said Maler. “In order to activate and protect an interconnected system where devices have the ability to communicate to and through each other, these Internet-connected devices must be able to continuously authenticate their user's identity and offer privacy controls for sharing data selectively.”

Return to headline | Return to top
Pharmalot, Pharmalittle: Bernie Sanders stumps for controversial California drug pricing bill

Oct 5, 2016 | STAT News

By Ed Silverman

Only Relevant Portions Included:
Johnson & Johnson says a cyber security bug in its OneTouch Ping insulin pump could be hacked and cause diabetic patients to overdose with insulin, though the hacking risk is believed to be low, Reuters tells us. Last month, the health care giant wrote doctors and patients that a hacker could identify the specific frequency the device is using and then issue commands to the pump.

Return to headline | Return to top
J&J’s Animas warns customers over cybersecurity risk with OneTouch Ping insulin pump

Oct 5, 2016 | MDBR

Johnson & Johnson’s (J&J) subsidiary Animas has alerted its customers over the cybersecurity issue with the OneTouch Ping insulin infusion pump.
The company informed that it has investigated the cybersecurity issue and worked with the appropriate regulatory authorities and security experts to solve the issue.
Animas also said that the probability of unauthorized access to the One Touch Ping system is very low, as it will not be connected to the internet or to any external network.
The system also features various safeguards to protect its integrity and prevent unauthorized action.
OneTouch pump’s radio frequency feature can be turned off to avoid the unauthorized access, while meter remote feature can be used to limit the amount of bolus insulin that can be delivered.
In addition, the firm noted that the bolus delivery alert and the customizable limits on bolus insulin can only be enabled on the pump and cannot be altered by the meter remote.
OneTouch Ping is a two-part system, which communicates wirelessly to deliver insulin. The two devices communicate in the 900mhz band using a proprietary management protocol.
It uses cleartext communications rather than encrypted communications in its proprietary wireless management protocol.
Rapid7 researcher Jay Radcliffe observed that a remote attacker can spoof the meter remote and trigger unauthorized insulin injections due to the lack of encryption.

Return to headline | Return to top
Can Medical Devices Be Hacked? Johnson & Johnson Says Yes.

Oct 5, 2016 | Medical Device Investing News

By Chelsea Pratt

Johnson & Johnson (NYSE:JNJ) is warning customers that its Animas OneTouch Ping Insulin pump can be hacked—a cybersecurity vulnerability that could be deadly. And while the FDA says it knows of zero medical device hacking attempts to date, the subject is one of growing concern. In fact, St. Jude Medical (NYSE:STJ) was accused of ignoring serious cybersecurity vulnerabilities in its own medical devices just last month.
So can medical devices be hacked? Absolutely.
With the Animas OneTouch Ping Insulin pump, for example, hackers may tamper with unencrypted communications between a wireless remote and the pump itself, triggering a potential insulin overdose in users.
And while Johnson & Johnson says the threat is minimal—the hacker would need significant technical knowledge and be standing no more than 25 feet away—the mere possibility of an attack on patients has caused the company to take rapid action.
After verifying the vulnerabilities, first discovered by Rapid7’s Jay Radcliffe, and consulting with the FDA, Johnson & Johnson sent a letter to 114,000 users in North America explaining the security issue and how it could be resolved.
The company recommends discontinuing use of the wireless remote or setting a maximum dose limit on the device itself, steps that Radcliffe deemed sufficient: as he told Fortune, “They can give peace of mind to to the patient or parent of a child using the device.”
But the solution isn’t always so simple. St. Jude Medical, for example, was accused of multiple vulnerabilities in its products—ones so severe that the devices would all need to be recalled. “There is a strong possibility that close to half of STJ’s revenue is about to disappear for approximately two years,” the report from Muddy Waters Research claimed.
No wonder that medical device manufacturers, as well as the FDA, are starting to reexamine the question of cybersecurity.
By sending that letter to customers, Johnson & Johnson became the first medical device manufacturer to ever warn customers about a hacking threat—but they probably won’t be the last. In fact, the FDA is betting on it.
The regulatory body is currently formulating guidelines for medical manufacturers on how they should respond to reports on their products’ cybersecurity—such as those that came out of Muddy Waters Research or Rapid7 in recent months. That suggests they see this as ongoing issue going forward—and therefore, it’s something investors should pay attention to.

Return to headline | Return to top
Johnson & Johnson’s (J&J) subsidiary Animas has alerted its customers over the cybersecurity issue with the OneTouch Ping insulin infusion pump. The company informed that it has investigated the cybersecurity issue and worked with the appropriate regulat

Oct 5, 2016 | iTech Post

Medical devices manufacturer Johnson & Johnson has warned diabetic patients when using their insulin pump. The company admitted that their Animas OneTouch Ping insulin pump faces a security issue. Apparently, it is vulnerable to attacks from hackers. This is after a security firm revealed the said flaw.
The Hackable Animas OneTouch Ping Insulin Pump
It was the computer security firm Rapid 7 that discovered the problem. Reuters had reported about this first, according to USA Today. Rapid 7 immediately informed Johnson & Johnson.
Hackers can actually hack through the pump's unencrypted radio frequency communication system. They will be able to manipulate the amount of insulin dose. This is because the system aids in sending commands and information via a wireless remote control.
Rapid 7's Senior Security Researcher Jay Radcliffe has described how to hack the system. First, the hacker would have to determine that a person has the said insulin pump. To achieve this, a radio frequency monitor has to be used. Then, the hacker can record a command on how much insulin dosage is delivered.
If the insulin dose is too high or low dose, it can be fatal. However, Johnson & Johnson ensures patients that there's a low risk of danger. They also assured that there are still no instances of hacked insulin pumps.
The company's Chief Information Security Officer Marene Allison said that the hacker has to be within 35 feet of the insulin pump. It will also require ingenious knowledge to succeed the hack. The hacker must also have radio antennas.
Diabetic patients are told not to worry unless a person exerts such efforts to harm another human being.
The Future Of Johnson & Johnson's Insulin Pumps
The USA Today reports that this is the first time a company has taken such action. Radcliffe also praised how Johnson & Johnson has handled the issue. In their defense, he said that the pumps were designed when threats to cybersecurity had not been thought of yet.
Allison disclosed that the company has been working on guidelines regarding medical device cybersecurity. They have been doing that for the past 18 months with the Food and Drug Administration. The company will incorporate security measures in their future insulin delivery pumps.

