1
00:00:00,000 --> 00:00:01,740
Good afternoon. Everybody hear me all right?

2
00:00:02,580 --> 00:00:03,500
Okay, great.

3
00:00:05,060 --> 00:00:06,300
Thanks, Harry, for the introduction.

4
00:00:07,060 --> 00:00:09,300
I've been doing hacking for a while.

5
00:00:09,540 --> 00:00:11,400
The past three years I've been working for Metatology Services

6
00:00:11,400 --> 00:00:13,340
and focused strictly on health care.

7
00:00:13,680 --> 00:00:17,440
I've done about 50 different hacking engagements

8
00:00:17,440 --> 00:00:19,680
for medium to large health care providers,

9
00:00:19,720 --> 00:00:20,760
so that's what I'm going to focus on today

10
00:00:20,760 --> 00:00:23,140
and really talk about the different themes that I'm seeing

11
00:00:23,680 --> 00:00:26,600
as a health care hacker and the weaknesses in health care.

12
00:00:27,840 --> 00:00:30,940
To overview, health care providers are really struggling

13
00:00:30,940 --> 00:00:32,400
with the basic foundational security.

14
00:00:32,640 --> 00:00:34,360
I'm going to get into a lot of these things in this talk.

15
00:00:35,080 --> 00:00:37,080
I used to do hacking in other industries,

16
00:00:37,140 --> 00:00:39,280
and when I came back and started doing hacking again

17
00:00:39,280 --> 00:00:43,220
and came into health care, it was really like 10 years ago

18
00:00:43,220 --> 00:00:47,060
in some aspects, just kind of seeing a lot of really weak security

19
00:00:47,600 --> 00:00:51,020
out there and just some of the technology that was out there 10 years ago.

20
00:00:51,860 --> 00:00:53,460
There is some closing those gaps.

21
00:00:53,680 --> 00:00:56,440
A few are mature. They have mature programs.

22
00:00:57,080 --> 00:00:59,020
But you have to also think about health care environment.

23
00:00:59,340 --> 00:01:01,460
In health care, they're serving patients.

24
00:01:01,700 --> 00:01:03,140
People can walk into the facilities.

25
00:01:03,640 --> 00:01:06,260
There's all types of devices everywhere, computers everywhere,

26
00:01:06,580 --> 00:01:07,620
so it's kind of an open door.

27
00:01:07,700 --> 00:01:10,280
It's not like a financial institution where you keep the employees,

28
00:01:10,340 --> 00:01:12,220
keep everything inside, keep everything behind doors

29
00:01:12,220 --> 00:01:13,340
and build that perimeter up.

30
00:01:13,820 --> 00:01:17,160
So you have that as well as just a lot of different devices

31
00:01:17,160 --> 00:01:18,440
that are being connected to the network.

32
00:01:18,540 --> 00:01:20,520
All these medical devices now are getting IP addresses,

33
00:01:20,560 --> 00:01:22,540
getting connected within there.

34
00:01:22,700 --> 00:01:26,000
In the culture overall, security has always been an afterthought

35
00:01:26,000 --> 00:01:26,580
in health care.

36
00:01:26,600 --> 00:01:30,220
And that mentality is starting to shift, especially with all these breaches

37
00:01:30,220 --> 00:01:31,460
and ransomwares that are happening.

38
00:01:33,020 --> 00:01:35,340
But I'll get into that in this talk here.

39
00:01:36,160 --> 00:01:38,260
So real quick, just why is health care a target?

40
00:01:38,580 --> 00:01:41,080
Obviously, a lot of different data points that are out there,

41
00:01:41,160 --> 00:01:44,320
electric medical records, financial data.

42
00:01:44,940 --> 00:01:47,420
You know, this data is just being hoarded kind of in hospitals,

43
00:01:47,580 --> 00:01:50,040
especially the health care information.

44
00:01:50,720 --> 00:01:56,120
And with that information, you can do a lot of types of stuff with it, right?

45
00:01:56,180 --> 00:01:56,580
So you can do a lot of things.

46
00:01:56,580 --> 00:02:00,280
You can do insurance fraud, prescription fraud, blackmail, ransomware,

47
00:02:00,780 --> 00:02:02,340
just steal the data and sell it.

48
00:02:02,540 --> 00:02:03,740
So a lot of different things.

49
00:02:03,900 --> 00:02:05,480
And as well as just as a higher impact.

50
00:02:05,720 --> 00:02:07,300
You know, we're dealing with people's lives here,

51
00:02:07,600 --> 00:02:10,900
the privacy of their information, but as well as, you know,

52
00:02:10,900 --> 00:02:12,380
being hooked up to different medical devices,

53
00:02:12,460 --> 00:02:14,860
being for the hospital system to be able to serve the patient

54
00:02:15,460 --> 00:02:17,000
and give them correct care.

55
00:02:18,680 --> 00:02:19,720
Easy fish and sea.

56
00:02:19,900 --> 00:02:23,060
And like I said, I'm going to talk a lot about those security weaknesses in this talk.

57
00:02:25,680 --> 00:02:27,020
A few screenshots here.

58
00:02:27,040 --> 00:02:28,340
I have a lot of screenshots throughout here,

59
00:02:28,400 --> 00:02:30,080
and I'm going to try to pepper in some of my kind of stories.

60
00:02:31,700 --> 00:02:34,360
The first one here on top here is just an EHR system.

61
00:02:34,540 --> 00:02:36,580
The second one is a point of sale system in a cafeteria.

62
00:02:37,000 --> 00:02:41,480
I always like to hop on that before I get lunch, make sure I can get something.

63
00:02:41,940 --> 00:02:45,920
So we're just doing that and then grabbing some keystroke log in on that system there,

64
00:02:46,060 --> 00:02:47,600
just some of the screenshots showing.

65
00:02:48,500 --> 00:02:52,780
So health care is a target, 30% more likely than financial industry.

66
00:02:53,640 --> 00:02:58,620
2017 alone, the most amount of reportable breaches have been in health care.

67
00:02:58,800 --> 00:03:00,740
We're seeing that uptake every year.

68
00:03:01,400 --> 00:03:05,300
Just listing some of the big breaches that have happened in the past couple of years here.

69
00:03:06,420 --> 00:03:10,300
And all these screenshots I have in here are actually from health care engagements.

70
00:03:10,360 --> 00:03:12,900
I've redacted them so there's no sensitive information,

71
00:03:13,200 --> 00:03:15,640
but these are a lot of different screenshots that we've taken,

72
00:03:15,640 --> 00:03:18,820
getting into different devices and systems within health care environments.

73
00:03:20,320 --> 00:03:22,240
So health care key industry weaknesses.

74
00:03:23,060 --> 00:03:24,620
I'm going to talk about these different topics today.

75
00:03:25,120 --> 00:03:29,080
Some are near and dear to my heart, so I'll probably spend a little more time on them

76
00:03:29,080 --> 00:03:30,260
and skim through a few others.

77
00:03:32,900 --> 00:03:34,820
First thing here is unpatched and outdated systems.

