Security Firm Warns on Flaw in Insulin Pump with No Easy Fix

Rapid7 researchers discovered that the Animas OneTouch Ping insulin pump uses an unencrypted, non-unique proprietary RF protocol between the Meter Remote and pump, allowing intercepted commands to be replayed or spoofed to force insulin delivery. The flaw could enable an attacker within wireless range to induce potentially harmful bolus doses, though exploitation requires proximity and specialized equipment; Johnson & Johnson/Animas acknowledged the issue, recommended mitigations (disable RF, limit bolus settings, use vibration alerts), and stated the overall risk is low.