Return to headline | Return to top
Insulin pump users warned of hacking risk, but probability of attack is 'extremely low'

Oct 5, 2016 | Medical Device Daily

By Amanda Pederson

Johnson & Johnson's diabetes unit warned patients this week that the Animas Onetouch Ping insulin pumps may be vulnerable to a cyberattack, but the probability of one of the devices actually being hacked is "extremely low," the company said.
The pump could potentially be accessed through its unencrypted radio frequency communication system, but such an attack would require technical expertise, sophisticated equipment and proximity to the device, according to a letter the West Chester, Pa.-based Animas Corp. sent to patients on Monday. The company noted that the Onetouch Ping system is not connected to the Internet or any external network.
Patients do have the option of turning the pump's radio frequency feature off to prevent unauthorized access, Animas said, but that would also block communication between the pump and meter and blood glucose readings would need to be entered manually on the pump.
Another option would be to program the pump to limit the amount of bolus insulin that can be delivered, using one of several customizable settings, such as the maximum bolus amount setting, the two-hour amount, and the total daily dose setting. If a hacker attempted to exceed or override these settings, Animas said, the attack would trigger a pump alarm and prevent bolus insulin delivery.
The company also recommended patients use the system's vibrating alert feature so that if a bolus dose of insulin is initiated remotely they would have the option of canceling the delivery.
Both of these safety measures – the bolus delivery alert and the customizable limits – can only be enabled on the pump itself, Animas said, and cannot be altered by the meter remotely. The system is also designed to record any insulin delivery and its source (pump or meter remote) for the patient to review.
Animas assured patients in the letter that it has worked with regulatory authorities and security experts to address the issue and that the Onetouch Ping system continues to be safe and effective for managing diabetes. Still, the warning comes at a time when the device industry is particularly vulnerable to cybersecurity concerns.
Last month St. Jude Medical Inc. filed a lawsuit against short-selling firm Muddy Waters Capital LLC, Medsec Holdings Ltd., and their affiliates over a report claiming St. Jude's implantable heart devices were vulnerable to cyberattack. The St. Paul, Minn.-based company said it filed the suit to hold the firms and individuals accountable for their "false and misleading tactics," and to "set the record straight" about the security of St. Jude devices. Shortly after the claims were made, the company's stock (NYSE; STJ), which had been trading around $82 a share before the Muddy Waters report, dropped about 5 percent. The stock has fluctuated between $79.55 and $80.71 over the past month, and closed Tuesday at $79.82. (See Medical Device Daily, Aug. 30 and Sept. 8, 2016.)
Johnson & Johnson's stock (NYSE; JNJ) held steady Tuesday after news of the Animas letter, closing at $118.82, a 0.01 percent increase over the day's opening.
Past problems abound
Cybersecurity issues are not new to the device industry, but it has been a growing concern over the past couple of years. In 2015 the FDA made an unprecedented move by telling hospitals not to use the Symbiq infusion pump from Lake Forest, Ill.-based Hospira Inc., now owned by Pfizer Inc., because of specific cybersecurity vulnerabilities associated with the device. The company later issued guidance on the topic to clarify how existing quality regulations apply to cybersecurity maintenance activities. The topic has also gained attention at industry events over the past year, including the annual meeting of the Advanced Medical Technology Association (Advamed). (See Medical Device Daily, Oct. 7, 2015.)
At a heavily-attended Advamed panel last year, Scott Rea, vice president of government and education relations at Digicert Inc., said device companies would be better off putting a plan in place for when a cybersecurity issue does happen, rather than focusing all the attention on preventing an attack. There is "no such thing" as a perfect solution that will solve all the industry's cybersecurity problems, Rea said.
It may be difficult to understand the motivation behind a cyberattack on an individual infusion pump, or other device, but cybersecurity firm Trapx suggested in a 2015 report that hackers may be trying to hijack medical data, which has become more valuable to cybercriminals than stolen credit card numbers. (See Medical Device Daily, June 10, 2015.)
Medtronic plc dealt with a similar issue with one of its infusion pumps back in 2011 after security software manufacturer Mcafee alerted the company to a flaw in some models of the Paradigm insulin pumps. Mcafee said at the time that such problems could exist with other drug pumps as well, given the devices' increasing use of wireless technology and software.

Return to headline | Return to top
J&J Says Insulin Device Can Be Hacked But Risk Is Low

Oct 4, 2016 | Law360

By Kat Greene

Johnson & Johnson warned users of its OneTouch Ping insulin pump that the technology is vulnerable to hackers who could potentially trigger insulin overdoses, according to a letter Tuesday that recommended taking precautions.

The company’s Animas Corp. unit sent out the message advising that even though the device isn’t connected to the internet, its unencrypted radio frequency communication system opens it up to hackers. They could technically trigger extra doses of the diabetes drug, which could prove life-threatening, the letter said.