78
00:03:35,660 --> 00:03:40,820
Health care, it's interesting, like we're out there,

79
00:03:40,880 --> 00:03:43,740
you actually see a lot of old systems still sitting on the network.

80
00:03:44,920 --> 00:03:48,120
It's an example of Windows 2000 servers, always a handful of those.

81
00:03:48,340 --> 00:03:52,460
I've seen everything from Windows NT to one client having Windows 98

82
00:03:52,460 --> 00:03:53,040
still out there.

83
00:03:53,060 --> 00:03:57,540
I mean, it's crazy in this day and age to see some of that that's out there.

84
00:03:58,060 --> 00:04:01,860
You know, what's happening a lot is there's a lot of just different systems out there,

85
00:04:01,900 --> 00:04:03,240
and a lot of times these are vendor systems,

86
00:04:03,480 --> 00:04:06,560
so they're not being managed by the security of IT.

87
00:04:06,720 --> 00:04:09,520
They're unaware of them, and they're sitting out in some corner somewhere,

88
00:04:09,780 --> 00:04:12,820
and they're just, you know, never been updated, never been patched.

89
00:04:14,400 --> 00:04:16,640
So these are just showing up top a couple exploits.

90
00:04:16,980 --> 00:04:22,980
The top one is just a common Microsoft exploit, MS-0867, if you're familiar with that.

91
00:04:23,060 --> 00:04:25,340
We usually find a few of those that are out there, right?

92
00:04:25,420 --> 00:04:30,560
It's just a JBoss vulnerability that we use to exploit those, get local admin,

93
00:04:31,620 --> 00:04:34,760
then dump the passwords in memory and escalate that from there,

94
00:04:34,880 --> 00:04:37,520
and usually pretty quickly we got domain admin to the network.

95
00:04:38,760 --> 00:04:42,700
Bottom right-hand corner is just what we do with some of the proof of concepts

96
00:04:42,700 --> 00:04:46,480
of once we get access, is taking some webcam pictures

97
00:04:46,480 --> 00:04:49,580
of some of the different workstations that are out there.

98
00:04:49,780 --> 00:04:52,820
So in health care, there's these things called workstations on wheels, right?

99
00:04:53,060 --> 00:04:55,720
And so they're used around the clinicians are moving around,

100
00:04:56,260 --> 00:04:58,840
bringing them into exam rooms. They got webcams on them.

101
00:04:59,080 --> 00:05:03,540
We pop on those. I mean, we've been able to take pictures of nurses in exam rooms

102
00:05:03,540 --> 00:05:06,660
examining somebody and monitoring them while they're getting exams.

103
00:05:06,900 --> 00:05:11,000
So you really talk about some serious privacy issues that are happening with this,

104
00:05:11,060 --> 00:05:14,200
you know, as you get hacked and just some of the stuff that somebody could actually do,

105
00:05:14,960 --> 00:05:16,820
you know, with getting that type of data.

106
00:05:20,120 --> 00:05:22,660
Insufficient user awareness. So when I think about this, you know,

107
00:05:22,660 --> 00:05:27,580
primarily speaking about social engineering, phishing, and some bad security practices

108
00:05:27,580 --> 00:05:30,500
that are happening from phishing, from our phishing assessments,

109
00:05:30,760 --> 00:05:34,060
what we've seen here, and if you see in here in the left-hand corner,

110
00:05:34,200 --> 00:05:37,540
just kind of a tally of people who fell for the different phish that we sent.

111
00:05:37,900 --> 00:05:41,580
So 27 people posted their credentials in this phishing campaign that we launched,

112
00:05:41,640 --> 00:05:43,700
just a sample of employees in the environment.

113
00:05:43,980 --> 00:05:47,960
And the red line there is the all industries average, and you see the blue.

114
00:05:48,240 --> 00:05:52,160
That is, you know, kind of where they're at, and that's typical in health care.

115
00:05:52,160 --> 00:05:58,060
We're seeing at least double, if not more, of individuals falling for phishing

116
00:05:58,440 --> 00:06:00,580
when we send them different phishing campaigns.

117
00:06:01,520 --> 00:06:04,600
Social engineering. This social engineering is really interesting in health care.

118
00:06:05,260 --> 00:06:08,240
You know, we've come up with a lot of different scenarios that work a lot.

119
00:06:09,020 --> 00:06:11,920
One is posing as a doctor. So we'll call the IT help desk.

120
00:06:12,140 --> 00:06:15,160
You know, hey, I'm Dr. Such and Such. I've got a patient in the room right now.

121
00:06:15,220 --> 00:06:17,880
I need to get into my system. I don't know what the heck my password is.

122
00:06:17,900 --> 00:06:21,360
Can you reset it? And we use that authority, and when we're using that authority

123
00:06:22,160 --> 00:06:25,280
to be aggressive with the help desk person, they'll bypass any type of verification.

124
00:06:25,660 --> 00:06:30,000
Even if they do, you know, we've been able to work around that and give them some story

125
00:06:30,000 --> 00:06:33,540
and get them, you know, they'll usually start shaking a little bit, and they'll get nervous

126
00:06:34,040 --> 00:06:36,300
just because, you know, they're talking to a doctor.

127
00:06:36,400 --> 00:06:40,740
We have this projection of authority on the doctors, so they want to give up and give that information.

128
00:06:40,960 --> 00:06:43,560
And they also don't want to cause any types of problems or get in trouble.

129
00:06:44,040 --> 00:06:46,920
So we take advantage of a lot of that when we're doing this with health care.

130
00:06:47,440 --> 00:06:51,200
Other things is, you know, calling employees, impersonating different IT folks.

131
00:06:52,160 --> 00:06:55,620
You know, I have a little bit of background in psychology, which is interesting.

132
00:06:55,720 --> 00:06:58,140
You know, like social engineering for me is always about gaining trust.

133
00:06:58,220 --> 00:07:00,700
It's about building a relationship with somebody and establishing trust.

134
00:07:01,000 --> 00:07:04,640
So we'll do some research on the person that we're targeting, gather that information,

135
00:07:05,000 --> 00:07:08,000
and start giving them that information and build a connection with that person

136
00:07:08,000 --> 00:07:10,200
and also let them know we have some information on them.

137
00:07:10,260 --> 00:07:12,540
And, you know, as we're doing that, we're building trust.

138
00:07:12,820 --> 00:07:17,820
We tell them this is their password, and, you know, it's a fake password that we're giving them.

139
00:07:17,920 --> 00:07:20,500
And then they'll usually respond and say, hey, that's the wrong password.

140
00:07:20,500 --> 00:07:23,880
Oh, can we get you updated? That's what the problem is.

141
00:07:24,080 --> 00:07:28,360
You know, we usually make a whole IT thing out of it, and they're usually okay with that.

142
00:07:28,460 --> 00:07:30,340
Or we'll talk them through it. Okay, we know it's security.

143
00:07:30,700 --> 00:07:33,740
You know, 15 minutes later, can you just do this and change your password?

144
00:07:34,060 --> 00:07:35,460
And they're usually comfortable with that.

