Death's Messengers

The question is not whether it can be done. It already was.

Death’s Messengers is a performative work built around a working exploit of the Omnipod insulin pump. One of the most widely prescribed insulin delivery systems in the world. The pump communicates with its controller over a proprietary 434 MHz radio protocol. That protocol has a flaw. This work makes the flaw operational and visible.

We built a software-defined radio system in C++ to demonstrate the exploit. The radio receives and transmits on the pump’s operating frequency, decoding incoming signals from the pump and constructing outgoing packets that the device accepts as legitimate. To pass the pump’s validation, outgoing packets must be correctly encoded, prepended with the protocol’s sync words, and validated against both CRC-8 and CRC-16 checksums before transmission.

What those packets contain is the point: bolus commands, injections, cancellations. Sent without the pump owner’s knowledge, without authentication, without any mechanism for the device to distinguish a real controller from a laptop running in the same room.

The second component of the work is an automated email campaign: a minimal web tool that generates individualised messages to the manufacturer’s CEO, linking to the published vulnerability documentation.

The underlying vulnerability was identified and documented by security researchers Alexander Krog and Jens Hegner Staermose of Lyrebirds.

Made possible with grants from The Danish Arts Foundation