The risk of someone tapping in to add more insulin doses is “extremely low,” the company said. “It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the internet or to any external network.”

The device already has safeguards in place, the company said. Still, it advised customers who might be concerned about unauthorized access to turn off the radio feature, which means the device couldn’t communicate with the blood glucose remote, or to limit the amount of insulin the device can deliver, among other precautions, according to the letter.

Cybersecurity researcher Jay Radcliffe discovered that the pump system doesn’t use encrypted communications in its proprietary wireless management protocol, meaning a remote attacker could trigger unauthorized injections, according to a blog post for Rapid7, a security and information technology company where he works as a senior security consultant.

Radcliffe, a diabetic, famously hacked into his own Medtronic Inc. Paradigm pump as part of a demonstration at a Las Vegas security conference in August 2011 to show that medical devices carry cybersecurity risks.

He said he discovered in April that a hacker who is close enough to a OneTouch Ping user could remotely harm the diabetic by triggering a hypoglycemic reaction, although he, too, said the risk of such a hack was low.

"Rapid7 and I have worked hard with Johnson & Johnson to make sure these issues are addressed responsibly and ethically, Radcliffe said in a statement Tuesday. “This includes making sure patients understand the vulnerabilities and risks associated with using a connected device like this."

Radcliffe said he would put his own child on the OneTouch Pump if a doctor recommended it, and that there was little reason for users to panic.

“Removing an insulin pump from a diabetic over this risk is similar to never taking an airplane because it might crash,” he wrote.

The news of a potentially vulnerable device follows a report in late August that St. Jude Medical Inc.’s pacemakers and other cardiac devices have several serious cybersecurity risks. That report, issued by an investment firm that was taking a short position on the company’s stock, triggered a spate of litigation that included a class action by a patient and a defamation suit by St. Jude against the investment firm.

The report on St. Jude devices triggered warnings about the vulnerability of devices on the so-called internet of things and how consumers and companies can be protected.

Federal Trade Commission Chairwoman Edith Ramirez has called for more monitoring of the risks to consumer privacy and safety carried in the wireless devices.

The OneTouch Ping isn’t a wireless device; its vulnerability comes from its use of a radio frequency, according to Radcliffe’s post. A spokeswoman for the company didn’t immediately respond to a request for comment after business hours on Tuesday.

Return to headline | Return to top
J&J warns patients about cybersecurity vulnerabilities in insulin pump

Oct 4, 2016 | Becker's Hospital Review

By Mackenzie Bean

New Brunswick, N.J.-based Johnson & Johnson identified a low-risk security issue in one of its insulin pumps that could allow hackers to overdose diabetic patients with insulin, reported Reuters.
The pump, called the Animas OneTouch Ping, comes with a wireless remote patients can use to administer insulin doses. Jay Radcliffe, a diabetic and researcher at the cybersecurity firm Rapid7, found the communications between the device and remote were not encrypted, leaving the device vulnerable to hackers who could mimic the communication to deliver unauthorized doses of insulin.
Mr. Radcliffe reported the device's cybersecurity vulnerabilities to J&J in April. The company's technicians replicated his findings and confirmed that a hacker could command the pump to administer insulin from up to 25 feet away, said Brian Levy, CMO of J&J's diabetes division.
Since these attacks require technical expertise and sophisticated equipment, "the probability of unauthorized access to the OneTouch Ping system is extremely low," the company said in a warning letter to physicians and patients. About 114,000 people use the insulin pump in the U.S. and Canada, according to the report.
If patients are concerned about a hack, they can stop using the wireless remote or program the device to administer a maximum insulin dose, J&J said.

Return to headline | Return to top
Researcher Roots Out Security Flaws In Insulin Pumps