145
00:07:35,480 --> 00:07:39,500
You know, in that 15 minutes' time, we can use that password, get on, and gain access to the network.

146
00:07:40,380 --> 00:07:44,760
Another big thing we see is just kind of a lot of scripts out there, IT keeping scripts out there

147
00:07:45,160 --> 00:07:46,560
with different passwords in it.

148
00:07:46,900 --> 00:07:48,160
Active Directory is a big one.

149
00:07:48,260 --> 00:07:50,440
Once we get a user account on the network,

150
00:07:50,500 --> 00:07:53,120
we'll go into Active Directory, pull what's in the description fields,

151
00:07:53,260 --> 00:07:58,360
and we have read-only access with any user usually typically in an environment for Active Directory.

152
00:07:59,080 --> 00:08:01,900
And there's usually a bunch of different passwords sitting in the description field.

153
00:08:01,980 --> 00:08:03,580
We found domain, admin, service accounts.

154
00:08:04,280 --> 00:08:09,800
You know, it's really simple stuff, really basic stuff that we'd see out there.

155
00:08:10,400 --> 00:08:13,360
So this is like the biggest pet peeve of mine is password management.

156
00:08:14,940 --> 00:08:19,020
You know, every year I read these different, like, breach reports, Pokemon, Verizon,

157
00:08:19,020 --> 00:08:22,440
these different surveys that are going out to the healthcare community

158
00:08:23,000 --> 00:08:27,180
and the healthcare security professionals that are out there, the CIO, the CSSO.

159
00:08:28,460 --> 00:08:32,520
And what, like, I'm seeing is, you know, always on the bottom of their concerns is passwords.

160
00:08:35,180 --> 00:08:39,000
You know, it's not really making, like, they're not really that concerned about it,

161
00:08:39,060 --> 00:08:42,900
which for me, as a hacker, I'm like, there's really bad passwords out there.

162
00:08:43,060 --> 00:08:46,820
And you see on the right-hand corner, you'll see, you know, we usually grab the AD database,

163
00:08:47,480 --> 00:08:49,000
do some analysis on their passwords.

164
00:08:49,000 --> 00:08:52,400
This is an actual healthcare provider, a large provider.

165
00:08:53,080 --> 00:08:56,500
You know, 6,476 accounts with password 1.

166
00:08:56,680 --> 00:08:58,500
You know, ABT123.

167
00:08:58,640 --> 00:09:00,620
I mean, really, really bad passwords.

168
00:09:00,760 --> 00:09:02,340
You know, you see that worst password let's get.

169
00:09:02,880 --> 00:09:05,160
This is where you're seeing it, like, and it's here.

170
00:09:05,480 --> 00:09:10,480
And this is in, you know, protecting our sensitive healthcare information and our medical devices,

171
00:09:10,500 --> 00:09:13,920
everything that's out there on this network, which is just crazy to me.

172
00:09:14,060 --> 00:09:16,240
And, you know, single-factor authentication,

173
00:09:16,800 --> 00:09:18,860
the majority of our healthcare providers,

174
00:09:19,000 --> 00:09:20,440
are still using single-factor authentication.

175
00:09:20,880 --> 00:09:22,880
Most of them haven't moved to multi-factor authentication.

176
00:09:23,900 --> 00:09:27,440
You know, with combinations of these weak passwords and that,

177
00:09:27,600 --> 00:09:30,860
and Outlook Web Access as well as being single-factor authentication,

178
00:09:31,520 --> 00:09:36,860
we've been successfully been able to get domain administrator from the internet 80 to 90% of the time.

179
00:09:37,880 --> 00:09:39,300
And that's a scary statistic.

180
00:09:39,740 --> 00:09:42,340
You know, and we're under a strict budget with this.

181
00:09:42,380 --> 00:09:43,700
I'm doing this testing in a week or two.

182
00:09:43,840 --> 00:09:48,380
I mean, you know, real bad guys don't got those restraints that I have to put on myself,

183
00:09:48,560 --> 00:09:48,980
to be able to do this.

184
00:09:48,980 --> 00:09:50,300
So, we're going to be under contract to do this work.

185
00:09:52,060 --> 00:09:53,380
Did some other weaknesses here.

186
00:09:53,500 --> 00:09:55,820
Land man hashing, we still see quite a bit of that stuff.

187
00:09:56,000 --> 00:09:56,780
Very easy to crack.

188
00:09:58,640 --> 00:10:01,540
So, yeah, it's just a huge pet peeve of mine is password management.

189
00:10:02,280 --> 00:10:04,260
Default counts and passwords, another big thing.

190
00:10:04,640 --> 00:10:07,600
You know, a lot of those GE type of accounts that are out there,

191
00:10:08,140 --> 00:10:10,220
we see those connected to AD.

192
00:10:11,020 --> 00:10:13,440
Majority of the time, they're sitting there, default password.

193
00:10:14,060 --> 00:10:16,620
They allow their whole AD database through the VPN.

194
00:10:17,100 --> 00:10:18,700
We gain access through that.

195
00:10:18,980 --> 00:10:21,480
And usually there's some servers or some other systems on there

196
00:10:21,480 --> 00:10:24,720
that those accounts actually have local admin privileges on.

197
00:10:24,880 --> 00:10:28,140
So, get access to that and pretty easily you can escalate up.

198
00:10:29,580 --> 00:10:33,460
Other default stuff, SQL databases, still see quite a bit of that out there.

199
00:10:33,500 --> 00:10:34,940
SQL databases sitting out there.

200
00:10:35,400 --> 00:10:38,800
That's pretty easy to gain access to and pop a shell on.

201
00:10:40,080 --> 00:10:45,720
Apache, that's easy to load up a command.asp and get a shell on that as well.

202
00:10:46,740 --> 00:10:47,480
Password hints.

203
00:10:47,480 --> 00:10:49,900
This is another interesting thing you see sometimes.

204
00:10:50,200 --> 00:10:54,640
I had a recent client, they had their password self-service out there

205
00:10:54,640 --> 00:10:57,280
and they're using security questions.

206
00:10:57,840 --> 00:10:59,800
So, I started looking at these security questions.

207
00:11:00,080 --> 00:11:04,500
The security questions, I think they were using six and you had to get three correct.

208
00:11:05,120 --> 00:11:07,220
But the security questions, some of them were hard.

209
00:11:07,320 --> 00:11:09,180
Like, you know, who's your second grade teacher?

210
00:11:09,320 --> 00:11:11,340
That would take quite a bit of research for me to do.

211
00:11:11,720 --> 00:11:13,080
But some of them were pretty easy.

212
00:11:13,140 --> 00:11:15,040
Like, where did I go to elementary school?

213
00:11:15,180 --> 00:11:16,980
Where did I meet my husband?

214
00:11:16,980 --> 00:11:19,660
You know, what town was I born in?

215
00:11:20,020 --> 00:11:23,300
You know, 10, 15 minutes I can do some public profiling on the internet

216
00:11:23,300 --> 00:11:25,680
and find out all that information or at least close to it

217
00:11:25,680 --> 00:11:27,960
or at least a few cities or something, you know, that's there.

