1
00:00:00,000 --> 00:00:07,020
Our next two speakers include a neurology resident and medical consultant with interest in

2
00:00:07,020 --> 00:00:13,180
medical device security. Prior to medicine, he was an industrial robotics designer. And our

3
00:00:13,180 --> 00:00:19,180
other speaker is a senior security engineer and security researcher at Spirulant Federal

4
00:00:19,180 --> 00:00:26,260
System. He spends his time working on vehicle systems, UAVs and drones, encryption systems,

5
00:00:26,260 --> 00:00:35,100
IOT devices, medical devices, and semi-autonomous systems. So here to talk on their talk of

6
00:00:35,100 --> 00:00:41,600
medical device ethics and security, ladies and gentlemen, Dr. Stanislav and Vlad Gostromleski.

7
00:00:47,800 --> 00:00:51,600
All right. So we're going to be a little dense here. We have a lot of information to go

8
00:00:51,600 --> 00:00:55,980
through. And if you pay attention, we'll have some questions along the way. Spirulants,

9
00:00:55,980 --> 00:01:01,320
very generous to be giving out some t-shirts for any questions you guys answer. So that's my

10
00:01:01,320 --> 00:01:10,220
profile, Vlad's profile. So brain imaging, very important. I use it quite a bit. And it usually

11
00:01:10,220 --> 00:01:15,980
determines what I'm going to do with the patient in an acute setting. So can anyone tell me what's

12
00:01:15,980 --> 00:01:19,420
going on here? What kind of image this is? What are we looking at on the left compared to the

13
00:01:19,420 --> 00:01:24,760
right? Okay. What's going on on the left side? Why was this important?

14
00:01:26,980 --> 00:01:30,860
Well, actually the bright area is representing a bleed, so this is a patient who came in.

15
00:01:31,040 --> 00:01:35,940
This is obviously a picture taken off Google. I didn't put real pictures from my patients

16
00:01:35,940 --> 00:01:43,400
in. The guy came in, hemiplegic, and our job is, do we need to open him and drain the

17
00:01:43,400 --> 00:01:47,820
blood or do you actually do something to break a clot, which is what a stroke is. So this

18
00:01:47,820 --> 00:01:52,560
gentleman gets a t-shirt here. So this is very, very important. In a stroke, time is

19
00:01:52,560 --> 00:01:55,960
brain. So we need to make a decision quickly. And we can't make a decision too quickly.

20
00:01:55,980 --> 00:02:05,540
have any delays. Unfortunately, this happens. So ransomware creates a lot of problems. Hollywood

21
00:02:05,540 --> 00:02:11,760
Presbyterian paid 17 grand, affected their emergency room for a week, and they had to divert

22
00:02:11,760 --> 00:02:16,660
anything neurologically related to nearby hospitals because they couldn't get CT scans in

23
00:02:16,660 --> 00:02:23,700
time. Then the same thing happened in May of this year in the U.K. I want to cry, got them, and

24
00:02:23,700 --> 00:02:31,100
they were diverting strokes all over the place as a result. And now imaging is being used as

25
00:02:31,100 --> 00:02:38,180
defense for murder. So there's a scan of a patient, or actually someone tried for murder in

26
00:02:38,180 --> 00:02:44,760
92. Gentleman choked his wife, threw her out of a window in Manhattan to try to claim she

27
00:02:44,760 --> 00:02:52,200
committed suicide. He was indicted for murder, second degree, and lucky enough, he had a

28
00:02:52,200 --> 00:02:53,400
headache. He went to the E.D.

29
00:02:53,700 --> 00:02:57,960
from jail, and they found this type of picture. This isn't his actual picture, but this is what

30
00:02:57,960 --> 00:03:02,200
they found. Basically, he had a cyst in his brain. It's been there his entire life, but this is

31
00:03:02,200 --> 00:03:06,800
very convenient for his defense. Now, his defense is saying, well, he's missing part of his brain.

32
00:03:06,880 --> 00:03:12,200
When you show this to a jury, I mean, that's a great defense. So then they further qualified it.

33
00:03:12,220 --> 00:03:18,400
They did something called a PET scan to show that that cystic area doesn't function. They

34
00:03:18,400 --> 00:03:23,680
managed to get him a minimum sentence, and this has been the case that now, this is the case that

35
00:03:23,700 --> 00:03:29,320
almost 5% of all murder charges and cases are trying to use neuroscience as the defense.

36
00:03:32,580 --> 00:03:39,240
Well, from a security side, what if images are spoofed? So I have an example. This happened to me.