Oct 4, 2016 | Dark Reading

By Sara Peters

Jay Radcliffe, researcher and diabetic who found the flaws in Johnson & Johnson Animas OneTouch Ping insulin pump, 'would not hesitate' to allow his own children be treated by the device if they were diabetic and advised to do so by physicians.
Three security vulnerabilities in a popular insulin pump were revealed today, but the researcher who discovered them doesn't want you to worry about it too much.
The problems in the Animas OneTouch Ping wireless insulin pump were discovered by Jay Radcliffe, security researcher at Rapid7 and himself a Type I diabetic. The vulnerabilities all relate to insufficient security protocols still common in Internet of Things devices, including cleartext communications. Attackers could ultimately exploit the weak security to issue extra doses of insulin and induce hypoglycemic reactions.
Johnson & Johnson is the parent company of Animas.
However, Radcliffe's blog announcing the vulnerabilities included nearly as many cautions about not overreacting to cybersecurity alerts as it did to cybersecurity alerts. "If any of my children became diabetic and the medical staff recommended putting them on a pump," he wrote, "I would not hesitate to put them on an OneTouch Ping. It is not perfect, but nothing is."
The Animas OneTouch Ping has an optional wireless remote function. Radcliffe found CVE-2016-5084, which covers that communications between the pump and the wireless remote are communicated in cleartext, not encrypted. Blood glucose results and insulin dosage data is thus freely available to eavesdroppers; identity information is not included in the data communicated.
Remotes and pumps are "paired" to "prevent the pump from taking commands from other remotes that it might accidentally pick up transmissions from," but as CVE-2016-5085 describes, the pairing process is weak. To pair, the devices conduct a five-packet exchange in the clear -- the same five packets every time. This key is therefore easy to sniff and spoof.
"This vulnerability can be used to remotely dispense insulin and potentially cause the patient to have a hypoglycemic reaction," he wrote.
The third flaw, CVE-2016-5086, is a lack of replay attack prevention or transmission. As Radcliffe explained in the blog, "Communication between the pump and remote have no sequence numbers, timestamps, or other forms of defense against replay attacks."
This makes it relatively trivial for an attacker to - by replaying previous transmissions - issue additional doses of insulin, and induce a hypoglycemic reaction.
This vulnerability theoretically may also enable an attack to be launched from a considerable distance. The range of the remote and pump as designed is roughly 30 feet, yet with some off-the-shelf radio transmission equipment and directional antenna, an attacker can regularly exceed 1 to 2 kilometers away from the patient.
The vulnerabilities can be mitigated by implementing industry-standard encryption with a unique key pair or by disabling the radio (RF) functionality of the device. (All functions can be performed through the interface on the pump itself, Radcliffe says.) Animas provides further suggestions for patients here, and in mailed letters.
"Most people are at limited risk of any of the issues related to this research," wrote Radcliffe. "These are sophisticated attacks that require being physically close to a pump. Some people will choose to see this as significant, and for that they can turn off the rf/remote features of the pump and eliminate that risk ... Removing an insulin pump from a diabetic over this risk is similar to never taking an airplane because it might crash."
Rapid7 first informed Animas and its parent company Johnson & Johnson of the vulnerabilities in April. CERT, the Department of Homeland Security, and the Food & Drug Administration were also informed. Rapid7 worked with Animas on validating the vulnerabilities and providing mitigations before publicly disclosing the vulnerabilities today. Animas will also be mailing patients information about the flaws and mitigations.
This is all common, established vulnerability disclosure procedure for medical devices but nevertheless noteworthy. Six weeks ago, security company MedSec broke vulnerability disclosure norms, partnering with Muddy Waters to short-sell medical device manufacturer St. Jude Medical rather than disclose full details of the flaws it claimed to have found.
"Rapid7 is very committed to ethical vendor disclosure like we have here with [Johnson & Johnson]," Radcliffe told Dark Reading. "It is important for the users of these devices to have their health and safety come first."
Radcliffe said in his blog post that the risk to such devices increases as they evolve and gain Internet connectivity. He said his findings demonstrate the importance of vendors, regulators, and researchers working together to ensure the devices are safe for patients.
With so many medical devices becoming increasingly connected, are we nearing the point at which hospitals need full-time IT and security to respond to issues of availability, confidentiality, or integrity of these devices?
"Yes, very much so," says Radcliffe. "Rapid7 services works with many hospitals and clinics in order to address this exact issue."

Return to headline | Return to top
Inside Scoop: J&J Confirms Insulin Pump Security Flaws

Oct 5, 2016 | Carreers Info Security

By Kolbasuk McGee

Vulnerabilities in certain Johnson & Johnson wireless insulin pumps put the devices at risk for hacker exploitations that could cause the delivery of an insulin overdose to patients, sayscybersecurity researcher Jay Radcliffe, who discovered the flaws.
Johnson & Johnson's Animas unit is sending letters to about 114,000 patients and physicians based on the findings by Radcliffe, a researcher at the security firm Rapid7. Radcliffe, who is a diabetic, used his own Animas OneTouch Ping insulin pump in identifying vulnerabilities that put the product at risk for cyberattacks, he explains in an interview with Information Security Media Group.
A wireless control unit enables patients to remotely command the dose of insulin delivered by the Animas pumps without having to actually touch the pumps, he explains. The radio frequency communication path between the wireless control unit and the insulin pump, however, is unencrypted, he points out. As a result, a malicious attacker could potentially create remote commands for the pumps to deliver an overdose of insulin to patients, he explains, although he portrays the risk as low.
Radcliffe and his team at Rapid7 have been working closely with Johnson & Johnson to address the risks since he discovered the problems in April.
Manufacturer Responds
Animas says in a statement provided to ISMG: "The OneTouch Ping insulin delivery system has multiple safeguards to protect the integrity of the pump and remains safe and reliable. The probability of unauthorized access to the One Touch Ping System is extremely low. It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the internet or to any external network. For this reason also, there isn't a capability to push out a patch."
As a result of Radcliffe's findings, Animas says, its next generation of insulin pumps "will leverage different communication protocols which leverage industry best security practices." The company did not specifically address whether it plans to encrypt the product's remote communication functions.
The Animas letter sent to patients and doctors includes three mitigation approaches, Radcliffe explains. That includes turning off the pump's remote radio frequency feature, programming the pump to limit the maximum amount of insulin that can be delivered or turning on the pump's "vibrating" feature so that a patient is alerted when an insulin delivery is being initiated, providing the individual the option of cancelling the dosage.
FDA Lauds Coordinated Vulnerability Announcement
In a statement, the Food and Drug Administration tells ISMG: "The FDA was made aware of the cybersecurity vulnerabilities identified in the Animas OneTouch Ping insulin pump during the coordinated disclosure process used by the medical device manufacturer and the research firm. This coordinated disclosure employed by Johnson & Johnson and Rapid7 demonstrates directly the basic principles proposed in the FDA's draft guidance on postmarket management of cybersecurity in medical devices."
The federal regulator said Johnson & Johnson's work with Radcliffe's team at Rapid7 is "the proactive behavior the FDA has been looking to see from the medical device manufacturer and research community and demonstrates the collaborative manner in which vulnerabilities can be addressed in a way that best protects patients."
In the interview (see audio player below photo), Radcliffe also discusses:How the vulnerabilities in the Animas insulin pumps differ from earlier security flaws
Radcliffe identified in 2013;
Why medical device makers often don't respond positively to independent researchers who identify cyber flaws in their products;
Rapid7's relationship with device manufacturers in its role as an independent research firm.
Radcliffe, has spent more than 20 years in security, including work in managed security services. He specializes in medical-related environments and the internet of things and is known for his research on security vulnerabilities in medical devices.