218
00:11:28,240 --> 00:11:30,360
So, sit there, plug away those security questions.

219
00:11:31,040 --> 00:11:32,400
I can reset the password.

220
00:11:32,520 --> 00:11:35,660
They're not sending the reset back to an SMS or anything like that.

221
00:11:35,900 --> 00:11:36,720
I get it right.

222
00:11:36,820 --> 00:11:39,540
I can change it right there on the fly, get into the network.

223
00:11:40,380 --> 00:11:41,600
So, a lot of different things.

224
00:11:41,700 --> 00:11:46,640
This one actually here is for a point of sale system that I got access to.

225
00:11:46,640 --> 00:11:49,180
And they had a password hint thing going on.

226
00:11:49,280 --> 00:11:50,220
And what was your favorite color?

227
00:11:50,240 --> 00:11:51,160
My favorite color is blue.

228
00:11:51,280 --> 00:11:52,520
That was the right answer.

229
00:11:56,100 --> 00:11:58,220
Another big area is just medical device security.

230
00:11:59,060 --> 00:12:01,300
And I think there's some other talks and stuff on there

231
00:12:01,300 --> 00:12:05,200
and some stuff on the internet of things that you guys can do some hacking, I heard,

232
00:12:05,660 --> 00:12:07,300
on those really cool stuff.

233
00:12:07,740 --> 00:12:09,760
You know, from my perspective, a lot of times we're going after these

234
00:12:09,760 --> 00:12:14,500
after we get access to the network and going after the ones that are connected to the network.

235
00:12:15,260 --> 00:12:16,620
They're just crazy.

236
00:12:16,620 --> 00:12:18,700
You actually see a picture here.

237
00:12:18,820 --> 00:12:19,560
This is kind of funny.

238
00:12:19,660 --> 00:12:24,960
We were doing a physical security review of some medical devices in a provider.

239
00:12:25,400 --> 00:12:28,540
We actually found a cockroach sitting in, I think this is an insulin pump,

240
00:12:29,660 --> 00:12:30,740
that was sitting in there.

241
00:12:30,840 --> 00:12:32,540
So, they actually do have bugs, real ones.

242
00:12:35,520 --> 00:12:39,680
Default passwords, missing patches, configurations, no AV, remote access, you name it.

243
00:12:39,800 --> 00:12:45,040
You can get VNC access, SSH access, Telnet access, a lot of different access.

244
00:12:45,460 --> 00:12:49,520
Vendor oversight, that's like the main reason behind somebody getting some of these root causes at the end,

245
00:12:49,540 --> 00:12:50,800
if I got some time for these.

246
00:12:51,360 --> 00:12:54,240
But a lot of times what happens is, you know, the vendors come in,

247
00:12:54,280 --> 00:12:58,160
they put these medical devices in, or biomed, or clinical engineering, whatever it's called,

248
00:12:58,260 --> 00:13:00,580
in the facility, sitting there hooking these up.

249
00:13:01,440 --> 00:13:03,160
Either security doesn't know about them,

250
00:13:03,220 --> 00:13:08,420
or security believes that the vendor is taking care of the security of them.

251
00:13:08,820 --> 00:13:11,400
So, there's kind of this finger pointing, like, well, I thought you were doing it.

252
00:13:11,580 --> 00:13:13,100
You know, no, I thought you were doing it.

253
00:13:13,160 --> 00:13:14,100
And, you know, it's been five years.

254
00:13:14,100 --> 00:13:15,440
These things have been connected to the network.

255
00:13:16,000 --> 00:13:21,080
There's a lot of also issues just about the medical devices in general of, you know,

256
00:13:21,120 --> 00:13:23,180
can they actually be updated?

257
00:13:23,340 --> 00:13:24,140
Can they be patched?

258
00:13:24,200 --> 00:13:25,160
Can they run an antivirus?

259
00:13:25,700 --> 00:13:29,380
There's just a lot of different concerns around it, and it really depends on the manufacturer

260
00:13:30,260 --> 00:13:31,700
and also how they're connected.

261
00:13:32,400 --> 00:13:35,020
You know, a lot of environments, we don't see them segmented out.

262
00:13:35,220 --> 00:13:39,040
You know, we have different ways that we do and talk about, you know, medical device

263
00:13:39,040 --> 00:13:43,300
and building a whole security program out there and building separate networks for those ones

264
00:13:43,300 --> 00:13:46,740
that really we can't secure too well and trying to lock that down that way.

265
00:13:47,740 --> 00:13:53,060
Some of the ones that have done that have been fairly successful,

266
00:13:53,820 --> 00:13:56,520
but a lot of times we just see them connected right out on the whole network,

267
00:13:56,620 --> 00:14:00,160
and there's really not a whole lot of asset inventory right now of, you know,

268
00:14:00,200 --> 00:14:02,420
we're knowing what's actually out there that's connected.

269
00:14:04,380 --> 00:14:09,800
So, one big thing that we do see a lot, probably I'd say about 15% to 20% of the time,

270
00:14:09,820 --> 00:14:11,520
we still see wet networks out there.

271
00:14:11,640 --> 00:14:13,280
And these are usually the medical devices.

272
00:14:13,300 --> 00:14:16,560
There's a lot of device equipment that's connected to this because they can't run WPA.

273
00:14:17,760 --> 00:14:19,740
So, it's really, really interesting.

274
00:14:20,220 --> 00:14:23,640
Like, I was, like, the first time I saw a WEP out there, I was like, really?

275
00:14:24,020 --> 00:14:25,340
I was like, that's nuts.

276
00:14:25,620 --> 00:14:28,860
I was like, this day and age, WEP is still being used out there.

277
00:14:29,380 --> 00:14:33,160
So, kind of this picture down here, went around with one of our smartphones and antenna,

278
00:14:34,100 --> 00:14:37,120
cracked some WEP pretty quickly, got on the network.

279
00:14:37,480 --> 00:14:40,040
That network was directly connected to the internal network,

280
00:14:40,240 --> 00:14:42,940
a whole other entry point right into the network.

281
00:14:43,740 --> 00:14:44,480
From there.

282
00:14:45,620 --> 00:14:49,860
Just some of the other screenshots here are just some devices that we've gotten onto.

283
00:14:50,220 --> 00:14:53,760
Some, I think, one's like a breath monitoring or something, respiration.

284
00:14:54,140 --> 00:14:57,620
Other one's monitoring, looks like heart rate and just basic vitals.

285
00:14:58,300 --> 00:15:01,360
But always cool getting on those type of devices that are out there.

286
00:15:02,400 --> 00:15:04,880
Ooh, got a thing popping up here.

287
00:15:06,780 --> 00:15:08,460
Lack of oversight into vendor security.

288
00:15:08,860 --> 00:15:10,200
I already talked a little bit about this.

289
00:15:10,540 --> 00:15:12,680
I'll tell a little more of a story about this here.

290
00:15:13,300 --> 00:15:16,040
So, this screenshot here is actually a patient sleeping.

291
00:15:16,400 --> 00:15:21,300
So, a lot of healthcare providers have a sleep center for people who are experiencing insomnia,

292
00:15:21,420 --> 00:15:22,880
having a really difficult time sleeping.

