gms | German Medical Science

Background: Hacking medical devices and cybersecurity in public health is the subject of recent discussions [1]. The Federal Office for Information Security (BSI) aims to improve transparent communication regarding cybersecurity risks of networked medical devices [2]. To this end, the BSI initiated the project ManiMed – Manipulation of Medical Devices to facilitate a trustful communication and cooperation between manufacturers, security researchers, and authorities. This study targets the current cybersecurity state of smart and connected medical devices [3], [4] and illustrates what kind of questions the medical device industry is facing by making their devices smart.

This article focuses on security vulnerabilities identified in the DANA Diabecare RS insulin pump to illustrate what kind of questions the medical device industry faces by making their devices smart. The exemplifying vulnerabilities affected the pump's proprietary, Bluetooth Low Energy (BLE)-based communication and affected patient safety.

Methods: The assessment of medical devices is highly specialized and individual in terms of the device's medical use case, present interfaces, used technologies and assumptions to its environment [5]. The device was assessed following a black-box approach. The proprietary communication protocol built on top of Bluetooth Low Energy (BLE) was reverse-engineered using the manufacturer's Android and iOS applications and captures of the communication between the pump and its mobile apps using elementary BLE prototyping hardware. In the scope of the assessment were applied cryptography, Man-in-the-Middle attacks, eavesdropping of the communication, as well as the authentication and pairing process.

A coordinated vulnerability disclosure process (CVD) was initiated to keep the smart medical device on the market while ensuring that it no longer poses a threat to patient safety. The disclosure deadline was set with the constraint that measures must not harm the therapeutic purpose of the medical device. The Federal Institute for Drugs and Medical Devices (BfArM), as the national authority for vigilance in Germany, was notified and involved.

Results: During the security assessment, client-side controls, weak generation of encryption keys, improper verification of the pump's identity, missing replay protection, the insecure transmission of cryptographic keys, and an overall weak authentication mechanism were identified. By hijacking the pump, an attacker can administer insulin boluses remotely, causing severe patient harm [6].

The coordinated vulnerability disclosure (CVD) process was extended and lasted several months until a patch was rolled out to patients with a new pump firmware and major mobile application upgrades. The manufacturer released security advisories in the forms of a Field Safety Notice (FSN) [7]. A Medical Advisory (ICSMA) as well as CVEs were published by the Cybersecurity and Infrastructure Security Agency (CISA) [8].

Conclusion: This example demonstrates that mature processes for handling cybersecurity vulnerabilities with safety impact on active medical devices are not yet common among all medical device manufacturers, even though recognized procedures [9], [10] based on pervasive community knowledge are in place.

The authors declare that they have no competing interests.

The authors declare that an ethics committee vote is not required.