[Group_B]

Oh well. The whole thing has already been reverse engineered. Look up Loop or Trio or OpenAPS. Diabetic companies like Insulet have been very lax when it’s come to the hacking of their devices. This isn’t really that big a deal. What we need right now is help REing the Omnipod 5

[duban]

I’m aware of a few people working on REing the Omnipod 5. The furthest issue that I have seen is that when a PDM/Omnipod 5 app signs into your insulet id, it gets a private key from the API which is stored in the keychain (and uses SSL pinning to prevent MiTM retrieval of the private key). When pairing with the pod they exchange public keys and then a derived key from the devices private key+pods public keys, but haven’t been able to get a copy of a private key yet to make further progress.

[Group_B]

Anyway to follow the progress? I attended the Nightscout conference and asked around regarding this but no one really knew of any group to follow. Or really knew of the latest developments on this effort.

[duban]

I am not aware of any public groups to follow the progress, I have just met a few people on the Loop Zulip and have talked with them every few months whenever people have time to look into it.

[Group_B]

I'm thinking we probably need to get more organized and start picking up the pace with this. There are rumors, which of course I am not sure how credible, but word is that the Dash will be discontinued soon. Maybe we can add another channel to the Zulip to try to get things moving.

[kakoni]

Was going to ask the something. And also, so the omnipod app is not using android attestation but stores private key it got from omnipod server?

[duban]

It seems to use the play integrity API when communicating with Insulet's servers which provide a private key to the PDM/app once it was registered with the user's account. However since the Pod doesn't have access to the internet, it has no way to check the play integrity signature AFAIK, so instead it checks that the certificate that the PDM/app presents to it is issued from the cert chain that it trusts.

[fyhn]

Not all though, I've been looking at Minimed pump reverse engineering (which would be just reading glucose data, not controlling the pump), and that's not solved yet, at least not for the 780G. But I hope it will be, and perhaps I'll be able to contribute.

[mlsu]

I don't work for Medtronic. But it's extremely unlikely that will happen. It's not merely a matter of reverse engineering -- after the original medtronic "hack" / reverse engineer efforts (the ones that lead to the original openAPS system being developed) the FDA put out new guidance on cybersecurity protections for insulin pumps.

The communication between your phone/pump or glucose sensor/pump is encrypted now for all newer devices.

> Diabetic companies like Insulet have been very lax when it’s come to the hacking of their devices

Absolutely not true, not any more.

[Group_B]

No it's true. Companies like Insulet and Dexcom could send out lawsuits to all the open source projects out there that involved REing. Dexcom's glucose share API was REed years ago, and Dexcom hasn't even tried updating or stopping the use of unofficial APIs. All I'm saying is that the companies really don't care at all.

[sarusso]

> The communication between your phone/pump or glucose sensor/pump is encrypted now for all newer devices.

May I ask where did you get this info? And what “newer” means here?

[ijustlovemath]

This person is referring to this guidance document: https://www.fda.gov/medical-devices/digital-health-center-ex...

I'm a medical device developer working on this exact problem (glucose control)

[sarusso]

Thanks!