Four Newbies Vs - An Insulin Pump - How Hard Can It Be

Four cybersecurity students from a Norwegian university describe their bachelor thesis on a commercial tubeless insulin pump, approaching it as newcomers to medical device research. They explain how type 1 diabetes depends on insulin delivery, and how the pump pairs over Bluetooth Low Energy with a controller app that was only offered in a single region, which made even getting a compatible phone a hurdle.

The team built a threat model using STRIDE and MITRE's embedded-device framework, splitting the system into controller, pump and glucose sensor and rating each threat by impact and attack complexity. Passive captures of pairing traffic revealed vendor identifiers and a service UUID in advertisements. Scan floods and connection-request floods were blunted by rate limits and fixed pauses, but an ESP32 imitating the pump's advertisement structure eventually got the controller to open a connection. Analysis of the later key exchange pointed to elliptic-curve Diffie-Hellman with no authentication of the peer.

In a demo, the controller refused to connect once it saw more than one pump, so a spoofed advertisement caused a denial of service. The speakers note that this behavior was likely added to prevent rogue connections seen in earlier pumps, and they suggest verifying the peer during connection as a fix. They stress that real-world risk is low. Their closing takeaway: a beginner's questions and persistence drove the work, and anything passively observable may be spoofable.