CVE-2016-5086
📋 TL;DR
CVE-2016-5086 is an authentication bypass vulnerability in Johnson & Johnson Animas OneTouch Ping insulin pumps that allows attackers to replay previously captured communication packets to gain unauthorized access. This affects patients using these medical devices for insulin delivery, potentially allowing remote attackers to control insulin administration.
💻 Affected Systems
- Johnson & Johnson Animas OneTouch Ping Insulin Pump
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker could deliver lethal insulin doses to patient, causing severe hypoglycemia or death.
Likely Case
Unauthorized access to device settings allowing manipulation of insulin delivery rates, potentially causing dangerous blood sugar levels.
If Mitigated
With proper network segmentation and monitoring, risk reduces to unauthorized access attempts being detected before harm occurs.
🎯 Exploit Status
Exploit tools and research published by Rapid7 and security researchers demonstrate practical attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware update released by Johnson & Johnson in 2016
Vendor Advisory: https://www.animas.com/safety-notice
Restart Required: Yes
Instructions:
1. Contact Johnson & Johnson/Animas for firmware update. 2. Follow medical device update procedures. 3. Verify new firmware version. 4. Test device functionality post-update.
🔧 Temporary Workarounds
Disable remote control feature
allDisable the OneTouch Ping remote control functionality to prevent RF communication attacks
Device-specific menu settings to disable remote control
Physical isolation
allKeep device in RF-shielded case when not in use to prevent unauthorized access
🧯 If You Can't Patch
- Replace vulnerable devices with updated models or alternative insulin delivery systems
- Implement strict physical security controls and monitoring for unauthorized RF signals near patient
🔍 How to Verify
Check if Vulnerable:
Check device firmware version against Johnson & Johnson security bulletin. Devices manufactured before 2016 firmware update are vulnerable.Check Version:
Check device settings menu for firmware version informationVerify Fix Applied:
Verify firmware version shows post-2016 update. Test RF communication requires authentication.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts
- Unexpected RF communication patterns
Network Indicators:
- Unusual RF signal patterns in medical device frequency ranges
- Repeated authentication packets
SIEM Query:
Medical device logs showing authentication bypass or unexpected remote control commands🔗 References
- http://www.kb.cert.org/vuls/id/884840
- http://www.kb.cert.org/vuls/id/BLUU-A9SQRS
- http://www.securityfocus.com/bid/93351
- https://community.rapid7.com/community/infosec/blog/2016/10/04/r7-2016-07-multiple-vulnerabilities-in-animas-onetouch-ping-insulin-pump
- https://ics-cert.us-cert.gov/advisories/ICSMA-16-279-01
- http://www.kb.cert.org/vuls/id/884840
- http://www.kb.cert.org/vuls/id/BLUU-A9SQRS
- http://www.securityfocus.com/bid/93351
- https://community.rapid7.com/community/infosec/blog/2016/10/04/r7-2016-07-multiple-vulnerabilities-in-animas-onetouch-ping-insulin-pump
- https://ics-cert.us-cert.gov/advisories/ICSMA-16-279-01
