Our next two speakers include a neurology resident and medical consultant with interest in
medical device security. Prior to medicine, he was an industrial robotics designer. And our
other speaker is a senior security engineer and security researcher at Spirulant Federal
System. He spends his time working on vehicle systems, UAVs and drones, encryption systems,
IOT devices, medical devices, and semi-autonomous systems. So here to talk on their talk of
medical device ethics and security, ladies and gentlemen, Dr. Stanislav and Vlad Gostromleski.
All right. So we're going to be a little dense here. We have a lot of information to go
through. And if you pay attention, we'll have some questions along the way. Spirulants,
very generous to be giving out some t-shirts for any questions you guys answer. So that's my
profile, Vlad's profile. So brain imaging, very important. I use it quite a bit. And it usually
determines what I'm going to do with the patient in an acute setting. So can anyone tell me what's
going on here? What kind of image this is? What are we looking at on the left compared to the
right? Okay. What's going on on the left side? Why was this important?
Well, actually the bright area is representing a bleed, so this is a patient who came in.
This is obviously a picture taken off Google. I didn't put real pictures from my patients
in. The guy came in, hemiplegic, and our job is, do we need to open him and drain the
blood or do you actually do something to break a clot, which is what a stroke is. So this
gentleman gets a t-shirt here. So this is very, very important. In a stroke, time is
brain. So we need to make a decision quickly. And we can't make a decision too quickly.
have any delays. Unfortunately, this happens. So ransomware creates a lot of problems. Hollywood
Presbyterian paid 17 grand, affected their emergency room for a week, and they had to divert
anything neurologically related to nearby hospitals because they couldn't get CT scans in
time. Then the same thing happened in May of this year in the U.K. I want to cry, got them, and
they were diverting strokes all over the place as a result. And now imaging is being used as
defense for murder. So there's a scan of a patient, or actually someone tried for murder in
92. Gentleman choked his wife, threw her out of a window in Manhattan to try to claim she
committed suicide. He was indicted for murder, second degree, and lucky enough, he had a
headache. He went to the E.D.
from jail, and they found this type of picture. This isn't his actual picture, but this is what
they found. Basically, he had a cyst in his brain. It's been there his entire life, but this is
very convenient for his defense. Now, his defense is saying, well, he's missing part of his brain.
When you show this to a jury, I mean, that's a great defense. So then they further qualified it.
They did something called a PET scan to show that that cystic area doesn't function. They
managed to get him a minimum sentence, and this has been the case that now, this is the case that
almost 5% of all murder charges and cases are trying to use neuroscience as the defense.
Well, from a security side, what if images are spoofed? So I have an example. This happened to me.
I was a doctor for maybe a week at the time. A patient comes in. He's a 34-year-old. I'm asked to
see him because he's having trouble breathing. I'm like, all right, I got this. I read about this.
Maybe I'll do an x-ray. I'll listen to him, and there's just crackles, and this is an image they
give back to me. So I'm thinking, all right, what's going on? Anyone give me an idea of what
they think is happening here? Sorry, go ahead. Yeah, that's exactly what it is. So I'm thinking,
okay, well, he's getting worse and worse. Do I put a needle in him and try to drain the fluid?
I'm looking at the image some more.
I think that's the face I probably had because then I start looking at this down the middle.
So, I mean, you see a spinal cord. You see the lung fields. I mean, you see the liver,
and then you're looking at this fluid, and then I go back to the midline. Did I miss this?
It looks like there's old scars from a cardiac surgery. So this guy had his chest opened and
then sewed back together with metal. How did I miss this on my exam when I'm examining someone
for shortness of breath?
And then I realized they switched images on me. So it was someone else's first week, too,
and they mislabeled it. I mean, if this can happen by mistake, I think it can easily be
switched up in another way as well by someone like him.
So, also, computers are now being used a lot in the courtroom. Just a side note. There was a case
in 2016. A gentleman was being tried, and he was probably selling drugs, and then he evaded police.