37
00:03:39,300 --> 00:03:45,320
I was a doctor for maybe a week at the time. A patient comes in. He's a 34-year-old. I'm asked to

38
00:03:45,320 --> 00:03:49,280
see him because he's having trouble breathing. I'm like, all right, I got this. I read about this.

39
00:03:51,280 --> 00:03:56,540
Maybe I'll do an x-ray. I'll listen to him, and there's just crackles, and this is an image they

40
00:03:56,540 --> 00:04:04,120
give back to me. So I'm thinking, all right, what's going on? Anyone give me an idea of what

41
00:04:04,120 --> 00:04:12,360
they think is happening here? Sorry, go ahead. Yeah, that's exactly what it is. So I'm thinking,

42
00:04:12,420 --> 00:04:16,880
okay, well, he's getting worse and worse. Do I put a needle in him and try to drain the fluid?

43
00:04:17,960 --> 00:04:19,160
I'm looking at the image some more.

44
00:04:19,280 --> 00:04:24,620
I think that's the face I probably had because then I start looking at this down the middle.

45
00:04:25,260 --> 00:04:31,780
So, I mean, you see a spinal cord. You see the lung fields. I mean, you see the liver,

46
00:04:31,880 --> 00:04:36,120
and then you're looking at this fluid, and then I go back to the midline. Did I miss this?

47
00:04:36,820 --> 00:04:44,120
It looks like there's old scars from a cardiac surgery. So this guy had his chest opened and

48
00:04:44,120 --> 00:04:47,960
then sewed back together with metal. How did I miss this on my exam when I'm examining someone

49
00:04:47,960 --> 00:04:49,260
for shortness of breath?

50
00:04:49,840 --> 00:04:53,880
And then I realized they switched images on me. So it was someone else's first week, too,

51
00:04:54,500 --> 00:05:00,400
and they mislabeled it. I mean, if this can happen by mistake, I think it can easily be

52
00:05:00,400 --> 00:05:04,820
switched up in another way as well by someone like him.

53
00:05:07,120 --> 00:05:14,100
So, also, computers are now being used a lot in the courtroom. Just a side note. There was a case

54
00:05:14,100 --> 00:05:19,220
in 2016. A gentleman was being tried, and he was probably selling drugs, and then he evaded police.

55
00:05:19,880 --> 00:05:27,480
He should have had a fairly small sentence from what people were thinking. However, Compass was

56
00:05:27,480 --> 00:05:33,120
developed at that time, and they started using that in Wisconsin to determine what the trial

57
00:05:33,120 --> 00:05:38,500
length is, or sorry, the sentence length should be on these people. And the formula is proprietary.

58
00:05:38,840 --> 00:05:44,240
They won't share the algorithm. And the guy received actually a pretty severe sentence because

59
00:05:44,240 --> 00:05:49,060
the computer told the judge he's got a high risk of violence, high risk of recidivism, and a pre-trial

60
00:05:49,060 --> 00:05:55,960
risk was very high. He tried to argue this multiple times in court, and this has been ruled as

61
00:05:55,960 --> 00:05:58,080
completely constitutional, and they're going to continue doing this.

62
00:05:58,280 --> 00:06:02,980
So, essentially, Compass is a threat assessment system for humans. Just like a vulnerability

63
00:06:02,980 --> 00:06:07,120
assessment report for a network, it takes known data points about your criminal background

64
00:06:07,120 --> 00:06:14,420
history, about your current living situation, and creates a risk score. So instead of failing a

65
00:06:14,420 --> 00:06:18,480
PCI assessment, you essentially fail at getting a lighter sentence.

66
00:06:21,380 --> 00:06:27,820
So, back to medicine. Implantable cardiac devices. Very important. There's a lot of them.

67
00:06:28,440 --> 00:06:34,680
10,000 are implanted every month. They save and extend lives. However, it can also be used as

68
00:06:34,680 --> 00:06:41,360
evidence. There's a recent case, a guy who's charged with arson and insurance fraud. Basically,

69
00:06:41,500 --> 00:06:48,120
he called 911 and said, I grabbed a bunch of stuff, I threw it out the window, and his house is on

70
00:06:48,120 --> 00:06:48,360
fire.

