Hacker News Reader

Comment by gustavus | Hacker News Reader

So my wife has a CGM and is stuck with a fancy pump that is supposed to "automatically" coordinate with her sensor to deliver or reduce insulin when it detects her numbers are too high/low.

I've always been suspicious of the yahoos writing the software that controls these kinds of devices being a security guy and all.

But I also would love to participate in, contribute to or help in any way with reverse engineering, open sourcing, or in some other way making it so that my wife's life isn't dependent upon the quality of software developed by the lowest bidder they could outsource it to.

If anyone knows how I could help please let me know who to reach out to.

View on HN

I worked at medtronic in the early 2000's (early paradigm pumps) and were evaluating wireless protocols and security... at the time we determined it was impossible to secure, once the FDA approved another device maker that did have connectivity there was a scramble to catch up. (this was palmos/pocketpc era). It was fun work but I always remembered how insanely detailed the code was, 8bit low power microcontrollers (some 16bit) but really really really tight C code. Then the demand for remote control happened and that really crapped the bed. https://www.medtronic.com/en-us/e/product-security/security-...

The amazing developer Scott Hanselman built on a PalmOS app to store readings and if I recall correctly wore 2 pumps with fast/slow insulin... he had a cybernetic pancreas in the mid-2000's.

There is an open source project using older pumps and somewhat older CGMs (Dexcom G6 and prior)

https://openaps.org/

I'm using Openaps with Omnipods. Nice not having to deal with proprietary apps.

Currently using Libre as sensor, luckily without their shit app. Dexcom was easier to set up.

Android APS, and xDrip. Getting watches to allow ble connection for CGMs is a great RE opportunity. It is really hard to have stable bluetooth connections.

Since you’re in security, you may enjoy this write up of decrypting the app database with glucose readings and third party API keys - https://www.frdmtoplay.com/freeing-glucose-data-from-the-fre...

Reply on news.ycombinator.com