Return to headline | Return to top
Will Johnson & Johnson (JNJ) Stock Be Hurt by Cyber Security Vulnerability?

Oct 4, 2016 | TheStreet

By Rachel Graf

Johnson & Johnson (JNJ) yesterday warned patients of a cyber security vulnerability in its Animas OneTouch Ping insulin pump that might allow hackers to overdose diabetics with insulin.
Executives are unaware of any attempted hacks, and noted that the probability of such an attack is "extremely low," Reuters reports.
A hacker would need to be within 25 feet of the patient and have access to sophisticated equipment, Johnson & Johnson added.
"We believe the OneTouch Ping system is safe and reliable. We urge patients to stay on the product," Brian Levy, chief medical officer with J&J's diabetes unit, said in a letter to patients cited by Reuters.
Shares of the New Brunswick, NJ-based health care company closed flat in Tuesday's trading session.
Separately, TheStreet Ratings team rates the stock as a "buy" with a ratings score of A-.
Johnson & Johnson's strengths such as its solid stock price performance, revenue growth, largely solid financial position with reasonable debt levels by most measures, reasonable valuation levels and expanding profit margins outweigh the fact that the company has had sub par growth in net income.
You can view the full analysis from the report here: JNJ
TheStreet Ratings objectively rated this stock according to its "risk-adjusted" total return prospect over a 12-month investment horizon. Not based on the news in any given day, the rating may differ from Jim Cramer's view or that of this article's author.

Return to headline | Return to top
Johnson & Johnson (JNJ) Says Insulin Pump Can Be Hacked

Oct 5, 2016 | TheStreet

By Natalie Walters

Johnson & Johnson (JNJ) sent out a letter to users of its Animas OneTouch Ping insulin pump to warn them that it could be hacked, although the risk of that happening is extremely low. Reuters first broke the story earlier Tuesday.
This particular pump is operated by a remote control so it "uses an unencrypted radio frequency to communicate with the device," explained CNBC's Meg Tirrell on this afternoon's "Closing Bell." This means someone could hack into the system and give someone more insulin than they needed at the time.
The hacker would need to be within 25 feet of the pump, be a very skilled hacker of such a system and have the intention to harm, in order to carry out the action, Johnson & Johnson told Tirrell.
Rapid7 researcher and diabetic Jay Radcliffe was the first person to hack into the system and joined "Closing Bell" to talk about his independent research that led to the discovery of the cyber security flaw.
"This is just out of my own curiosity about how these devices work and how safe they are for my own personal use as a diabetic," he said.
The system is "quite difficult" to hack, he noted, in agreement with J&J.
While the risk of the pump being hacked is "extremely low," Radcliffe says he reported the flaw so that people could "make good decisions around the risks that they take."
Patients with this paricular insulin pump can turn off the radio frequency portion if they want to eliminate any risk of being hacked, according to Radcliffe.
Separately, TheStreet Ratings objectively rated this stock according to its "risk-adjusted" total return prospect over a 12-month investment horizon. Not based on the news in any given day, the rating may differ from Jim Cramer's view or that of this articles's author.
TheStreet Ratings team rates Johnson & Johnson as a Buy with a ratings score of A. This is based on the convergence of positive investment measures, which should help this stock outperform the majority of stocks that the team rates.

Return to headline | Return to top
Johnson & Johnson says insulin pump can be hacked

Oct 4, 2016 | FierceHealthcare

By Dan Bowman

Johnson & Johnson, it appears, has no interest in being run through the same gauntlet as fellow device maker St. Jude Medical for its cybersecurity sins.
The company has issued a warning that its J&J Animas OneTouch Ping insulin pump is vulnerable to hacking attacks, according to a Reuters report. In letters to patients and providers, Johnson & Johnson calls the probability of hacking “extremely low,” and it tells Reuters it knows of no attacks to the devices, thus far.
Cybersecurity research firm Rapid7 Inc, which discovered the vulnerability last spring, outlines its findings in a blog post, noting that the OneTouch Ping system uses cleartext communication and not encrypted communication. “Due to this lack of encryption, Rapid7 researcher Jay Radcliffe discovered that a remote attacker can spoof the Meter Remote and trigger unauthorized insulin injections,” the post says.
Johnson & Johnson tells Reuters it has worked with Radcliffe on the issues, although Radcliffe clarifies in a note shared on the Rapid7 blog post that he has not been paid by Animas or Johnson & Johnson for his research.
The admission comes in the wake of cybersecurity problems for fellow device maker St. Jude Medical. A report distributed in August by investment firm Muddy Waters and security research firm MedSec revealed cybersecurity vulnerabilities with St. Jude’s cardiac devices. MedSec CEO Justine Bone said that she believed St. Jude knew about its vulnerabilities since 2013, but took very little action to remedy the situation.
A lawsuit filed after the report’s release by St. Jude called the Muddy Waters/MedSec accusations false and manipulative.
In a statement sent to FierceHealthIT, Aaron Lint, vice president of research for security company Arxan, urges all companies to use encryption on its devices.
“In order to prevent such instances from occurring, encrypted communication between any two endpoints is critical for medical devices and all [Internet of Things] devices,” Lint says.