71
00:06:49,060 --> 00:06:52,340
The police thought this was very suspicious. Too many things didn't make sense. There were multiple

72
00:06:52,340 --> 00:07:01,780
points where the fire started. But luckily, he had an implanted device, and these suspicious

73
00:07:01,780 --> 00:07:08,120
circumstances were enough to get everything into court, and they brought a cardiologist in, and

74
00:07:08,120 --> 00:07:14,040
he said, these actions are highly improbable because of his medical condition. So that got them

75
00:07:14,040 --> 00:07:18,940
the warrant to get the data. And they looked at his heart rate, his demand, and how long he'd been

76
00:07:19,060 --> 00:07:24,660
gathering his things prior to calling 911. And that was enough to charge him with arson. And the

77
00:07:24,660 --> 00:07:32,160
charges were just filed in January. Fitness trackers. They're awesome, right? We all use them.

78
00:07:33,420 --> 00:07:40,720
But now they're being also used as evidence in court. So, there's a few good cases. I mean,

79
00:07:40,780 --> 00:07:47,100
they're piling up, really. So, this first one, they basically managed to try this guy for murder,

80
00:07:48,000 --> 00:07:53,940
because he was giving the police a timeline, which didn't make sense to them. They used his email

81
00:07:53,940 --> 00:08:01,020
records and his wife's Fitbit data to basically show that she'd been moving around during a certain

82
00:08:01,020 --> 00:08:07,540
time, when he claimed, actually, she was already dead. So, there's a few more cases that recently

83
00:08:07,540 --> 00:08:16,300
came out, basically being a woman who was charged with a fraud after making up a rape case. And it's

84
00:08:16,300 --> 00:08:17,080
just really cool right now. And this is a case that I think is really cool. And it's really cool. And I think it's

85
00:08:17,100 --> 00:08:22,000
now. That's what people are trying to gather the data for and they're using it as evidence.

86
00:08:25,040 --> 00:08:30,580
So I keep hearing about medical devices and the internet of things coming closer together,

87
00:08:30,720 --> 00:08:35,760
how people can take charge of their own lives and their own medical care at home with all

88
00:08:35,760 --> 00:08:39,900
these really cool new devices. So I decided to start taking a look at some of those devices

89
00:08:39,900 --> 00:08:45,380
and actually see how secure the data is that they're gathering since they are not being used

90
00:08:45,380 --> 00:08:51,100
in court. And how accurate they are and whether or not you can spoof the data. Can they actually

91
00:08:51,100 --> 00:08:55,680
frame somebody for murder or can they fabricate some evidence to exonerate somebody for murder

92
00:08:55,680 --> 00:09:02,380
or for arson. One of the most common devices I decided to get my hands on some blood pressure

93
00:09:02,380 --> 00:09:07,640
devices because that's apparently one of the second most common device that people are buying

94
00:09:07,640 --> 00:09:14,780
for home monitoring. The first one being one of these cool little wearables that track you and

95
00:09:14,780 --> 00:09:20,940
broadcast a Bluetooth beacon. I got my hands on the Omron one because that was actually the one

96
00:09:20,940 --> 00:09:24,680
recommended by many nursing homes and that actually is the model that's purchased by many

97
00:09:24,680 --> 00:09:30,500
nursing homes. It's really cool, it supports log in, supports a large number of users so

98
00:09:30,500 --> 00:09:34,740
somebody can actually log in as a caregiver, as a nurse or somebody can log in as a patient.

99
00:09:35,120 --> 00:09:41,120
They can go in and start taking their own samples. I also bought some Chinesium, one of those

100
00:09:41,120 --> 00:09:44,760
cool little iHealth ones just because there was an Amazon. So that's one of the things I'm

101
00:09:44,780 --> 00:09:51,880
interested in. And I started gathering some data points. The Omron one was giving me fairly

102
00:09:51,880 --> 00:09:58,040
consistent data, meaning the samples were close to each other in numbers. However, the data was

103
00:09:58,040 --> 00:10:03,160
wildly inaccurate. Just how inaccurate? The device actually told me to seek immediate medical

104
00:10:03,160 --> 00:10:08,660
assistance. I actually ended up calling my brother at 3 a.m. going, hey, these are the readings I'm

105
00:10:08,660 --> 00:10:14,760
getting. Should I go to the emergency room? So I had my data points and I started gathering some data

106
00:10:14,780 --> 00:10:15,200
points. I started gathering them. And I had a cutting edge, and they were all looking at me and

107
00:10:15,200 --> 00:10:20,200
it was pretty close. My blood pressure verified manually and it was nowhere near close. I mean, my

108
00:10:20,200 --> 00:10:25,300
blood pressure was not perfect, but it was significantly better than what the device was

109
00:10:25,300 --> 00:10:31,620
telling me. So next up is I called Omron and I said, hey, this device is inaccurate, how can I

110
00:10:31,620 --> 00:10:35,360
calibrate it? And it said, well, it doesn't support calibration but we will send you a new one.

