Hacking Medical Devices for Fun and Insulin: Breaking the Human SCADA System

Presented at Black Hat USA 2011, Aug. 4, 2011, 3:15 p.m. (75 minutes).

As a diabetic, I have two devices attached to me at all times; an insulin pump and a continuous glucose monitor. This combination of devices turns me into a Human SCADA system; in fact, much of the hardware used in these devices are also used in Industrial SCADA equipment. I was inspired to attempt to hack these medical devices after a presentation on hardware hacking at DEF CON in 2009. Both of the systems have proprietary wireless communication methods. Could their communication methods be reverse engineered? Could a device be created to perform injection attacks? Manipulation of a diabetic's insulin, directly or indirectly, could result in significant health risks and even death. My weapons in the battle: Arduino, Ham Radios, Bus Pirate, Oscilloscope, Soldering Iron, and a hacker's intuition. After investing months of spare time and an immense amount of caffeine, I have not accomplished my mission. The journey, however, has been an immeasurable learning experience - from propriety protocols to hardware interfacing-and I will focus on the ups and downs of this project, including the technical issues, the lessons learned, and information discovered, in this presentation "Breaking the Human SCADA System."

Presenters:

• Jerome Radcliffe

Links:

• https://www.blackhat.com/html/bh-us-11/bh-us-11-archives.html#Radcliffe
• https://media.blackhat.com/bh-us-11/Radcliffe/BH_US_11_Radcliffe_Hacking_Medical_Devices_Slides.pdf
• https://media.blackhat.com/bh-us-11/Radcliffe/BH_US_11_Radcliffe_Hacking_Medical_Devices_WP.pdf

Similar Presentations:

• DeepSec 2013 „Secrets, Failures, and Visions“ / Hacking Medical Devices
• AppSec USA 2013 / Why is SCADA Security an Uphill Battle?
• DerbyCon 6.0 Recharge (2016) / Five year checkup: the state of insulin pump security