Return to headline | Return to top
Security flaws leave J&J insulin pumps vulnerable to hacking

Oct 4, 2016 | MedCity News

By Neil Versel

It’s not quite the “Rise of the Machines” depicted in the “Terminator” movies, but the Internet of Things does have its safety issues.
Case in point: Johnson & Johnson is warning users of its Animas OneTouch Ping insulin pumps that the devices could be vulnerable to hackers.
J&J, based in New Brunswick, New Jersey, sent a letter to patients last week from its Animas subsidiary acknowledging three security vulnerabilities first brought to the company’s attention six months ago. “We want you to know that Animas has investigated this issue and has worked with the appropriate regulatory authorities and security experts, as we are always evaluating ways to further ensure patient safety and security,” the letter said.
Animas recommended either turning off the radio frequency transmitter in the OneTouch Ping device or limit the amount of insulin that can be delivered at any one time. The company also advised patients to turn on vibrating alerts so users can cancel insulin doses they aren’t supposed to get.
The security risks came to light last week when Jay Radcliffe, a OneTouch Ping insulin pump user who happens to work for cybersecurity technology vendor Rapid7 discussed the flaws on his company’s blog. Reuters first broke the news widely on Tuesday.
Radcliffe, told Reuters that he first informed J&J of the vulnerabilities back in April. On the blog, he wrote:
"The OneTouch Ping does not communicate on 802.11 WiFi, or otherwise communicate on the internet. However, it is believed these attacks could be performed from one to two kilometers away, if not substantially further, using sufficient elevation and off-the-shelf radio transmission gear available to ham radio hobbyists."
A J&J spokeswoman confirmed the security flaws to MedCity News. A corporate statement issued to the press said that the risk of hacking was “extremely low, would require technical expertise, sophisticated equipment and proximity to the pump.”
J&J said it was continuing to work with unspecified regulatory agencies — probably the Food and Drug Administration and possibly the Federal Communications Commission as well — and with security experts to prevent actual hacks of the insulin pumps.
The security industry has feared hacks of connected medical devices for several years. In July 2015, the FDA warned that Hospira’s Symbiq Infusion System smart pumps could be vulnerable to hackers. The FDA has not issued any statement on the OneTouch Ping to date.

Return to headline | Return to top
Oh, Great, Now It's Possible to Literally Hack Someone's Body

Oct 4, 2016 | Thrillist

By Christina Stiehl

Johnson & Johnson was just trying to help diabetes patients when it created its new Animas OneTouch Ping insulin pump, which allows people to control the amount of insulin delivered into their bodies with a simple touch of a wireless remote. It's easy, it's discreet, it allows patients to accurately control their insulin levels -- and it's vulnerable to hackers who secretly want to overdose people on insulin.
That's right: Johnson & Johnson announced that its high-tech new insulin system is totally susceptible to attacks, to warn any diabetics just in case they have enemies looking to assault them with a mad case of hypoglycemia.
As dark as that sounds, the pharmaceutical company insists it's totally, probably not going to happen; it's just giving people a heads-up on the off-chance hackers have gotten too bored with Yahoo emails and are instead moving on to insulin pump remotes. But again, don't worry! You'll probably be fine, it's so unlikely, you have (almost) nothing to worry about!
"It would require technical expertise, sophisticated equipment and proximity to the pump, as the OneTouch Ping system is not connected to the internet or to any external network," the company wrote in a letter sent to doctors and patients. If you see someone with "sophisticated equipment" creeping around you at a coffee shop, though, watch out.
Just because it's improbable doesn't mean it's impossible -- after all, anything that's wireless and that high-tech inherently comes with some kind of security risk. This is particularly troubling in the medical field, where smart devices promise more automation, responsiveness, and personalization, usually through wireless access that connects you to the internet and all its hackers. Dick Cheney even disconnected his pacemaker from its wireless connection, which seems silly because Dick Cheney can't be killed by hackers or any other mere mortals.
The Animas OneTouch Ping is a little different -- it's vulnerable because the communications between the remote control and the insulin pump aren't encrypted or scrambled, which seems like something that should've been done, but we're not Johnson & Johnson, so who knows? Apparently, someone could intercept the remote's commands and pump their target full of insulin from up to 25ft away, a cyber-security firm found. No word on how the firm ran this test, but hopefully the subject recovered.
OK, so the attacker would have to hack the technology, build a sophisticated system, get within 25ft of their victim, and keep upping the insulin dose until the poor person's blood sugar dropped so low, it became life-threatening. But who knows -- "Pumping" could become the new "Swatting," especially among the gamer crowd. Their diet consists mostly of Mountain Dew and Doritos, which means there are probably a few people who have, or are going to have, diabetes... and also lots of enemies seeking revenge.