293
00:15:22,980 --> 00:15:27,420
So, they go and stay over a couple nights over at the sleep center.

294
00:15:27,600 --> 00:15:29,640
And there are video cameras and everything else.

295
00:15:29,800 --> 00:15:32,300
And there's some live streaming of them sleeping.

296
00:15:32,440 --> 00:15:36,460
So, we hacked into these sleep systems that were connected to the network.

297
00:15:37,160 --> 00:15:40,180
And just really, really bad security.

298
00:15:40,440 --> 00:15:42,080
The password for a miniature was password.

299
00:15:42,080 --> 00:15:45,020
We actually tracked down the server in the sleep center.

300
00:15:45,220 --> 00:15:46,740
And we found a closet.

301
00:15:46,860 --> 00:15:47,900
It's a regular closet.

302
00:15:48,360 --> 00:15:49,540
No lock on it.

303
00:15:49,620 --> 00:15:52,160
The server is sitting on this makeshift desk.

304
00:15:52,560 --> 00:15:55,480
And then the password is written on a little postie right next to it.

305
00:15:56,220 --> 00:15:57,760
So, it's really interesting.

306
00:15:58,180 --> 00:16:04,140
Another client that I had recently, they had a pharmacy dosing network.

307
00:16:04,220 --> 00:16:07,180
One of the vendors came in and put this whole network in.

308
00:16:07,300 --> 00:16:08,480
It had a domain controller.

309
00:16:08,720 --> 00:16:11,780
It had about, I don't know, 50 different systems connected to it.

310
00:16:12,820 --> 00:16:13,440
Domain controller.

311
00:16:14,180 --> 00:16:14,900
No patching.

312
00:16:15,720 --> 00:16:17,840
It had JBoss vulnerability.

313
00:16:18,720 --> 00:16:19,500
We got on it.

314
00:16:19,500 --> 00:16:21,060
We started looking at some of the passwords around it.

315
00:16:21,160 --> 00:16:23,300
The passwords were pretty all the same.

316
00:16:23,360 --> 00:16:24,340
The same as the username.

317
00:16:24,780 --> 00:16:25,760
Three characters long.

318
00:16:27,060 --> 00:16:28,420
Just really horrendous.

319
00:16:28,540 --> 00:16:29,840
You know, very easy to get on there.

320
00:16:29,920 --> 00:16:31,740
We talked to the security officer about it.

321
00:16:32,360 --> 00:16:34,020
You know, he was kind of unaware of it.

322
00:16:34,240 --> 00:16:36,200
Some of the IT guys didn't know about it.

323
00:16:36,260 --> 00:16:39,400
But, you know, like I said, there's just a lot of stuff that's just getting out there.

324
00:16:39,540 --> 00:16:40,780
And healthcare is just so complex.

325
00:16:40,780 --> 00:16:43,500
And there's just, everybody's kind of sticking stuff on the network.

326
00:16:43,760 --> 00:16:44,820
That's just the way it's been.

327
00:16:45,640 --> 00:16:47,620
And there's just this stuff that's sitting out there.

328
00:16:47,740 --> 00:16:51,820
And until they actually do some real testing and having somebody kind of go out there and find this stuff

329
00:16:51,820 --> 00:16:55,220
and identify it on the network, unless they're doing it internally,

330
00:16:56,160 --> 00:16:57,340
you know, they just have no idea.

331
00:17:00,860 --> 00:17:01,660
Physical security.

332
00:17:02,020 --> 00:17:05,260
Like I said, hospital doors are open.

333
00:17:06,940 --> 00:17:09,820
So, pretty easy to walk in, get on the clinical floors.

334
00:17:10,780 --> 00:17:11,920
Some of the screenshots here.

335
00:17:12,360 --> 00:17:15,140
This, I think, was in a doctor's lounge on one of the clinical floors.

336
00:17:15,880 --> 00:17:20,560
We often find workstations sitting in, you know, doctor's lounges, conference rooms,

337
00:17:20,680 --> 00:17:25,540
the type of stuff that's just kind of open that, you know, you're not supposed to kind of walk into, but is open.

338
00:17:26,600 --> 00:17:27,900
I don't know what's going on with that.

339
00:17:29,460 --> 00:17:30,060
Is that me?

340
00:17:31,680 --> 00:17:32,620
Yeah. Yeah.

341
00:17:33,440 --> 00:17:34,240
Okay. Sorry.

342
00:17:37,860 --> 00:17:38,680
There I am.

343
00:17:39,960 --> 00:17:42,520
So, this particular workstation, we got in there.

344
00:17:42,600 --> 00:17:43,280
We're hanging out there.

345
00:17:43,280 --> 00:17:44,260
There's a couple of doctors in there.

346
00:17:44,360 --> 00:17:46,560
They were kind of cool with us hanging out in there.

347
00:17:46,700 --> 00:17:47,240
We asked them.

348
00:17:47,340 --> 00:17:47,820
They were nice.

349
00:17:49,840 --> 00:17:51,780
The workstation was automatically logged in.

350
00:17:51,900 --> 00:17:53,060
And there was also a case.

351
00:17:53,100 --> 00:17:53,580
It wasn't.

352
00:17:53,600 --> 00:17:57,160
There was a little posty next to it that did tell you the username and password for it.

353
00:17:57,680 --> 00:18:00,060
So, we find that stuff quite a bit.

354
00:18:00,540 --> 00:18:03,820
Another thing on the far right here, that's actually me.

355
00:18:03,960 --> 00:18:05,020
I covered myself up.

356
00:18:05,920 --> 00:18:08,460
But that's just hanging out kind of in a clinician's room.

357
00:18:08,680 --> 00:18:10,120
You'll see one of those workstations on wheels.

358
00:18:10,440 --> 00:18:12,380
That was a really interesting client.

359
00:18:12,560 --> 00:18:15,160
We actually did get caught doing the physical security.

360
00:18:15,280 --> 00:18:16,480
But we did get really, really aggressive.

361
00:18:16,840 --> 00:18:17,920
And we were kind of loopy.

362
00:18:17,920 --> 00:18:19,520
I think it was like 12, 1 o'clock in the morning.

363
00:18:19,600 --> 00:18:22,320
And we're like hanging out in this hospital and sneaking around.

364
00:18:23,400 --> 00:18:28,180
So, like one thing we got into, there was where people go and make payments.

365
00:18:28,540 --> 00:18:29,480
And it was like the cash counter.

366
00:18:29,820 --> 00:18:32,040
It had a counter like top like this high or something.

367
00:18:32,680 --> 00:18:33,700
We hopped over that.

368
00:18:33,800 --> 00:18:35,360
There actually was no gate that was down.

369
00:18:35,460 --> 00:18:36,360
We hopped over to that.

370
00:18:36,460 --> 00:18:38,600
And we were like pilfering through some of the drawers that were there.

371
00:18:38,680 --> 00:18:41,920
And we found the keys and the combination for the safe and everything that was in there.

372
00:18:42,080 --> 00:18:44,120
So, like you could open those up, cash, everything.