111
00:10:36,260 --> 00:10:40,980
So I was thinking, he's got this Bluetooth interface, let's keep playing with it. It turns out

112
00:10:40,980 --> 00:10:44,760
that you actually can calibrate it and you can calibrate remotely, and it doesn't actually get a lot of

113
00:10:44,780 --> 00:10:50,400
need the Bluetooth association pin to be recalibrated. I was able to recalibrate it from outside

114
00:10:50,400 --> 00:10:56,440
of my house. It's still not giving me correct data, but I can give it more inaccurate values,

115
00:10:57,080 --> 00:11:06,980
which I guess is good. Next, x-ray machines. Dentists absolutely love these things. If you

116
00:11:06,980 --> 00:11:10,420
go into the dentist's office, they could take a look at your mouth, they could identify

117
00:11:10,420 --> 00:11:16,460
cavities, and x-ray machines are now actually digital. The data actually gets pushed to the

118
00:11:16,460 --> 00:11:19,980
central imaging server within an office, and a lot of times the copy is made to the insurance

119
00:11:19,980 --> 00:11:26,440
company. I was trying to figure out how these things work, and it actually turns out that

120
00:11:26,440 --> 00:11:32,320
they're using an x11 server with no authentication, no encryption turned on. They are also

121
00:11:32,320 --> 00:11:36,840
using an FTP server with default credentials as shipped from a manufacturer, and they don't

122
00:11:36,840 --> 00:11:40,400
let you change the authentication. So, oh, yeah, it's a little bit of a challenge, but

123
00:11:40,400 --> 00:11:45,320
what you have to do is intercept the FTP log in since it's clear text, you've got your

124
00:11:45,320 --> 00:11:48,800
credentials, now you can go in and now you can change the images around the location of

125
00:11:48,800 --> 00:11:55,820
yourself, mess with insurance data, create the necessary medical procedures possibly. If

126
00:11:55,820 --> 00:11:59,560
you're wondering how I got my hands on one of these, it was definitely not eBay because

127
00:11:59,560 --> 00:12:04,680
medical devices are illegal to buy and sell without appropriate licenses and FDA licensing, so

128
00:12:04,680 --> 00:12:10,380
we definitely wouldn't do that. Of course, the very first thing I did when I got my hands on the

129
00:12:10,400 --> 00:12:18,160
one of these is try to image the weirdest thing I had, which turns out to be a 4,000 lumen

130
00:12:18,160 --> 00:12:24,820
light. For those of you who haven't seen it, it's one of the largest surefire lights that they

131
00:12:24,820 --> 00:12:30,880
make, and I thought it was kind of cool to take a picture of it. So, what's your favorite search

132
00:12:30,880 --> 00:12:39,000
engine? My favorite search engine is Shodan. What it does is it goes out and it grabs information

133
00:12:39,000 --> 00:12:40,380
from different ports, and then it takes the information from different ports, and then it

134
00:12:40,400 --> 00:12:44,140
puts it on different machines that are accessible to the Internet, and it continuously scans all of

135
00:12:44,140 --> 00:12:53,580
the Internet, all of the ports. My buddy, Dan Tantler, likes looking at OpenX servers, and one

136
00:12:53,580 --> 00:13:00,720
time he shot me a link, and I opened it, and I thought, that's kind of cool. So, this is

137
00:13:00,720 --> 00:13:07,640
actually an fMRI machine that's connected to an OpenX server in Iran at a research institute. So,

138
00:13:07,680 --> 00:13:10,380
if you didn't violate any U.S. laws, this is a machine in Iran. So, this is actually a

139
00:13:10,400 --> 00:13:17,280
foreign, hostile country. I don't even know if the patient was alive or dead or what the subject

140
00:13:17,280 --> 00:13:22,540
of the fMRI was, but we were able to find a large number of fMRI machines connected to the Internet

141
00:13:23,070 --> 00:13:27,500
with OpenX and no authentication. We did not poke around at any of the ones in the United

142
00:13:27,500 --> 00:13:31,760
States, but there was a significant number of them in the United States that were open, according

143
00:13:31,760 --> 00:13:40,100
to Shodan. I decided to start looking at some of the medical devices that are used within the

144
00:13:40,100 --> 00:13:44,260
hospital, because I was seeing the same news stories you were seeing about WannaCry and

145
00:13:44,260 --> 00:13:51,480
ransomware. So, I was curious just how vulnerable things like blood infusion pumps were, heart

146
00:13:51,480 --> 00:13:56,040
rate monitors that were used in the hospitals. It turns out quite a few of them are running Windows.

