Vulnerability

Animas OneTouch Ping insulin pump accepts replayed and unencrypted radio commands

MedDevice Cyber Staff · Oct 5 · 3 min read · Via CISA ICSMA-16-279-01

CISA published advisory ICSMA-16-279-01 on October 5, 2016, covering three vulnerabilities in the Animas OneTouch Ping insulin pump system. All versions are affected. The flaws sit in the radio link between the pump and its meter remote, which can command a bolus.

CVE-2016-5084 (CWE-319, CVSS v3 6.5) is cleartext transmission: the devices do not use encryption for certain data, so an attacker in radio range can sniff it. CVE-2016-5085 (CWE-330, CVSS 4.2) is weak random number generation, which makes it easier to spoof a meter after sniffing traffic and completing the authentication handshake. CVE-2016-5086 (CWE-294, CVSS 6.4) lets an attacker bypass authentication by replaying captured messages.

Put together, the three describe a pairing that an adjacent attacker can observe, imitate and replay. The CVSS vectors all require adjacent network access, so the attacker has to be physically near the patient. The integrity impact on CVE-2016-5086 is rated high, which matters on a device that delivers insulin.

Animas does not plan to release a firmware update. It sent notifications to patients and healthcare professionals and published compensating controls instead: turn off the pump's radio frequency feature, cap bolus delivery through maximum bolus, 2-hour and total daily dose limits, and enable the Vibrating Alert so the patient can cancel a bolus the meter remote starts. Those limits can only be set on the pump itself, and the pump history records the source of every delivery.

Dose limits enforced on the pump are the control that holds when the radio cannot be trusted. A wireless command path to a therapy device needs replay protection and real randomness from the first design review.

Are you a representative of Animas? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no patch: Animas does not plan to release a firmware update for the OneTouch Ping. Patients who keep the meter remote should program bolus limits and the Vibrating Alert on the pump, since the remote cannot change those settings. Turning off the pump's radio frequency feature removes the attack path but means glucose readings are entered manually.

Set bolus limits on the pump. Program maximum bolus, 2-hour and total daily dose limits so any attempt to exceed them alarms and blocks delivery.
Turn on the Vibrating Alert. The pump then signals a bolus started by the meter remote, giving the patient a chance to cancel it.
Disable RF where the remote is not needed. Turning off the radio frequency feature cuts the pump off from the meter remote entirely.
Review pump history. The history records every insulin delivery and whether the pump or the meter remote initiated it.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Therapy delivery Home use

OneTouch Ping insulin pump system

PID-4112 Wireless connectivity Therapy delivery

Fix the class in your product

The device honors control commands from any peer in radio range. As the maker, gate every state-changing characteristic behind an authenticated, bonded link on the device itself, and strip undocumented command paths from the release image.

Authenticate on the device, not the app. Reject writes to state-changing characteristics unless the link is encrypted, bonded, and authenticated.
Bond with a modern pairing method. Require LE Secure Connections and add a physical confirmation on a safety-critical device.
Fail to a safe state. On an unexpected or unauthenticated command, hold or revert rather than acting.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer
MOBILETT Impact	Siemens Healthineers	Exposed to the same EMB3D threatTID-221	No feedback feed from manufacturer

Questions & Answers

Is there a firmware fix for CVE-2016-5086 in the Animas OneTouch Ping insulin pump?

No. Animas said it does not plan to release a firmware update for CVE-2016-5084, CVE-2016-5085 or CVE-2016-5086 in the OneTouch Ping insulin pump system, all versions, covered by CISA advisory ICSMA-16-279-01 on October 5, 2016. It recommends compensating controls such as turning off the radio frequency feature and setting bolus limits on the pump.

How can an attacker spoof the Animas OneTouch Ping meter remote?

Per CISA advisory ICSMA-16-279-01, the OneTouch Ping does not properly generate random numbers (CVE-2016-5085), which makes it easier for an attacker in radio range to sniff traffic and spoof the meter remote, and it accepts replayed messages (CVE-2016-5086). Unencrypted data (CVE-2016-5084) can also be sniffed.

← Back to Vulnerabilities