Return to headline | Return to top

US Regional Coverage

Boston company says some insulin pumps open to cyberattack

Oct 5, 2016 | Boston Globe

By Curt Woodward

Johnson & Johnson warned consumers Tuesday about security vulnerabilities in an insulin pump after Boston cybersecurity company Rapid7 Inc. discovered the device’s remote control could be hacked by a digital attacker, potentially delivering extra doses of insulin.
Reuters, which first reported the security problem, said Johnson & Johnson was able to replicate the problems identified by Rapid7 but was not aware of any attempts to hack into the OneTouch Ping insulin pump system. In a letter to patients, which it also posted online, Johnson & Johnson’s Animas Corp. subsidiary said the likelihood of someone gaining control of the pump “is extremely low.’’
The vulnerability brings more attention to security questions that accompany an increasing array of medical devices employing digital communications. The US Food and Drug Administration, which has called security threats to medical devices “a growing concern,’’ is developing cybersecurity guidelines for medical device manufacturers.
The problem was uncovered by Rapid7 researcher
Jay Radcliffe, himself a diabetic who had used the J&J pump and wanted to know if it had any security vulnerabilities. The device includes a pump that diabetics attach to their body, and a small remote control that displays their blood-glucose levels and controls the pump.
Radcliffe said he found that the communications between the remote and the pump were not protected, or encrypted. Rapid7 said it is possible an attacker with the right equipment could pretend to be the remote and send improper signals to the pump.
Rapid7 said the vulnerability “can be used to remotely dispense insulin and potentially cause the patient to have a hypoglycemic reaction,’’ a bout of low blood sugar that can cause confusion, fatigue, blurred vision, and even unconsciousness or death in severe cases.
J&J said patients could take some immediate steps if they were worried about the security risk, including disconnecting the pump’s radio-controlled remote glucose meter or programming the pump to limit the amount of insulin it sends into a wearer’s body. Johnson & Johnson also said it had notified the FDA and Department of Homeland Security of the problem.
In a blog post about the research, Radcliffe wrote that the episode shows why medical companies, regulators, and security researchers must take the time to track down any problems in devices.
“This is not something to be rushed into as there is a patient’s life on the line,’’ Radcliffe wrote. “We all want the best technology right away, but done in a reckless, haphazard way puts the whole process back for everyone.’’
Radcliffe said most users were “at limited risk’’ because the possible attacks were relatively sophisticated and likely would require a hacker to be within a few meters of the patient. He also said that he would allow his children to use the OneTouch Ping pump if they were diabetic.
Radcliffe gave credit to Johnson & Johnson for working to address the vulnerability, which he began reporting to the company in April. “They are focused on taking care of the patient and doing what is right,’’ he wrote.

Return to headline | Return to top

US National Broadcast Coverage

Squawk Box

Oct 5, 2016 | CNBC

View clip here: http://beta.criticalmention.com/app/#clip/view/24382543?token=5c174860-e2ba-4942-8b66-b6a4b80438ef
Rough transcript: johnson & johnson is warning customers that one of its insulin pumps could be vulnerable to hacking. although it does say the risk is low. that device, the one touch ping insulin pump attaches to the patient's body and injects insulin through catheters. While working with a security expert the company learned the hacker could force the pump to deliver unwarranted insulin which could dose a patient with too much insulin and cause hypoglycemia. The company says the likelihood of this happening is very low because a hacker would have to be within 25 feet of the device to affect the signal. johnson & johnson provided solme advice on how to fix the problem in letters that were sent out to doctors and patients. And again, they are warning low probability but that is probably something you would have some high concerns about if you are patient that’s actually effected.

Return to headline | Return to top
Varney & Company

Oct 5, 2016 | Fox Business

View clip here: http://beta.criticalmention.com/app/#clip/view/24382924?token=5c174860-e2ba-4942-8b66-b6a4b80438ef
Rough transcript: troubling news for people who use the johnson & johnson insulin pump. the company warning devices could be vulnerable to hacking attack. The stock crawled up a little bit higher. No relation to the stock price at all.

Return to headline | Return to top
Nightly Business Report

Oct 4, 2016 | PBS

View clip here: http://beta.criticalmention.com/app/#clip/view/24381991?token=5c174860-e2ba-4942-8b66-b6a4b80438ef

Rough transcript: and a warning from johnson & johnson to users of one of its insulin pumps. it could be vulnerable to a hack. meg terrell has more on the latest medical device facing a cyber security threat >> reporter: more than 100,000 people with diabetics recently got a strange letter from johnson & johnson. the health care giant was warning them about a cyber security risk with one of its insulin pumps. the one-touch ping insulin pump system comes with a remote control to enable delivery of insulin. J&J says nobody has been harmed in this way, but that it is possible someone could hack into the device and control insulin delivery. >> we need to give users and patients the information so that way they can determine if it's too risky for them or if it’s not risky for them. >> jay radcliffe is the research who made the discovery. while he works in cyber security at firm rapid 7, his work on the insulin pump was a side project. he's diabetic, and it was his pump on which he did the research. This is just out of my own personal curiosity about how these devices work and how safe they are for my own personal use as a diabetic. J&J says the probability of unauthorized access to the one touch ping system is extremely low. someone would have to be within 25 feet of the person wearing the device and have extremely specialized skills. Not to mention, harmful intentions. the company says there are ways to mitigate the risk. turning off the radio frequency feature, limiting how much insulin can be delivered at once and setting a vibrating alert system. the device is eight years old. newer systems, j & j says, have encryption technology that would be harder to hack. it says this issue doesn't exist in other products. but cyber security in medical devices is a growing area of focus. the food and drug administration issued draft guidance to manufacturers in january and in august, security firm medsec teamed with short seller muddywaters and issued a report on hard devices made by st. jude medical. They alleged st jude’s devices could be hacked in ways that makes them malfunction or lose battery power. the fda has said it's investigating. st. jude denies the claims, citing an external report and has sued both muddy waters and medsec. as for radcliffe, he doesn't use that pump any more but he said that’s not because of his findings. >> johnson & johnson and rapid 7 worked very hard at testing out these mitigation strategies and testing out these solutions that we published. especial turning off the radio frequency portion, works 100% at eliminating the risk.

Return to headline | Return to top
ABC World News Tonight with David Muir

Oct 5, 2016 | ABC

View clip here: http://beta.criticalmention.com/app/#clip/view/24382336?token=5c174860-e2ba-4942-8b66-b6a4b80438ef
Rough transcript: a new medical alert tonight. johnson & johnson warning some diabetic patients saying its one touch ping insulin pump could be breached by hackers. They say it's possible to tamper with the computerized device causing an insulin overdose. they add, the danger is extremely low, but possible. More than 100,000 patients in the US and Canada use that device.