147
00:13:56,700 --> 00:14:02,040
It's a somewhat slightly locked down version of Windows XP. They're still running XP because of

148
00:14:02,620 --> 00:14:07,040
licensing issues for the medical devices and because of the drivers that exist for the medical

149
00:14:07,040 --> 00:14:10,080
devices. So, I'm not sure.

150
00:14:11,280 --> 00:14:16,560
Again, when you start getting some devices, start playing with them. And if you're seeing the

151
00:14:16,560 --> 00:14:24,340
wireless signal, you're not missing things. It actually is all wireless. If you're not going to

152
00:14:24,340 --> 00:14:30,660
embarrass the company, who's able to get our hands on, so we covered up with our logo. If

153
00:14:30,660 --> 00:14:35,480
you're looking at this picture, you see the FCC ID. So, it's as simple as going to the FCC website,

154
00:14:35,980 --> 00:14:40,080
looking at the FCC filings. And you couldn't pull up all the data, so you have to look at the

155
00:14:40,100 --> 00:14:44,620
data about its quote unquote encryption scheme, radio transmission scheme, and Manchester encoding,

156
00:14:45,200 --> 00:14:53,140
all that good stuff. It used this technology called smart hopping. It touts power metering, which

157
00:14:53,140 --> 00:14:59,200
means that what it's actually trying to do is maintain an electronic medical record. So, if it

158
00:14:59,200 --> 00:15:03,600
doesn't get a confirmation from the base station data was received, it keeps ramping up the

159
00:15:03,600 --> 00:15:09,960
transmit power. And since these are wired devices, it actually went to just a bit over one watt, which is

160
00:15:10,100 --> 00:15:15,820
kind of cool for a device that you're wiring that's touching your body. It's automatic retry, so it'll

161
00:15:15,820 --> 00:15:20,560
keep broadcasting over and over again until it gets confirmation transmission. It does some error

162
00:15:20,560 --> 00:15:26,100
correction. And as I mentioned, it's supposed to be electronic medical record, so it's not supposed

163
00:15:26,100 --> 00:15:33,960
to be spoofable, it's supposed to be accurate record. Does anybody know what the security protocol

164
00:15:33,960 --> 00:15:40,080
that's built into this? It's actually the fact that it's on 1.4 gigahertz and it's not supposed to be

165
00:15:40,100 --> 00:15:44,400
not the same devices in your laptop, so it's secure. That's essentially what the specs

166
00:15:44,400 --> 00:15:50,320
told me. So that was cool. You definitely can't buy 50 of those on eBay.

167
00:15:55,220 --> 00:16:00,240
Apparently I'm not the only one that came to the same conclusion. There actually were

168
00:16:00,240 --> 00:16:05,300
recalls on several of these devices. Not all of them, just some of the earlier ones. So

169
00:16:05,300 --> 00:16:09,520
essentially the manufacturer is playing games and they're acknowledging issues in some of

170
00:16:09,520 --> 00:16:14,740
the older devices and pushed some firmware updates and actually forced a lot of hospitals

171
00:16:14,740 --> 00:16:19,020
to buy the newer version of the same device, which also still does not use any encryption

172
00:16:19,020 --> 00:16:30,540
protocols and still uses 1.4 gigahertz. Some of the references, if you want to go back and

173
00:16:30,540 --> 00:16:38,120
follow up on some of the case studies that we mentioned in this presentation. Any questions?

174
00:16:44,080 --> 00:16:46,520
Actually, we do have questions, so please come up to the mic.

175
00:16:58,660 --> 00:17:03,160
All right, do you want to ask some traffic questions? Are there any questions?

176
00:17:09,740 --> 00:17:16,300
So what would be the highest risk piece of equipment in a hospital if it was hit by ransomware?

177
00:17:16,520 --> 00:17:23,680
What would cause the most disruption for a hospital? What needs to be protected the most?

178
00:17:24,700 --> 00:17:30,960
Well, I mean, from my end, because I take stroke calls all the time, so for me the CAT scan is everything.

179
00:17:33,060 --> 00:17:39,180
Because that's the only thing that can make me come to the conclusion, am I pushing this medication that's going to destroy every clot in the body?

180
00:17:39,520 --> 00:17:43,280
Or do I need to worry about taking the blood that the person's bleeding in their brain out?

181
00:17:43,700 --> 00:17:48,900
So if I push this medication at someone who's bleeding, they're just going to die right away and it's going to be my fault.

182
00:17:49,920 --> 00:17:53,160
So that's the one I focus on and to me is very sensitive.