He should have had a fairly small sentence from what people were thinking. However, Compass was
developed at that time, and they started using that in Wisconsin to determine what the trial
length is, or sorry, the sentence length should be on these people. And the formula is proprietary.
They won't share the algorithm. And the guy received actually a pretty severe sentence because
the computer told the judge he's got a high risk of violence, high risk of recidivism, and a pre-trial
risk was very high. He tried to argue this multiple times in court, and this has been ruled as
completely constitutional, and they're going to continue doing this.
So, essentially, Compass is a threat assessment system for humans. Just like a vulnerability
assessment report for a network, it takes known data points about your criminal background
history, about your current living situation, and creates a risk score. So instead of failing a
PCI assessment, you essentially fail at getting a lighter sentence.
So, back to medicine. Implantable cardiac devices. Very important. There's a lot of them.
10,000 are implanted every month. They save and extend lives. However, it can also be used as
evidence. There's a recent case, a guy who's charged with arson and insurance fraud. Basically,
he called 911 and said, I grabbed a bunch of stuff, I threw it out the window, and his house is on
fire.
The police thought this was very suspicious. Too many things didn't make sense. There were multiple
points where the fire started. But luckily, he had an implanted device, and these suspicious
circumstances were enough to get everything into court, and they brought a cardiologist in, and
he said, these actions are highly improbable because of his medical condition. So that got them
the warrant to get the data. And they looked at his heart rate, his demand, and how long he'd been
gathering his things prior to calling 911. And that was enough to charge him with arson. And the
charges were just filed in January. Fitness trackers. They're awesome, right? We all use them.
But now they're being also used as evidence in court. So, there's a few good cases. I mean,
they're piling up, really. So, this first one, they basically managed to try this guy for murder,
because he was giving the police a timeline, which didn't make sense to them. They used his email
records and his wife's Fitbit data to basically show that she'd been moving around during a certain
time, when he claimed, actually, she was already dead. So, there's a few more cases that recently
came out, basically being a woman who was charged with a fraud after making up a rape case. And it's
just really cool right now. And this is a case that I think is really cool. And it's really cool. And I think it's
now. That's what people are trying to gather the data for and they're using it as evidence.
So I keep hearing about medical devices and the internet of things coming closer together,
how people can take charge of their own lives and their own medical care at home with all
these really cool new devices. So I decided to start taking a look at some of those devices
and actually see how secure the data is that they're gathering since they are not being used
in court. And how accurate they are and whether or not you can spoof the data. Can they actually
frame somebody for murder or can they fabricate some evidence to exonerate somebody for murder
or for arson. One of the most common devices I decided to get my hands on some blood pressure
devices because that's apparently one of the second most common device that people are buying
for home monitoring. The first one being one of these cool little wearables that track you and
broadcast a Bluetooth beacon. I got my hands on the Omron one because that was actually the one
recommended by many nursing homes and that actually is the model that's purchased by many
nursing homes. It's really cool, it supports log in, supports a large number of users so
somebody can actually log in as a caregiver, as a nurse or somebody can log in as a patient.
They can go in and start taking their own samples. I also bought some Chinesium, one of those
cool little iHealth ones just because there was an Amazon. So that's one of the things I'm
interested in. And I started gathering some data points. The Omron one was giving me fairly
consistent data, meaning the samples were close to each other in numbers. However, the data was
wildly inaccurate. Just how inaccurate? The device actually told me to seek immediate medical
assistance. I actually ended up calling my brother at 3 a.m. going, hey, these are the readings I'm
getting. Should I go to the emergency room? So I had my data points and I started gathering some data
points. I started gathering them. And I had a cutting edge, and they were all looking at me and
it was pretty close. My blood pressure verified manually and it was nowhere near close. I mean, my
blood pressure was not perfect, but it was significantly better than what the device was
telling me. So next up is I called Omron and I said, hey, this device is inaccurate, how can I
calibrate it? And it said, well, it doesn't support calibration but we will send you a new one.
