hi, everyone. welcome to "on the money" had. i'm kelly evans in for becky quick. the new cyber threat you may not know about. are your medical devices at risk? why hacking your health could really happen. delivery by drone. will your next package be dropped from the sky? from burritos to books it's all coming. and paying for college may have gotten a little easier. how to navigate your way around new financial aid forms and why you should do it now. beautiful bellies. expectant moms turn their tummies into a canvas for a great cause. >> naturally it came to me three days before i was delivering my first child. >> "on the money" starts right now. this the "on the money,"

your money, your life, your future. we begin with a cyber threat to your health. medical devices like insulin pumps could be vulnerable to an attack from hackers. reporter meg tirrell with a cyber security risk is something you may not have thought about. hacking your health is had week's cover story. >> reporter: more than 100,000 people with diabetes eventually got a strange letter from johnson & johnson. the health care giant was warning them of a cyber security risk with one of its insulin pumps. the one-touch ping insulin pump system comes with a remote control. to enable delivery of insulin. j&j says no one has been harmed in this way but it is possible someone could hack into the device and control insulin delivery. >> we need to give users and patients the information so that way they can determine if it's too risky for them or if it's not risky for them. >> reporter: jay radcliffe is the researcher who made the discovery. while he works in cyber security at firm rapid seven, his work on the insulin pump was a side project. he's diabetic, and it was his pump on which is he did the research.

>> this is just out of my own personal curiosity about how these devices work and how safe they are for my own personal use as a diabetic. >> reporter: j&j says the probability of unauthorized access to the one-touch ping system is extremely low. someone trying to hack in would have to be within 5 feet of the person wearing the device and specialized skills not to mention harmful intentions. the company says there are ways to mitigate the risk, turning off the radio frequency features limiting how much insulin can be delivered at once and setting a vibrating alert system. the device is 8 years old. new err systems j & j say have encryption technology that be harder to hack. it says this issue doesn't exist in its other products. jay radcliffe, the researcher who discovered the flaw, says he doesn't use the one-touch ens lynn pump anymore, but it's not because of his findings. he believes the fixes recommended especially turning off the radio frequency work well to eliminate that risk. >> thank you. cyber security and medical devices is a growing area of

focus and concern. earlier this year, the food and drug administration issued draft guidance to manufacturers on how to address the evolving cyber threat. kevin fu is director of the university of michigan center for medical device security. professor fu, thank you for joining us. >> good morning, kelly. >> with this latest report now, how widespread is this threat and how serious is this the cyber security risk to medical devices? >> well, the dirty little secret is that most manufacturers did not anticipate the cybersecurity risks when they were designing them more than a deck ailed ago, so this is just scratching the surface really. >> that being said, j&j, for example, said that its updated devices are a little bit safer. do you believe that to be the case, not just specifically for this one insulin pump but for other devices subject to these hacks? >> it's hard to know. i think the important thing, as you point out, is that fda is rolling out expectations for cyber security being built into medical devices as well as

preparations for when there's some kind of risk that reaches the market in an unanticipated fashion. so i think manufacturers will be improving, but it's not going to be an overnight fix. >> what other types of medical devices are vulnerable to these attacks? >> well, pretty much every device that has had a computer in it is breakable. there is no unhackable device, so i think the more interesting question is not whether you can hack into a device but how well do the devices tolerate the kind of threats that are endemic to computing today and endemic to the internet. so you'll see these devices ranging from the insulin pumps to infusion pumps that are bedside devices and hospitals. and then you also have on the extreme things like pacemakers and defibrillators and in between all sorts of other things, patient monitors, radiation therapy and all sorts of devices are in the hospital. >> and in meg's report she discussed how one researcher discovered this by tinkering out

of curiosity and concern about his own safety. what do you think the motive would be for other hackers outside parties to target hospitals or individuals? >> well, to be honest i'm less concerned about targeted attacks against hospitals because i know from experience that it really doesn't take a whole lot of skill to cause havoc. you'll certainly be finding some very talented hackers showing the faults in medical devices, but the bigger issue is really the continuity of the hospital's operating system, how can they withstand malware from ten years ago that still breaks into medical devices. >> the fda are working on medical device security but are they doing enough? >> i think the fda can do more. but this is a brave new world. certainly there were a few people, myself included ten years ago advocating to the fda and various government agencies that you need to watch for these security problems. they did listen, but typically the government reacts on a cycle

