Barnaby Jack

Barnaby Michael Douglas Jack (22 November 1977 – 25 July 2013) was a New Zealand hacker, programmer and computer security expert. He was known for his presentation at the Black Hat computer security conference in 2010, during which he exploited two ATMs and made them dispense fake paper currency on the stage. Among his other most notable works were the exploitation of various medical devices, including pacemakers and insulin pumps. In 2012 his testimony led the United States Food And Drug Administration to change regulations regarding wireless medical devices.

Security research

ATMs At a Black Hat conference in 2010, Jack gave a presentation on "jackpotting", or causing automated teller machines to dispense cash without withdrawing it from a bank account using a bank card. The scenario was first described in fiction in the 1995 cult movie Hackers. Jack gave demonstrations of different kinds of attacks involving both physical access to the machines and completely automated remote attacks. In both cases, malware was injected into the operating system of the machines, causing them to dispense currency fraudulently on the attacker's command. During the physical attack on an automated teller machine (ATM) as demonstrated by Jack, the attacker takes advantage of their physical access to the target machine and uses a flash drive loaded with malware to gain unauthorised access to the machines allowing control over their currency dispensing mechanism. During the remote attack, malware is installed onto the target system via exploited vulnerabilities in the remote management system, most notably the use of default passwords and remote management TCP ports. The attacker then executes the malware, causing the target ATM to dispense currency.

Medical equipment At the McAfee FOCUS 11 conference in October 2011 in Las Vegas, while working for McAfee Security, Jack first demonstrated the wireless hacking of insulin pumps, one worn by a diabetic friend and another of the same model on a bench set up for demonstration. Interfacing with the pumps with a high-gain antenna, he obtained complete control of the pumps without any prior knowledge of their serial numbers, up to being able to cause the demonstration pump to repeatedly deliver its maximum dose of 25 units until its entire reservoir of 300 units was depleted, amounting to many times a lethal dose if delivered to a typical patient.

At the RSA Security Conference in San Francisco in February 2012, using a transparent mannequin he demonstrated that he could wirelessly hack the insulin pump from a distance of up to 90 metres using the high-gain antenna.

In 2012, Jack demonstrated the ability to assassinate a victim by hacking their pacemaker. Jack demonstrated delivering such a deadly electric shock live at the 2012 BreakPoint security conference in Melbourne. Barnaby Jack, the director of embedded device security for computer security firm IOActive, developed software that allowed him to remotely send an electric shock to anyone wearing a pacemaker within a 50-foot radius. He also came up with a system that scans for any insulin pumps that communicate wirelessly within 300 feet, allows you to hack into them without needing to know the identification numbers and then sets them to dish out more or less insulin than necessary, sending patients into hypoglycemic shock quickly if excessive insulin was dispensed or ketoacidosis if not enough insulin was dispensed over a period of time. At the time of his death, he was due to attend a Black Hat Briefings hacking conference in Las Vegas. Black Hat general manager Trey Ford, said "Everyone would agree that the life and work of Barnaby Jack are legendary and irreplaceable", and announced his spot would not be replaced at the conference.