373
00:18:44,340 --> 00:18:45,620
I mean, just ridiculous.

374
00:18:47,760 --> 00:18:50,180
But this particular one, so we didn't get caught with that.

375
00:18:50,320 --> 00:18:52,700
But we went to an ICU unit.

376
00:18:53,820 --> 00:18:55,580
And we weren't supposed to go in there.

377
00:18:56,100 --> 00:18:57,460
It's supposed to be bad access.

378
00:18:57,680 --> 00:18:58,940
But we were able to walk right in.

379
00:18:59,400 --> 00:19:00,240
But we got in there.

380
00:19:00,320 --> 00:19:03,400
We were hopping on some workstations, pulling some hashes down for some of the workstations.

381
00:19:03,480 --> 00:19:05,960
There were some medical devices we were messing around with in there.

382
00:19:07,060 --> 00:19:08,660
All of a sudden, I hear a little footstep.

383
00:19:08,680 --> 00:19:11,000
And my colleague with me, I see him take off.

384
00:19:11,080 --> 00:19:11,580
And he's hiding.

385
00:19:12,440 --> 00:19:13,440
So, I'm hiding, too.

386
00:19:13,660 --> 00:19:15,360
And, like, eventually we had to come out.

387
00:19:15,460 --> 00:19:16,840
But there was two night nurses.

388
00:19:17,080 --> 00:19:19,140
It was, like, Nurse Gresham and somebody else.

389
00:19:19,240 --> 00:19:20,080
But they were walking around.

390
00:19:20,700 --> 00:19:22,280
And they were like, we know you're in here.

391
00:19:23,020 --> 00:19:23,820
So, we came out.

392
00:19:23,920 --> 00:19:26,920
We made up a whole cover story that we're, you know, such and such IT vendor.

393
00:19:27,060 --> 00:19:27,980
We're here doing some upgrades.

394
00:19:28,140 --> 00:19:29,000
We only do these at night.

395
00:19:29,960 --> 00:19:31,000
They were okay with that.

396
00:19:31,040 --> 00:19:32,560
But we did get escorted out of the hospital.

397
00:19:34,420 --> 00:19:37,860
But another instance I can give you that we actually did get threatened with a gun.

398
00:19:37,860 --> 00:19:39,960
Which I'm not going to get too much into.

399
00:19:40,160 --> 00:19:43,940
But that was a little bit not of a good section, a good city to be in.

400
00:19:45,400 --> 00:19:50,580
So, physical security is quite interesting, you know, just around a hospital.

401
00:19:50,680 --> 00:19:53,200
Just because it's such an open access type of thing.

402
00:19:53,380 --> 00:19:54,900
And people want to be helpful.

403
00:19:55,120 --> 00:19:57,080
You know, that's a big thing with health care.

404
00:19:57,720 --> 00:20:00,620
People are typically helpful, especially if you're nice.

405
00:20:00,780 --> 00:20:03,140
You know, a lot of times we'll wear suits, walk around.

406
00:20:03,380 --> 00:20:05,360
You know, we don't look like typical hackers walking around in suits.

407
00:20:06,200 --> 00:20:07,800
So, we have good cover stories.

408
00:20:07,800 --> 00:20:09,780
So, you can get around quite a bit.

409
00:20:10,820 --> 00:20:16,860
So, the two center screenshots here are just around some of the actual network hacking that we're doing.

410
00:20:17,600 --> 00:20:19,960
And just getting on some of the physical security devices.

411
00:20:20,200 --> 00:20:24,520
So, getting access to the camera system that's throughout the facilities.

412
00:20:25,060 --> 00:20:27,880
Getting access to badge systems, if you want to make your own badge.

413
00:20:28,160 --> 00:20:31,300
The bottom one here is infant security system monitoring.

414
00:20:31,640 --> 00:20:36,100
So, if you're familiar with babies, it's actually a really locked down section of the hospital.

415
00:20:36,220 --> 00:20:37,780
Just so nobody can steal the baby.

416
00:20:37,800 --> 00:20:43,200
I proposed at our firm to do this type of testing to actually steal babies.

417
00:20:43,340 --> 00:20:43,620
I'm kidding.

418
00:20:45,660 --> 00:20:47,020
I don't think that would go over well.

419
00:20:47,060 --> 00:20:51,180
I never would want to do that because people's father and mother instincts would kick in.

420
00:20:52,140 --> 00:20:53,820
But, yeah, it's a very sensitive area.

421
00:20:53,960 --> 00:20:57,380
But we're just kind of showing that we could get on some of the systems and monitor that.

422
00:20:57,540 --> 00:20:58,900
That we're monitoring those controls.

423
00:21:03,480 --> 00:21:04,660
So, root causes.

424
00:21:05,380 --> 00:21:06,560
There's a lot of root causes.

425
00:21:06,620 --> 00:21:07,680
I tried to cram.

426
00:21:07,680 --> 00:21:08,980
I tried to cram as much as I could on one page.

427
00:21:10,160 --> 00:21:13,840
So, one is 60% of teams lack an information security leader.

428
00:21:14,320 --> 00:21:20,240
A lot of times what we find is a CIO has a security responsibility.

429
00:21:20,340 --> 00:21:23,540
Or a compliance officer has security responsibilities.

430
00:21:23,680 --> 00:21:24,360
No CISO.

431
00:21:25,440 --> 00:21:26,580
Very short-handed.

432
00:21:26,760 --> 00:21:27,920
Teams are very small.

433
00:21:28,180 --> 00:21:30,440
Sometimes one analyst, two analysts at most.

434
00:21:31,240 --> 00:21:32,560
Very limited budget.

435
00:21:32,960 --> 00:21:36,600
If you look at the financial industry, I think it's like 12 or 13%.

436
00:21:37,320 --> 00:21:39,080
Healthcare, I think it's 5 or 6%.

437
00:21:39,080 --> 00:21:40,500
So, half the cost.

438
00:21:40,560 --> 00:21:41,740
A little more complex of an environment.

439
00:21:43,020 --> 00:21:43,800
Culture and leadership.

440
00:21:44,420 --> 00:21:45,980
This is still kind of happening.

441
00:21:46,120 --> 00:21:47,840
It's this prioritization of security's importance.

442
00:21:48,860 --> 00:21:51,780
Like I said, like the ransomware and the different breaches that have been happening.

443
00:21:51,840 --> 00:21:53,680
It's starting to get more and more.

444
00:21:53,800 --> 00:21:56,060
Like the board is starting to ask questions about this.

445
00:21:56,160 --> 00:21:57,340
And like what are we doing around security?

446
00:21:57,520 --> 00:21:58,740
You know, what's happening?

447
00:21:59,060 --> 00:22:00,740
So, some of that is starting to shift.

448
00:22:00,860 --> 00:22:01,920
And it's exciting to see.

449
00:22:02,860 --> 00:22:04,860
But it's still kind of this whole big thing.

450
00:22:06,600 --> 00:22:09,120
Focus on compliance rather than security and risk management.

451
00:22:09,640 --> 00:22:12,060
So, you know, we do HIPAA.