that's measured in four or five years, not overnight. >> and the meantime for those hospitals caring for patients overnight and healthcare providers and others, are they investing enough themselves in cybersecurity? >> well, i heard from one cio of a large hospital system that he went to his board asking for a $5 million annual budget and the board said how about 6 million. so i think some hospitals are beginning to invest more heavily in cybersecurity. the real problem is they don't -- they have a hard time even knowing what medical devices are at risk. so it's pretty basic right now in the hospital systems. and as far as patients go, personally i think patients are far safer with these devices than -- than not. patients are predisposed to medical risks, and even though i'm a security researcher and i believe in improving the security of devices, i know that patients are much safer with these than without. >> that brings the final pressing question, how can patients protect themselves for all kinds of medical devices that may be in their lives? >> right.

i think it really goes back to basics. you know, the patient should talk with their physician to ask about the risks and benefits. you'll hear a lot of discussion in the media about the risks, but you're probably going to hear more about the benefits when you talk with your physician. for instance, with pacemakers and defibrillators it's been shown with remote monitoring patient outcomes are far improved, so disabling wireless communication can actually ometimes reduce the benefits. and so the risk benefit decision has to be made between the particular patient and the particular physician. >> all right. thanks again for joining us. that's kevin fu. >> all right. >> now, here's a look at what's making news as we head into a new week "on the money." john stumpf is it out as chairman and ceo of wells fargo. he retiring after a scanned a.m. in which wells fargo bankers opened accounts for customers without their knowledge. stumpf testified before congress last month and chief executive officer tim sloan is taking over as ceo. it was a choppy week for the markets.

the dow falling 200 points on tuesday, its worse day in about a month, though it recovered a bit midweek. the nasdaq closed at an all-time high on monday but it was all downhill from there. but stocks closed higher on friday. the federal reserve's open market committee released minutes from its latest meeting, and it looks like interest rates will go up, quote, relatively soon. members agree that the case for increasing interest rates has strengthened because the labor market has improved. the fed next meets in november and then again in december. and retailers probably won't find a lump of coal in their holiday stockings. a new survey finds americans plan to spend an average of $636 on holiday shopping this year, up 3% from last year, and all signs point to a retail season that will be better than a year ago. up next we're "on the money." what goes 30 miles an hour, has night vision and can drop off your package? hint, it might make the u.p.s. delivery man go the way of the horse and buggy.

fafsa 101, how to get the most money for anyone heading to college. now a look at the stock market and how it ended the week.

when you want to order something online, you usually want it delivered yesterday. well, that may not be possible, but what is becoming possible is to have it delivered by drone. u.p.s. u.p.s. is starting to test them for commercial use. our morgan brennan went to marblehead, massachusetts, to check out drone deliveries.for . our morgan brennan went to marblehead, massachusetts, to check out drone deliveries. >> reporter: it's coming sooner than you may think. package delivery by drone. u.p.s. took to the skies to test a commercial delivery using an

unmanned aerial vehicle. the delivery scenario, a child forgot her asthma inhaler after heading to camp on a remote island. the three-mile eight-minute mission over water from beverly, massachusetts to children's island was conducted by sci-fi works which claims u.p.s. as an investor. this delivery drone is a hexicopter fully autonomous meaning it can fly itself, equipped with night vision and can go at fast as 30 miles per hour. and, of course, it's branded in u.p.s. brown. experts say the adoption of drone technology will be crucial as customers continue to buy more online and do so with faster delivery expectations. >> the total cost of ownership of drones to actually have a full drone delivery fleet is not determined at this time. but the costs per mile is pretty low, maybe as low as five cents per mile on actually delivering and moving the drone. >> reporter: competition is fierce. amazon is conducting advanced tests with its prime air drones in the uk and alphabet's project wings drowns are delivers chipotle at virginia tech, just to name a few. over the next ten years unmanned aircraft systems could generate more than $80 billion for the

u.s. economy, according to the white house. and federal aviation officials estimate 600,000 commercial drones will be operating stateside within a year. yet, despite all of the talk, drone use for package deliveries has been slower to catch on. largely because new regulations require operators always have a line of sight on the aircraft. >> when you prove that this has value and you collect the data to convince the faa to open up other areas, then we'll be able to do more non-line of sight deliveries. >> reporter: right now as data is collected and new regulations sort out, it's tests like this one running urgent deliveries to remote locations like children's island where drone deliveries make the most economic sense. that recent flight made u.p.s. the first major transportation carrier to attempt this type of delivery on u.s. soil. and under new faa regulations that took effect at the end of august, sci-fi is running regular experiments to develop this technology further, and it is collecting data because the