Return to headline | Return to top
Closing Bell

Oct 4, 2016 | CNBC

View clip here: http://beta.criticalmention.com/app/#clip/view/24382183?token=5c174860-e2ba-4942-8b66-b6a4b80438ef

Rough transcript: johnson & johnson revealing some disturbing news today regarding cyber security of one of its medical devices. meg terrell has the scary details. Fascinating story. >> we heard about this idea that maybe a pace maker could be hacked into. that was one of the plots on "homeland.” today johnson & johnson wrote a letter to more than 100,000 patients that use their one of their insulin pumps warning about its one touch ping insulin pump. An outside researcher an expert in cyber security identified a potential of hack risk here. no patients have been harmed here. this is a story originally reported by reuters this morning. Broken by reuters this morning. Essentially the way this works is the pump has a remote control. so it uses an unencrypted radiofrequency to communicate with the device. Now j&j says theoretically this could be hacked into by somebody wanting to cause someone harm and giving them a dangerous level of insulin. It says quote the probability of unauthorized access to the one touch ping system is extremely low. I’ve learned from talking with j and j somebody would have to be within 25 feet of somebody wearing this insulin pump, having extremely strong skills about hacking into this system and of course want to harm somebody. these kind of cyber security issues have come in to focus a lot with muddy waters teaming up with company medsec shorting st. jude stock over the security of their heart devices. fda is actually investigating this right now. Of course st. jude has refuted this and is suing both of those parties so this is an ongoing situation. The fda at least in terms of the johnson & johnson situation says this is the kind of proactive behavior that the fda has been looking to see for from the research community and demonstrates the collaborative manner in which vulnerabilities can be addressed in a way that best protects patients. So saying this is really what companies should be doing here, writing this letter. J&J saying the risk is incredibly low, and the guy that did this is himself a diabetic, had used the pump, did the research on himself. He says while he's not using this anymore it's not because of this risk. >> what do you say we talk to him. What an idea. stay right there. we're going need your help on this. let's bring in the man who was able to hack the insulin pump. That’s jay Radcliff, senior consultant at rapid7. And as mentioned you are a diabetic. now j and j is painting this as if it's highly unlikely, difficult, the logistics don't make sense. how easy or difficult in your view since you've done it is it to hack this insulin pump? >> sure. you know it's actually quite difficult. i agree with the assessment that johnson & johnson has made that there's extremely low risk to the patient and that the patients should stay on their medical treatment and continue to use their insulin devices so that way they can stay healthy. >> are you worried then that you scared everybody as a result of doing this? what's the framework for thinking about this? >> i think the framework around it is for people to be able to make good decisions around the risks they take. so, you know, the example i gave is when you go out driving some people don't like to drive when it's raining or snowy because it's too risky. in this case we need to give users and patients the information so that way they can determine if it's too risky for them or not. >> so jay, as a result of this, johnson & johnson reaching out in its letter giving a few things people can do if they are concerned about this. turning off the radiofrequency for example. do you think these kind of mitigation strategies is enough to keep this pump safe for folks? >> absolutely. johnson & johnson and rapid seven worked very hard at testing out these mitigation strategies and testing out these solutions that we've published and they especially turning off the radiofrequency portion works 100% at eliminating the risk. >> did you just do this on your own or you wanted them to – or you worked in collaboration with them in advance. >> i did not work with them in collaboration in advance. this is entirely independent research. it was my personal device that I did the research on. this is just out of my own personal curiosity about how these devices work about how safe they are for my own personal use as a diabetic. >> meg mentioned it's unencrypted the communicatoin. should it be encrypted? Why not do that? >> you have to remember that these devices were designed quite some time ago. in this case in particular this device is over ten years old in its design. newer devices because these devices take some time to get through the regulatory process and get through engineering new devices are going to have encryption. as we study them and do the independent research we want to validate that. >> for the average person right now the conclusion i would draw is if i have one of these i got to have a really, really smart person nearby me who hates me, right? >> that would be the high-risk scenario, correct. like if you were a nation state leader or like the president of a country that that would be a scenario that i would consider. for the average every day user they need to take care of their diabetes and their health. >> some days that's my job description. >> i know we're almost out of time but i want to ask you with this idea these devices are meant to last years inside the body but we think about a 5-year-old cell phone and it would be ridiculous for a lot of people to be using one of those these days. is that a problem with medical devices. they are supposed to last so long but the rest of the world advances as you're wearing youre still five-year-old pace maker. >> as we go forward and see these new devices coming out I think manufacturers will adapt to that. they will have the ability to update. Because they see the threats and research we're doing and reacting to them appropriately just like johnson & johnson has. >> jay, good stuff. very nice to meet you. very enlightening. appreciate it. jay radcliffe. >

Return to headline | Return to top
Bloombeg Markets

Oct 4, 2016 | Bloomberg TV

View clip here: http://beta.criticalmention.com/app/#clip/view/24382561?token=5c174860-e2ba-4942-8b66-b6a4b80438ef

Rough transcript: johnson & johnson is warning users of its one touch insulin pump about potential hacking risks. the device maker says a cyber security flaw could be exploited to secretly add extra doses of the diabetes drug. J&j says the probability of unauthorized access is low but it has confirmed the device’s vulnerability to outside manipulation can be life threatening.

Return to headline | Return to top

Add recipients

Suggested