452
00:22:12,120 --> 00:22:12,500
We're good.

453
00:22:12,700 --> 00:22:14,560
You know, HIPAA is kind of vague in a lot of areas.

454
00:22:14,600 --> 00:22:15,420
Not very specific.

455
00:22:15,460 --> 00:22:16,800
Not real world security.

456
00:22:16,980 --> 00:22:17,800
What can a hacker do?

457
00:22:17,920 --> 00:22:19,240
What can somebody do in our network?

458
00:22:21,120 --> 00:22:23,920
And like I said, and this whole talk is really about the basics.

459
00:22:25,060 --> 00:22:29,920
You know, like I don't, you know, like I see a lot of times like, hey, we're going to buy this tool.

460
00:22:29,980 --> 00:22:31,560
We're going to buy this next generation AV.

461
00:22:32,620 --> 00:22:36,580
But at the same time, like I'm like, you guys haven't taken care of the basic stuff, right?

462
00:22:36,580 --> 00:22:40,760
Password management, patching, you know, old systems.

463
00:22:41,020 --> 00:22:43,560
Just taking care of that stuff goes a long way.

464
00:22:44,020 --> 00:22:46,880
Default accounts out there, you know, looking for your SQL databases.

465
00:22:46,920 --> 00:22:49,600
Looking at your applications that have defaults that are sitting out there.

466
00:22:49,940 --> 00:22:52,080
You know, it's stuff that takes time.

467
00:22:52,240 --> 00:22:53,840
But it's very cost effective.

468
00:22:54,760 --> 00:23:01,480
But like that basic stuff really needs to be done before we go and bring in these tools that we don't have enough people to run and look at anyway.

469
00:23:03,340 --> 00:23:04,500
Expansive systems and upgrades.

470
00:23:04,760 --> 00:23:06,560
So, just, you know, huge HIPAA.

471
00:23:06,580 --> 00:23:07,440
HR implementations.

472
00:23:07,440 --> 00:23:09,080
That type of stuff takes away from the security.

473
00:23:09,260 --> 00:23:09,960
Old systems.

474
00:23:10,340 --> 00:23:11,320
I talked about that.

475
00:23:11,480 --> 00:23:14,660
I'm slowly running out of time, so I'm just kind of trying to skim through some of these things here.

476
00:23:15,500 --> 00:23:17,640
Healthcare systems require, you know, high availability.

477
00:23:18,040 --> 00:23:18,980
Patient first mentality.

478
00:23:19,780 --> 00:23:21,660
You know, security has always been an afterthought.

479
00:23:21,780 --> 00:23:22,460
Security is delayed.

480
00:23:23,420 --> 00:23:25,580
I spoke quite a bit about vendor management.

481
00:23:25,760 --> 00:23:27,460
Understanding the assets that are out there.

482
00:23:27,720 --> 00:23:28,460
Responsibilities, risks.

483
00:23:28,720 --> 00:23:30,360
They're definitely the weak point of entry.

484
00:23:31,220 --> 00:23:33,400
You know, a lot of times we're getting in through those routes.

485
00:23:34,760 --> 00:23:36,060
And then just the vendors overall.

486
00:23:36,580 --> 00:23:38,920
So, you know, there's been this lack of secure development life cycle.

487
00:23:39,020 --> 00:23:41,260
You know, I'm actually pretty excited to see the FDA.

488
00:23:41,600 --> 00:23:44,740
A lot of them are starting to put out these different standards around there.

489
00:23:44,780 --> 00:23:47,960
Actually, you know, getting some of these devices secure before they get implemented.

490
00:23:48,720 --> 00:23:51,920
And, you know, and just this whole process around disclosing vulnerability.

491
00:23:52,120 --> 00:23:54,540
Sharing the different processes around that.

492
00:23:55,080 --> 00:23:56,800
You know, and just the business associations.

493
00:23:57,360 --> 00:24:00,840
Associates that are all connected into the network and getting those guys secure as well.

494
00:24:03,780 --> 00:24:05,200
So, that is my talk.

495
00:24:05,200 --> 00:24:06,540
I think we got maybe like.

496
00:24:07,900 --> 00:24:08,760
We don't have enough time?

497
00:24:08,880 --> 00:24:09,100
Okay.

498
00:24:09,200 --> 00:24:09,700
Oh, we do?

499
00:24:10,100 --> 00:24:10,460
Okay.

500
00:24:10,660 --> 00:24:11,220
So, yeah.

501
00:24:11,280 --> 00:24:12,300
If anybody has any questions.

502
00:24:12,660 --> 00:24:13,120
Go ahead.

503
00:24:14,320 --> 00:24:16,400
If you have questions, please walk up to the mic.

504
00:24:17,600 --> 00:24:19,000
What if I talk like this?

505
00:24:26,020 --> 00:24:29,320
How do you scope, like, when you're, like, looking at medical devices?

506
00:24:30,520 --> 00:24:33,200
Like, for me, I would be like, okay, I'm in a hospital.

507
00:24:33,240 --> 00:24:33,960
There's an IP address.

508
00:24:34,720 --> 00:24:35,180
That kind of thing.

509
00:24:35,200 --> 00:24:36,340
That could be a respirator.

510
00:24:37,280 --> 00:24:40,200
Like, how do you be careful and not kill people?

511
00:24:40,420 --> 00:24:40,860
Like, what?

512
00:24:40,880 --> 00:24:41,220
Yeah.

513
00:24:41,240 --> 00:24:41,520
Yeah.

514
00:24:41,600 --> 00:24:45,600
It's a very, you know, and it's definitely, you know, one of the big issues in healthcare.

515
00:24:45,740 --> 00:24:46,740
And we have to be very sensitive.

516
00:24:46,860 --> 00:24:49,860
And we usually put ourselves under a lot of restraints when doing this.

517
00:24:50,400 --> 00:24:52,280
We work with the IT teams.

518
00:24:52,360 --> 00:24:55,820
And we really identify, you know, one, you know, is there things you don't want us to

519
00:24:55,820 --> 00:24:56,960
touch at all on the network?

520
00:24:57,520 --> 00:24:59,680
Is there items you want us to be sensitive around?

521
00:24:59,820 --> 00:25:03,480
You know, if we're doing medical devices, a lot of times we may ask for a sampling.

522
00:25:03,800 --> 00:25:05,100
Some sampling.

523
00:25:05,100 --> 00:25:05,180
You know?

524
00:25:05,180 --> 00:25:07,620
Are you doing a little type of things that we know that, you know, they've done?

525
00:25:07,720 --> 00:25:08,300
We talk to them, too.

526
00:25:08,380 --> 00:25:09,560
You know, are you doing vulnerability scanning?

527
00:25:09,740 --> 00:25:10,300
Have you done that?

528
00:25:10,500 --> 00:25:12,460
Have you touched these type of things that are out there?

529
00:25:13,000 --> 00:25:15,960
So there's a lot of considerations to go in, that go into that.

530
00:25:16,100 --> 00:25:18,240
But, yeah, we definitely, you know, want to be cautious.