goal is ultimately a drone fleet that could provide another way for u.p.s. to make deliveries, kelly. >> when will drone deliveries really happen? >> reporter: that's the big question here. helen greener, the founder of sci-fi, said they make drones for military use and a wide variety of other uses. she thinks package delivery is the single biggest opportunity for drone deployment, but because of regulations where you can't operate the drone out of the line of visual sight and you can't operate a drone over people involved in that test, this will take a lot longer for package deliveries. that being said, there are special tests being done here and other places, amazon and the uk, to collect the data to see how efficient this could be. >> as soon as they change the rules, the sky's could be filled. >> sky's the limit. >> up next "on the money," we all know paying for college can be difficult and daunting. we'll share tips on what every college-bound student should do to help finance their future. and later you may call it a

pregnant pause for spanx founder and billionaire sara bla blakely. her story of success and how show he's paying it forward in an unusual way. honey, aren't we having friends over? it reeks in here.

i know [goat noise] i stole the other team's mascot for good luck. we need to wash this room. wash it? yeah, wash it with febreze. for all the things you can't wash, use febreze fabric refresher wow [inhales] it really smells great in here. dog barks and try pluggable febreze, with up to 4 times the freshness in one refill. pluggable febreze and fabric refresher [inhale + exhale mnemonic], two more ways to breathe happy

fall, it's the beginning of a new school year and now it's also the beginning of the new federal financial aid process for the college-bound. this year families can apply three months earlier for federal financial aid than in the past. what other changes have been made, and why is this beneficial?

here to explain it kelly peeler, the ceo and founder of nextgenvest, a text message service helping students in the financial aid process. kelly, welcome. >> hi. >> so this fafsa change moving it three months earlier is a big deal and this is the transition what do people really need to know right now? >> they need to know one thing, the fafsa is already released. came out october 1st so if you haven't gotten all of your tax forms together and your bank statements and your w2 and investment portfolio, all things you need to submit on your right now. and if you can submit it as soon as you can. >> why did they change the date and are there any other dates here? >> they changed the date, used to come out january 1st, and it's really to streamline the whole process of applying for free federal aid. so that stands the free application for federal student aid is what the fafsa stands for. and so in the future it will likely be a lot easier. can you actually use tax returns from the previous year, but this year it's a little bit confusing

because a lot of people are being caught off guard about the new change and the release date >> you mentioned the earlier that you submit, the more you're likely to get the money or more money. >> exactly. it's a little bit complicated in terms of why. we really like to encourage students over text messages to submit their fafsa as soon as they possibly can, namely because a few different reasons. one, some universities are changing their own priority deadlines, whether in arizona or ohio and so students might need to submit their forms earlier than they might have otherwise needed to, maybe as early as november to start accessing institutional aid from the colleges. and the second is really because you get a better sense of your whole financial picture as you go through the financial process whether that's early decision or regular decision. >> who are come.

what are some common mistakes to avoid making on this early application? >> really not filling it out is the biggest one and i say that because $2.7 billion of free federal aid went unclaimed despite the fact that students graduate with about $37,000 in student loan debt so that means there's a lot of free federal aid out there that people are not taking advantage of and there's a few reasons why. a lot of times students do not qualify and wouldn't bother and that's really what we want to encourage you is might as well fill it out. >> and what other tips do you have to get the most financial aid possible? >> in terms of just general tips, we really see a lot of students not actually knowing that they can negotiate their tuition once they actually get into the college. >> negotiate? >> yeah. that's something a lot of people don't really know. it's not a guarantee, but we last semester were able to help students negotiate about $250,000 in their tuition just by negotiating and going through an appeal process. >> well, i hope everybody listening is getting a jump start on what can be an overwhelming process. >> yes, it's very stressful. >> thanks for joining us, kelly peeler. up next "on the money," a look at the news for the week ahead and how the founder of spanx is paying attention to a woman's shape but in a very different way. the billionaire bellies and

giving back. >> the pictures turned out so fun and amazing, i thought i want to do something more with this concept and idea.