So I was thinking, he's got this Bluetooth interface, let's keep playing with it. It turns out
that you actually can calibrate it and you can calibrate remotely, and it doesn't actually get a lot of
need the Bluetooth association pin to be recalibrated. I was able to recalibrate it from outside
of my house. It's still not giving me correct data, but I can give it more inaccurate values,
which I guess is good. Next, x-ray machines. Dentists absolutely love these things. If you
go into the dentist's office, they could take a look at your mouth, they could identify
cavities, and x-ray machines are now actually digital. The data actually gets pushed to the
central imaging server within an office, and a lot of times the copy is made to the insurance
company. I was trying to figure out how these things work, and it actually turns out that
they're using an x11 server with no authentication, no encryption turned on. They are also
using an FTP server with default credentials as shipped from a manufacturer, and they don't
let you change the authentication. So, oh, yeah, it's a little bit of a challenge, but
what you have to do is intercept the FTP log in since it's clear text, you've got your
credentials, now you can go in and now you can change the images around the location of
yourself, mess with insurance data, create the necessary medical procedures possibly. If
you're wondering how I got my hands on one of these, it was definitely not eBay because
medical devices are illegal to buy and sell without appropriate licenses and FDA licensing, so
we definitely wouldn't do that. Of course, the very first thing I did when I got my hands on the
one of these is try to image the weirdest thing I had, which turns out to be a 4,000 lumen
light. For those of you who haven't seen it, it's one of the largest surefire lights that they
make, and I thought it was kind of cool to take a picture of it. So, what's your favorite search
engine? My favorite search engine is Shodan. What it does is it goes out and it grabs information
from different ports, and then it takes the information from different ports, and then it
puts it on different machines that are accessible to the Internet, and it continuously scans all of
the Internet, all of the ports. My buddy, Dan Tantler, likes looking at OpenX servers, and one
time he shot me a link, and I opened it, and I thought, that's kind of cool. So, this is
actually an fMRI machine that's connected to an OpenX server in Iran at a research institute. So,
if you didn't violate any U.S. laws, this is a machine in Iran. So, this is actually a
foreign, hostile country. I don't even know if the patient was alive or dead or what the subject
of the fMRI was, but we were able to find a large number of fMRI machines connected to the Internet
with OpenX and no authentication. We did not poke around at any of the ones in the United
States, but there was a significant number of them in the United States that were open, according
to Shodan. I decided to start looking at some of the medical devices that are used within the
hospital, because I was seeing the same news stories you were seeing about WannaCry and
ransomware. So, I was curious just how vulnerable things like blood infusion pumps were, heart
rate monitors that were used in the hospitals. It turns out quite a few of them are running Windows.
It's a somewhat slightly locked down version of Windows XP. They're still running XP because of
licensing issues for the medical devices and because of the drivers that exist for the medical
devices. So, I'm not sure.
Again, when you start getting some devices, start playing with them. And if you're seeing the
wireless signal, you're not missing things. It actually is all wireless. If you're not going to
embarrass the company, who's able to get our hands on, so we covered up with our logo. If
you're looking at this picture, you see the FCC ID. So, it's as simple as going to the FCC website,
looking at the FCC filings. And you couldn't pull up all the data, so you have to look at the
data about its quote unquote encryption scheme, radio transmission scheme, and Manchester encoding,
all that good stuff. It used this technology called smart hopping. It touts power metering, which
means that what it's actually trying to do is maintain an electronic medical record. So, if it
doesn't get a confirmation from the base station data was received, it keeps ramping up the
transmit power. And since these are wired devices, it actually went to just a bit over one watt, which is
kind of cool for a device that you're wiring that's touching your body. It's automatic retry, so it'll
keep broadcasting over and over again until it gets confirmation transmission. It does some error
correction. And as I mentioned, it's supposed to be electronic medical record, so it's not supposed
to be spoofable, it's supposed to be accurate record. Does anybody know what the security protocol
that's built into this? It's actually the fact that it's on 1.4 gigahertz and it's not supposed to be
not the same devices in your laptop, so it's secure. That's essentially what the specs
told me. So that was cool. You definitely can't buy 50 of those on eBay.
