Johnson & Johnson warned consumers Tuesday about security vulnerabilities in an insulin pump after Boston cybersecurity company Rapid7 Inc. discovered the device’s remote control could be hacked by a digital attacker, potentially delivering extra doses of insulin.  Reuters, which first reported the security problem, said Johnson & Johnson was able to replicate the problems identified by Rapid7 but was not aware of any attempts to hack into the OneTouch Ping insulin pump system. In a letter to patients, which it also posted online, Johnson & Johnson’s Animas Corp. subsidiary said the likelihood of someone gaining control of the pump “is extremely low.”  The vulnerability brings more attention to security questions that accompany an increasing array of medical devices employing digital communications. The US Food and Drug Administration, which has called security threats to medical devices “a growing concern,” is developing cybersecurity guidelines for medical device manufacturers.  The problem was uncovered by Rapid7 researcher Jay Radcliffe, himself a diabetic who had used the J&J pump and wanted to know if it had any security vulnerabilities. The device includes a pump that diabetics attach to their body, and a small remote control that displays their blood-glucose levels and controls the pump.  Radcliffe said he found that the communications between the remote and the pump were not protected, or encrypted. Rapid7 said it is possible an attacker with the right equipment could pretend to be the remote and send improper signals to the pump.  Rapid7 said the vulnerability “can be used to remotely dispense insulin and potentially cause the patient to have a hypoglycemic reaction,” a bout of low blood sugar that can cause confusion, fatigue, blurred vision, and even unconsciousness or death in severe cases.  J&J said patients could take some immediate steps if they were worried about the security risk, including disconnecting the pump’s radio-controlled remote glucose meter or programming the pump to limit the amount of insulin it sends into a wearer’s body. Johnson & Johnson also said it had notified the FDA and Department of Homeland Security of the problem.  In a blog post about the research, Radcliffe wrote that the episode shows why medical companies, regulators, and security researchers must take the time to track down any problems in devices.  “This is not something to be rushed into as there is a patient’s life on the line,” Radcliffe wrote. “We all want the best technology right away, but done in a reckless, haphazard way puts the whole process back for everyone.”  Radcliffe said most users were “at limited risk” because the possible attacks were relatively sophisticated and likely would require a hacker to be within a few meters of the patient. He also said that he would allow his children to use the OneTouch Ping pump if they were diabetic.  Radcliffe gave credit to Johnson & Johnson for working to address the vulnerability, which he began reporting to the company in April. “They are focused on taking care of the patient and doing what is right,” he wrote.
The findings by a  security expert for Boston’s Rapid7 prompted Johnson & Johnson to warn consumers, although it was deemed a low risk for most users.