183
00:17:54,560 --> 00:17:59,580
But I mean, any focal point, depending on every specialty, I think matters.

184
00:17:59,640 --> 00:18:05,640
For a nephrologist, I mean, the dialysis machines, if they're hit and they're all digitally controlled, that's going to be a huge problem.

185
00:18:06,460 --> 00:18:09,420
But you have more time, at least, with that to transport a patient somewhere.

186
00:18:11,560 --> 00:18:13,160
My answer would be to follow the money.

187
00:18:13,620 --> 00:18:20,520
If the financial systems, the transaction systems, the billing systems go down, the hospital will simply not be able to operate.

188
00:18:21,740 --> 00:18:22,740
Doctors will be sent home.

189
00:18:22,840 --> 00:18:23,620
They're not going to be paid.

190
00:18:24,080 --> 00:18:25,660
Patients are not going to be able to be billed.

191
00:18:25,660 --> 00:18:31,320
So even if all the medical devices are functioning, you essentially can bring the hospital down to its knees and make it inoperable.

192
00:18:32,700 --> 00:18:34,960
I took a scenario to the head of a hospital.

193
00:18:35,020 --> 00:18:39,360
I said, what if you got a ransomware thing and said, we're not going to encrypt your patient files.

194
00:18:39,520 --> 00:18:43,280
We know you have a Picker X-ray and a Siemens MRI.

195
00:18:43,700 --> 00:18:45,840
And we know the vulnerabilities on those.

196
00:18:45,940 --> 00:18:47,500
And we'll just kill a patient every other day.

197
00:18:47,620 --> 00:18:49,620
And the guy just put his head down in his hands.

198
00:18:49,860 --> 00:18:52,020
Is that a plausible scenario?

199
00:18:52,320 --> 00:18:56,080
And are those vulnerabilities out there somewhere on the dark web?

200
00:18:58,860 --> 00:19:07,960
So I'm not going to comment about a particular manufacturer that has been really terrible about patching known zero days that have been reported for over five years.

201
00:19:07,960 --> 00:19:09,900
However, I will say it is very feasible.

202
00:19:10,300 --> 00:19:16,700
If you go and show them and you search for particular medical devices by model number and by manufacturer, they are out there.

203
00:19:16,760 --> 00:19:17,260
They are connected.

204
00:19:17,800 --> 00:19:23,420
Typically, the most connected devices I find wide open on the network are actually in research institutions.

205
00:19:23,900 --> 00:19:26,240
But the hospital networks are not bulletproof.

206
00:19:27,240 --> 00:19:35,340
We know there are a number of vulnerabilities that let an attacker from the Internet actually pivot to the internal hospital network.

207
00:19:36,160 --> 00:19:37,940
So if you're talking about medical devices.

208
00:19:37,940 --> 00:19:40,680
If you're talking about a determined skill attacker, yes, that's certainly a feasible scenario.

209
00:19:41,280 --> 00:19:45,100
And would you also agree that they can't afford to replace those machines?

210
00:19:45,260 --> 00:19:47,180
We're never going to have a perfect machine.

211
00:19:47,380 --> 00:19:49,020
There will always be vulnerabilities, right?

212
00:19:49,160 --> 00:19:51,380
And if they're $5 million, they can't replace them.

213
00:19:51,740 --> 00:19:55,680
So what we see at larger hospitals is there's actually multiple machines, not just one machine.

214
00:19:56,120 --> 00:19:59,320
So they could, for example, take one offline, which often happens for service.

215
00:19:59,500 --> 00:20:03,600
A lot of times they'll have a newer machine that's a higher resolution and has a longer wait time.

216
00:20:03,680 --> 00:20:06,500
But they can use an older machine for diagnostic purposes.

217
00:20:07,040 --> 00:20:08,120
And one more little one.

218
00:20:08,220 --> 00:20:10,640
I took it to IBM Security and said, oh, of course there's an answer.

219
00:20:10,680 --> 00:20:12,900
Just air gap it, which is ridiculous, right?

220
00:20:13,260 --> 00:20:14,240
Tell me it's ridiculous.

221
00:20:14,640 --> 00:20:16,200
So air gapping is excellent.

222
00:20:16,360 --> 00:20:21,360
However, what typically happens is somebody may want to look at the data.

223
00:20:22,420 --> 00:20:25,720
For example, the fMRI data from their home.

224
00:20:25,800 --> 00:20:32,340
Or a doctor may, for example, be emailed even the imaging scan instead of having to drive into the hospital.

225
00:20:32,460 --> 00:20:33,880
So that typically doesn't happen.