531
00:25:18,320 --> 00:25:21,980
As well as, like, when we're getting on those, a lot of times we're doing very more passive

532
00:25:21,980 --> 00:25:22,520
type of stuff.

533
00:25:22,620 --> 00:25:25,620
We're like, you know, if it's got, you know, SSH, we're just trying to connect to that.

534
00:25:25,820 --> 00:25:28,360
We're not trying to run, like, some exploit code or something on it.

535
00:25:28,440 --> 00:25:32,280
So we're really cautious around testing those things and just the testing and working really

536
00:25:32,280 --> 00:25:35,040
with, you know, as much as the IT and the security teams know.

537
00:25:35,040 --> 00:25:37,720
You know, what's out there and what's connected.

538
00:25:38,260 --> 00:25:39,360
That's a good question.

539
00:25:39,560 --> 00:25:39,680
Yeah.

540
00:25:39,760 --> 00:25:40,140
Thanks.

541
00:25:55,280 --> 00:25:56,580
Thanks for coming.

542
00:25:58,860 --> 00:25:59,420
Yeah.

543
00:26:01,380 --> 00:26:04,640
I was just curious about Bluetooth and IOT type things.

544
00:26:04,740 --> 00:26:05,020
Has that been a problem?

545
00:26:05,040 --> 00:26:07,340
Has it changed at all, all these other frequencies and stuff

546
00:26:07,340 --> 00:26:08,540
and things that are limited range?

547
00:26:08,720 --> 00:26:10,900
Do you have to do more scoping and try to venture around

548
00:26:10,900 --> 00:26:13,020
to try to find these limited broadcast systems?

549
00:26:14,300 --> 00:26:18,080
Yeah, you know, a lot of times, you know, my work,

550
00:26:18,220 --> 00:26:21,140
we have another guy that is a lot more around the medical device stuff

551
00:26:21,140 --> 00:26:24,800
that, you know, be specific and come in and look at that type of stuff.

552
00:26:25,160 --> 00:26:28,600
A lot of times what I'm getting engaged for is to look at the entire network

553
00:26:28,600 --> 00:26:30,300
and find the weak point of entries

554
00:26:30,860 --> 00:26:33,800
and just do some general threat hunting around that.

555
00:26:33,800 --> 00:26:35,760
So a lot of times I'm not going after that type of stuff.

556
00:26:36,000 --> 00:26:38,040
You know, if the environment is really challenging,

557
00:26:38,160 --> 00:26:40,940
then I'll start, like, kind of pinpointing more of that type of stuff

558
00:26:40,940 --> 00:26:43,080
that's going on there, but usually there's so much stuff to go after

559
00:26:43,080 --> 00:26:45,620
and I only have such a time frame that I'm just trying to get in

560
00:26:45,620 --> 00:26:48,860
and show as much access as I can get and what could I do.

561
00:26:49,740 --> 00:26:52,500
You know, but yeah, there's a lot of risks with that type of stuff.

562
00:26:53,580 --> 00:26:55,020
We have time for one more question.

563
00:27:01,380 --> 00:27:03,380
I guess my only question is,

564
00:27:03,900 --> 00:27:06,680
Lon, like, when you're trying to exploit a certain target,

565
00:27:06,780 --> 00:27:10,440
have you ever accidentally gone to another hospital's network or anything

566
00:27:10,440 --> 00:27:12,360
with any database that they're sharing

567
00:27:12,360 --> 00:27:16,180
or anything that they're using, the same group or anything like that?

568
00:27:17,760 --> 00:27:20,640
Yeah, not, trying to think off the top of my head.

569
00:27:22,680 --> 00:27:26,980
There was one client that did give us some IPs from the external one time

570
00:27:26,980 --> 00:27:30,720
that they scoped it wrong, and we got into some, I think,

571
00:27:30,780 --> 00:27:33,640
I think there's some cameras.

572
00:27:33,800 --> 00:27:35,820
There's some systems out in the internet of some, like, daycare thing,

573
00:27:35,940 --> 00:27:36,560
but it wasn't them.

574
00:27:37,060 --> 00:27:39,040
But, you know, anything major, no.

575
00:27:39,120 --> 00:27:44,020
We haven't gotten into, you know, anything that was, like, totally something else.

576
00:27:44,240 --> 00:27:47,820
I mean, on the network, everything's kind of game that's in scope for them,

577
00:27:47,920 --> 00:27:49,600
so if there's vendor stuff sitting out in the network,

578
00:27:50,140 --> 00:27:52,500
we'll usually go after that, and then they'll work with the vendor,

579
00:27:52,620 --> 00:27:54,460
you know, to secure those type of things.

580
00:27:54,920 --> 00:27:57,500
But, yeah, nothing like that.

581
00:27:57,560 --> 00:28:02,520
So you haven't noticed that there are any use of, say, cloud-like, you know, type stuff

582
00:28:02,520 --> 00:28:03,360
where they're actually...

583
00:28:03,800 --> 00:28:07,500
using out external resources that are unsecure or anything like that?

584
00:28:07,960 --> 00:28:11,020
Or is it generally internalized at the local site?

585
00:28:11,960 --> 00:28:13,380
Yeah, it depends.

586
00:28:13,680 --> 00:28:15,460
You know, there is a lot moved in the cloud,

587
00:28:15,700 --> 00:28:18,780
and sometimes we're engaged to target some of those things.

588
00:28:18,900 --> 00:28:22,580
It's more from the business associate level that are developing apps

589
00:28:22,580 --> 00:28:24,280
and different things that are sitting out in the cloud.

590
00:28:24,560 --> 00:28:24,920
Okay.

591
00:28:24,960 --> 00:28:28,980
But typically we're not going after those things specifically in an environment.

592
00:28:29,620 --> 00:28:30,580
You know, we'll find...

593
00:28:30,580 --> 00:28:33,220
We definitely do find usernames and passwords and that type of stuff.

594
00:28:33,380 --> 00:28:33,640
Okay.

595
00:28:33,640 --> 00:28:35,900
External, like, you know, all their banks and different things,

596
00:28:35,960 --> 00:28:37,780
all that type of stuff, anything that's external,

597
00:28:37,860 --> 00:28:40,540
we find big sheets and stuff with all that type of stuff in it.

598
00:28:40,580 --> 00:28:44,580
But, yeah, we try to keep it contained of what our scope is under contract.

599
00:28:44,840 --> 00:28:45,180
Right.

600
00:28:45,260 --> 00:28:45,600
Okay.

601
00:28:45,720 --> 00:28:45,960
Yeah.

602
00:28:46,140 --> 00:28:46,680
Thank you.

603
00:28:46,700 --> 00:28:47,240
Thank you.

604
00:28:47,280 --> 00:28:48,040
Thank you, Kevin.

605
00:28:48,240 --> 00:28:48,520
Okay.

606
00:28:48,580 --> 00:28:48,920
Thanks.

607
00:28:49,640 --> 00:28:50,040
Thanks.

608
00:28:50,520 --> 00:28:50,920
Thanks.

609
00:28:50,920 --> 00:28:51,240
Thanks.