for more on our show and our guests go, to our website otm.cnbc.com, and you can follow us on twitter at "on the money." here are the stories coming up that may impact your money this week. on monday we'll get a look at manufacturing with the industrial production report for september. and be nice to your boss.

it's national boss' day. who knew. on tuesday a read on inflation with the consumer price index for september and wednesday marks the anniversary of the 1987 stock market crash remembered as black monday when the dow fell 22% in one day. and hillary clinton and donald trump will face off in the third presidential debate moderated by chris wallace of fox news. come thursday we'll get existing home sales for september. spanx, it's a billion dollar brand founded by entrepreneur sara blakely. now she's turning her attention to another female silhouette, the baby bump. before our becky quick started her maternity leave she sat down with blakely to discuss her mission to help moms with her new book "the belly art project" and how she first came up with the idea for spanx. >> reporter: naturally the idea came to me at 3:00 in the morning three days before i was delivering my first child. and i woke up in the middle

of the night and i thought oh, my body is amazing. the state that it's in, and i thought it may never be in this state again, and i wrote down at 3:00 in the morning watermelon, beach ball, basketball and mr. potato head. >> and that's what you felt like at that point. >> and i fell back asleep and called friends the next day and they painted my belly. actually went into the grocery store, bellied up to the watermelon display. >> you have a picture of it. >> and it was so much fun and i was giving them as a gift to my husband. and the pictures turned out so fun and amazing and i thought i want to do something more with this concept and idea. >> you linked up with christie turlington burns. how did you find her and this organization? >> so once i started recruiting other pregnant women to be in the book and use their bellies as canvasses of hope and just wanted the project to take on a life of its own, and i feel very much like charity and philanthropy can be fun. and christie turlington's foundation came across my path and i went to haiti with her and her team and my foundation and the work that i do is about empowering women, but this was

so linked with pregnancy and maternal health that i wanted to give all the proceeds to some foundation that was directly linked to helping maternal health. >> with all the women that are in there, there's also one man. >> one man, and for all the money i bet no one would ever guess who is the man that painted his belly in the book. >> do tell. >> drum roll, warren buffett. i showed him what i was up to one day at lunch. and he said what are you up to, sara? and i showed him on my phone, all these bellies painted and burst out laughing. and he said that's amazing. i want to be in the book. i said, warren, you're not pregnant. that's okay and he grabs his belly and said don't you have enough here to work with. >> you're still running a business, founded spanx and came up this entire idea yourself, and this is another part of your inventor self. how did you get into the idea of spanx? >> myself as a consumer, like all great inventions, frustrated consumers often invent and i could not figure out what was

the right undergarment to wear under white or cream pants. everything showed, everything left a panty line and girdles were way too heavy duty, i thought there needed to be something in the lane in between. spanx is born by my own rear end. don't underestimate a woman who doesn't like the way she looks in white pants and can't figure out what to do about it. >> you've come such a long way. it's not just the fannie huggers. you have bras. you have leggings and all kinds of different things that have come out here, so where do you see this brand going? >> i've been saying i want to invent a comfortable high heel for quite some time. >> good luck with that. >> somebody's got to do it, but i see the brand -- i really view myself as an advocate for women as a customer. you know, i just felt like especially in the industry that i broke into and kind of revolutionized that industry, it was an industry that had fallen asleep at the wheel and stopped caring about how we felt. >> well, thank you for sharing the belly art project with us. >> oh, my god, thanks for being in it.

>> you actually convinced me to take off my top, too, for this. you're a very persuasive person. >> thank you. you have the cutest belly ever, the lucky penny, are you kidding me. >> oh, i love it. becky no longer has that lucky penny though. proud momma gave birth to kaylie noelle last weekend. congratulations to all. baby and mom are doing great. that's all for today's show. next week, when you take a dn arc test to reveal your ancestry, it could reveal something you may not want to know. each week we're right here "on the money." have a great one, and we'll see you next weekend.

market site, the guys getting ready behind me. while they're doing that, here's what's coming up on the show. ♪ it's a good time for the great taste of mcdonald's ♪ >> but it may not be a good time to buy the stock, because mcdonald's shares are pennies away from doing something bad. we'll explain. plus -- >> can you hear me now? >> we can. but investors in verizon certainly don't like what they're hearing. but now might be a buying opportunity. and we'll explain why. and -- something in the charts that says one sector is a screaming buy. and here's hint.