226
00:20:34,260 --> 00:20:36,180
Years ago, fMRI data was transferred.

227
00:20:36,500 --> 00:20:38,540
It was sent to the CDC just because of the size of the data.

228
00:20:38,580 --> 00:20:40,860
They would write the CD or DVD with a PDF file.

229
00:20:41,220 --> 00:20:43,000
But now it's typically emailed across.

230
00:20:44,560 --> 00:20:48,700
MRI is actually interesting because all it takes is a small hit.

231
00:20:49,080 --> 00:20:51,440
So this happened in my hospital a couple months ago.

232
00:20:51,760 --> 00:20:53,340
They were cleaning the MRI area.

233
00:20:53,500 --> 00:20:55,940
And cleaning service accidentally hit the emergency button on it.

234
00:20:56,240 --> 00:20:57,500
Well, the MRI is always on.

235
00:20:57,540 --> 00:20:58,160
It never turns off.

236
00:20:58,360 --> 00:21:01,180
And it takes you a few days to spin up for it to work again.

237
00:21:01,260 --> 00:21:03,140
So by that one action, we were out for a week.

238
00:21:03,180 --> 00:21:03,880
We couldn't do any scans.

239
00:21:06,500 --> 00:21:11,780
So an attack at that point, I mean, no matter how small or how non-disruptive it is,

240
00:21:11,880 --> 00:21:13,700
it's going to still delay you by a week.

241
00:21:19,660 --> 00:21:26,340
So like earlier you mentioned like a lot of legal cases are using neuroscience as like perhaps a defense.

242
00:21:27,020 --> 00:21:33,900
I was actually wondering like to what extent would perhaps a blood clot in the front of the brain

243
00:21:33,900 --> 00:21:37,200
like get someone off?

244
00:21:37,360 --> 00:21:43,600
Like would it really make them be able to be tried as like a different person

245
00:21:44,080 --> 00:21:46,720
than like when they actually committed the crime?

246
00:21:46,900 --> 00:21:53,820
Or could you just maybe talk about to what extent like the actual blood clot would affect the legal defense?

247
00:21:54,260 --> 00:21:58,280
So in this case, it was a cyst that the gentleman probably had his entire life.

248
00:21:58,500 --> 00:22:03,880
And what they used that, they used that to get him off in the fact that he was not sane enough.

249
00:22:03,880 --> 00:22:06,340
To be there or healthy enough to be on trial.

250
00:22:06,680 --> 00:22:13,100
And they were saying this medical disability is what made him not be able to function at a normal level like anyone else.

251
00:22:13,260 --> 00:22:15,640
So his actions, he wasn't responsible for.

252
00:22:16,260 --> 00:22:20,100
If it was something transient like you're describing, I don't know of any cases that's happened yet.

253
00:22:20,500 --> 00:22:26,000
But that would certainly be a plausible scenario for someone to have this transient state, commit an action,

254
00:22:26,200 --> 00:22:28,820
and then say that was the reason why it happened.

255
00:22:28,860 --> 00:22:33,200
You just have to prove that that happened during the time that there was a clot or something of that nature.

256
00:22:33,960 --> 00:22:36,940
So what we've seen in cases where somebody had a tumor,

257
00:22:37,520 --> 00:22:39,980
they were able to successfully argue diminished capacity.

258
00:22:40,480 --> 00:22:46,040
So even though the tumor was removed, they were still confined to a psychiatric institution

259
00:22:46,040 --> 00:22:50,180
until such time as the state of New York was able to be comfortable

260
00:22:50,180 --> 00:22:52,480
that they were no longer a danger to themselves or others.

261
00:22:53,060 --> 00:22:55,720
So people aren't completely let go.

262
00:22:55,940 --> 00:22:58,160
They're still typically institutionalized.

263
00:22:58,320 --> 00:23:01,620
But they're either tried for, tried as diminished capacity,

264
00:23:01,620 --> 00:23:03,400
or held in psychiatric institutions.

265
00:23:05,460 --> 00:23:09,440
There have been cases where intoxication, people have used that as a defense.

266
00:23:09,760 --> 00:23:13,640
And the way I understand the law right now is if you chose to take the substance,

267
00:23:13,840 --> 00:23:15,800
you are liable for any actions you take on the substance.

268
00:23:17,380 --> 00:23:19,980
If this is slipped to you, then it's a different story.

269
00:23:23,860 --> 00:23:26,060
There was also a case a few years ago.

270
00:23:26,500 --> 00:23:29,420
There's a gentleman who had a sleep behavior disorder.

271
00:23:29,720 --> 00:23:30,940
He was sleepwalking.