Apparently I'm not the only one that came to the same conclusion. There actually were
recalls on several of these devices. Not all of them, just some of the earlier ones. So
essentially the manufacturer is playing games and they're acknowledging issues in some of
the older devices and pushed some firmware updates and actually forced a lot of hospitals
to buy the newer version of the same device, which also still does not use any encryption
protocols and still uses 1.4 gigahertz. Some of the references, if you want to go back and
follow up on some of the case studies that we mentioned in this presentation. Any questions?
Actually, we do have questions, so please come up to the mic.
All right, do you want to ask some traffic questions? Are there any questions?
So what would be the highest risk piece of equipment in a hospital if it was hit by ransomware?
What would cause the most disruption for a hospital? What needs to be protected the most?
Well, I mean, from my end, because I take stroke calls all the time, so for me the CAT scan is everything.
Because that's the only thing that can make me come to the conclusion, am I pushing this medication that's going to destroy every clot in the body?
Or do I need to worry about taking the blood that the person's bleeding in their brain out?
So if I push this medication at someone who's bleeding, they're just going to die right away and it's going to be my fault.
So that's the one I focus on and to me is very sensitive.
But I mean, any focal point, depending on every specialty, I think matters.
For a nephrologist, I mean, the dialysis machines, if they're hit and they're all digitally controlled, that's going to be a huge problem.
But you have more time, at least, with that to transport a patient somewhere.
My answer would be to follow the money.
If the financial systems, the transaction systems, the billing systems go down, the hospital will simply not be able to operate.
Doctors will be sent home.
They're not going to be paid.
Patients are not going to be able to be billed.
So even if all the medical devices are functioning, you essentially can bring the hospital down to its knees and make it inoperable.
I took a scenario to the head of a hospital.
I said, what if you got a ransomware thing and said, we're not going to encrypt your patient files.
We know you have a Picker X-ray and a Siemens MRI.
And we know the vulnerabilities on those.
And we'll just kill a patient every other day.
And the guy just put his head down in his hands.
Is that a plausible scenario?
And are those vulnerabilities out there somewhere on the dark web?
So I'm not going to comment about a particular manufacturer that has been really terrible about patching known zero days that have been reported for over five years.
However, I will say it is very feasible.
If you go and show them and you search for particular medical devices by model number and by manufacturer, they are out there.
They are connected.
Typically, the most connected devices I find wide open on the network are actually in research institutions.
But the hospital networks are not bulletproof.
We know there are a number of vulnerabilities that let an attacker from the Internet actually pivot to the internal hospital network.
So if you're talking about medical devices.
If you're talking about a determined skill attacker, yes, that's certainly a feasible scenario.
And would you also agree that they can't afford to replace those machines?
We're never going to have a perfect machine.
There will always be vulnerabilities, right?
And if they're $5 million, they can't replace them.
So what we see at larger hospitals is there's actually multiple machines, not just one machine.
So they could, for example, take one offline, which often happens for service.
A lot of times they'll have a newer machine that's a higher resolution and has a longer wait time.
But they can use an older machine for diagnostic purposes.
And one more little one.
I took it to IBM Security and said, oh, of course there's an answer.
Just air gap it, which is ridiculous, right?
Tell me it's ridiculous.
So air gapping is excellent.
However, what typically happens is somebody may want to look at the data.
For example, the fMRI data from their home.
Or a doctor may, for example, be emailed even the imaging scan instead of having to drive into the hospital.
So that typically doesn't happen.
Years ago, fMRI data was transferred.
It was sent to the CDC just because of the size of the data.
They would write the CD or DVD with a PDF file.
But now it's typically emailed across.
MRI is actually interesting because all it takes is a small hit.
So this happened in my hospital a couple months ago.
They were cleaning the MRI area.