272
00:23:31,620 --> 00:23:32,540
And he murdered his wife.

273
00:23:32,600 --> 00:23:35,540
Got in his car, drove to his ex-wife's house, and killed her.

274
00:23:35,780 --> 00:23:39,600
And I think he actually used that as a successful defense, if I remember right.

275
00:23:42,960 --> 00:23:46,080
So in that case, he actually had a documented history of sleeping disorder.

276
00:23:46,240 --> 00:23:48,020
He had history of sleepwalking that was documented.

277
00:23:48,040 --> 00:23:48,980
He had sleep studies.

278
00:23:49,140 --> 00:23:52,580
So this wasn't something that they sprang up as a defense last second.

279
00:23:52,680 --> 00:23:57,520
He actually had the medical history to back up those claims in advance of the act.

280
00:24:00,420 --> 00:24:00,820
Yes.

281
00:24:00,820 --> 00:24:06,640
So when hospitals buy medical devices, do they have many choices on which vendor to use?

282
00:24:06,740 --> 00:24:09,340
And is security ever a factor in those choices?

283
00:24:09,980 --> 00:24:11,420
So in the past, it hasn't.

284
00:24:11,480 --> 00:24:16,400
What you're seeing hospitals doing increasingly is actually performing penetration tests

285
00:24:16,400 --> 00:24:19,900
and performing assessments, even though vendors expressly forbid them.

286
00:24:19,980 --> 00:24:24,920
And they're using the results of those penetration tests for their buying choices

287
00:24:24,920 --> 00:24:26,460
and in contract negotiations.

288
00:24:27,040 --> 00:24:30,420
So we're seeing that increasingly, and I hope that trend does continue.

289
00:24:30,960 --> 00:24:34,400
Because as we find in some cases when we do penetration tests,

290
00:24:34,900 --> 00:24:36,740
when hospitals look at their agreements,

291
00:24:37,040 --> 00:24:41,860
it's expressly forbidden for them to perform independent penetration tests on the hardware.

292
00:24:42,140 --> 00:24:42,840
They don't own it.

293
00:24:42,900 --> 00:24:45,760
They simply license it, even though they paid for it.

294
00:24:47,400 --> 00:24:47,880
Thanks.

295
00:24:53,880 --> 00:24:58,660
So like those medical devices that are not on the Internet, just on the Internet network, right,

296
00:24:58,660 --> 00:25:03,220
do you often find them that they are segregated from the main corporate network,

297
00:25:03,320 --> 00:25:07,520
like user LAN, or are they just there for everyone to access?

298
00:25:08,680 --> 00:25:09,760
So a few good points.

299
00:25:10,100 --> 00:25:13,560
Even in cases where they are separated, it's not actually a separate physical network.

300
00:25:13,720 --> 00:25:18,140
It's simply VLAN, and we know VLAN hopping can easily be accomplished.

301
00:25:19,040 --> 00:25:24,000
Also, internal network can often be connected to from the outside,

302
00:25:24,180 --> 00:25:26,340
whether it's by wireless vulnerabilities

303
00:25:26,340 --> 00:25:30,260
or by improper configuration of their AD servers

304
00:25:30,260 --> 00:25:32,120
and improper configuration of their VPN servers.

305
00:25:32,900 --> 00:25:35,480
Some of their financial systems, they have to be dual-homed.

306
00:25:36,440 --> 00:25:37,940
They're actually connected to the Internet.

307
00:25:38,240 --> 00:25:41,540
And so, for example, if you can remotely connect to them,

308
00:25:41,660 --> 00:25:47,040
do you find that you can completely compromise that device and perform all the operations,

309
00:25:47,240 --> 00:25:51,420
or is there usually a manual set, manual part to it?

310
00:25:52,100 --> 00:25:54,820
From what we've seen, I couldn't even really call it a compromise,

311
00:25:54,820 --> 00:25:57,760
because what you're doing is downloading configuration software

312
00:25:57,760 --> 00:26:00,260
for the machines, downloading firmware, and simply pushing it.

313
00:26:00,380 --> 00:26:04,760
Those devices implicitly trust the configuration software.

314
00:26:04,980 --> 00:26:06,660
They don't require any sort of authentication.

315
00:26:07,020 --> 00:26:10,400
So as long as they're getting the configuration packets coming in over TFTP,

316
00:26:10,580 --> 00:26:11,660
they're happy to comply.

317
00:26:12,220 --> 00:26:13,740
Okay. Thank you.

318
00:26:14,400 --> 00:26:15,580
Thank you both so much.