And cleaning service accidentally hit the emergency button on it.
Well, the MRI is always on.
It never turns off.
And it takes you a few days to spin up for it to work again.
So by that one action, we were out for a week.
We couldn't do any scans.
So an attack at that point, I mean, no matter how small or how non-disruptive it is,
it's going to still delay you by a week.
So like earlier you mentioned like a lot of legal cases are using neuroscience as like perhaps a defense.
I was actually wondering like to what extent would perhaps a blood clot in the front of the brain
like get someone off?
Like would it really make them be able to be tried as like a different person
than like when they actually committed the crime?
Or could you just maybe talk about to what extent like the actual blood clot would affect the legal defense?
So in this case, it was a cyst that the gentleman probably had his entire life.
And what they used that, they used that to get him off in the fact that he was not sane enough.
To be there or healthy enough to be on trial.
And they were saying this medical disability is what made him not be able to function at a normal level like anyone else.
So his actions, he wasn't responsible for.
If it was something transient like you're describing, I don't know of any cases that's happened yet.
But that would certainly be a plausible scenario for someone to have this transient state, commit an action,
and then say that was the reason why it happened.
You just have to prove that that happened during the time that there was a clot or something of that nature.
So what we've seen in cases where somebody had a tumor,
they were able to successfully argue diminished capacity.
So even though the tumor was removed, they were still confined to a psychiatric institution
until such time as the state of New York was able to be comfortable
that they were no longer a danger to themselves or others.
So people aren't completely let go.
They're still typically institutionalized.
But they're either tried for, tried as diminished capacity,
or held in psychiatric institutions.
There have been cases where intoxication, people have used that as a defense.
And the way I understand the law right now is if you chose to take the substance,
you are liable for any actions you take on the substance.
If this is slipped to you, then it's a different story.
There was also a case a few years ago.
There's a gentleman who had a sleep behavior disorder.
He was sleepwalking.
And he murdered his wife.
Got in his car, drove to his ex-wife's house, and killed her.
And I think he actually used that as a successful defense, if I remember right.
So in that case, he actually had a documented history of sleeping disorder.
He had history of sleepwalking that was documented.
He had sleep studies.
So this wasn't something that they sprang up as a defense last second.
He actually had the medical history to back up those claims in advance of the act.
Yes.
So when hospitals buy medical devices, do they have many choices on which vendor to use?
And is security ever a factor in those choices?
So in the past, it hasn't.
What you're seeing hospitals doing increasingly is actually performing penetration tests
and performing assessments, even though vendors expressly forbid them.
And they're using the results of those penetration tests for their buying choices
and in contract negotiations.
So we're seeing that increasingly, and I hope that trend does continue.
Because as we find in some cases when we do penetration tests,
when hospitals look at their agreements,
it's expressly forbidden for them to perform independent penetration tests on the hardware.
They don't own it.
They simply license it, even though they paid for it.
Thanks.
So like those medical devices that are not on the Internet, just on the Internet network, right,
do you often find them that they are segregated from the main corporate network,
like user LAN, or are they just there for everyone to access?
So a few good points.
Even in cases where they are separated, it's not actually a separate physical network.
It's simply VLAN, and we know VLAN hopping can easily be accomplished.
Also, internal network can often be connected to from the outside,
whether it's by wireless vulnerabilities
or by improper configuration of their AD servers
and improper configuration of their VPN servers.
Some of their financial systems, they have to be dual-homed.
They're actually connected to the Internet.
And so, for example, if you can remotely connect to them,
do you find that you can completely compromise that device and perform all the operations,
or is there usually a manual set, manual part to it?
From what we've seen, I couldn't even really call it a compromise,
because what you're doing is downloading configuration software
for the machines, downloading firmware, and simply pushing it.
Those devices implicitly trust the configuration software.
They don't require any sort of authentication.
So as long as they're getting the configuration packets coming in over TFTP,
they're happy to comply.
Okay. Thank you.
Thank you both so much.