Good afternoon. Everybody hear me all right?
Okay, great.
Thanks, Harry, for the introduction.
I've been doing hacking for a while.
The past three years I've been working for Metatology Services
and focused strictly on health care.
I've done about 50 different hacking engagements
for medium to large health care providers,
so that's what I'm going to focus on today
and really talk about the different themes that I'm seeing
as a health care hacker and the weaknesses in health care.
To overview, health care providers are really struggling
with the basic foundational security.
I'm going to get into a lot of these things in this talk.
I used to do hacking in other industries,
and when I came back and started doing hacking again
and came into health care, it was really like 10 years ago
in some aspects, just kind of seeing a lot of really weak security
out there and just some of the technology that was out there 10 years ago.
There is some closing those gaps.
A few are mature. They have mature programs.
But you have to also think about health care environment.
In health care, they're serving patients.
People can walk into the facilities.
There's all types of devices everywhere, computers everywhere,
so it's kind of an open door.
It's not like a financial institution where you keep the employees,
keep everything inside, keep everything behind doors
and build that perimeter up.
So you have that as well as just a lot of different devices
that are being connected to the network.
All these medical devices now are getting IP addresses,
getting connected within there.
In the culture overall, security has always been an afterthought
in health care.
And that mentality is starting to shift, especially with all these breaches
and ransomwares that are happening.
But I'll get into that in this talk here.
So real quick, just why is health care a target?
Obviously, a lot of different data points that are out there,
electric medical records, financial data.
You know, this data is just being hoarded kind of in hospitals,
especially the health care information.
And with that information, you can do a lot of types of stuff with it, right?
So you can do a lot of things.
You can do insurance fraud, prescription fraud, blackmail, ransomware,
just steal the data and sell it.
So a lot of different things.
And as well as just as a higher impact.
You know, we're dealing with people's lives here,
the privacy of their information, but as well as, you know,
being hooked up to different medical devices,
being for the hospital system to be able to serve the patient
and give them correct care.
Easy fish and sea.
And like I said, I'm going to talk a lot about those security weaknesses in this talk.
A few screenshots here.
I have a lot of screenshots throughout here,
and I'm going to try to pepper in some of my kind of stories.
The first one here on top here is just an EHR system.
The second one is a point of sale system in a cafeteria.
I always like to hop on that before I get lunch, make sure I can get something.
So we're just doing that and then grabbing some keystroke log in on that system there,
just some of the screenshots showing.
So health care is a target, 30% more likely than financial industry.
2017 alone, the most amount of reportable breaches have been in health care.
We're seeing that uptake every year.
Just listing some of the big breaches that have happened in the past couple of years here.
And all these screenshots I have in here are actually from health care engagements.
I've redacted them so there's no sensitive information,
but these are a lot of different screenshots that we've taken,
getting into different devices and systems within health care environments.
So health care key industry weaknesses.
I'm going to talk about these different topics today.
Some are near and dear to my heart, so I'll probably spend a little more time on them
and skim through a few others.
First thing here is unpatched and outdated systems.
Health care, it's interesting, like we're out there,
you actually see a lot of old systems still sitting on the network.
It's an example of Windows 2000 servers, always a handful of those.
I've seen everything from Windows NT to one client having Windows 98
still out there.
I mean, it's crazy in this day and age to see some of that that's out there.
You know, what's happening a lot is there's a lot of just different systems out there,
and a lot of times these are vendor systems,
so they're not being managed by the security of IT.
They're unaware of them, and they're sitting out in some corner somewhere,
and they're just, you know, never been updated, never been patched.
So these are just showing up top a couple exploits.
The top one is just a common Microsoft exploit, MS-0867, if you're familiar with that.
We usually find a few of those that are out there, right?
It's just a JBoss vulnerability that we use to exploit those, get local admin,
then dump the passwords in memory and escalate that from there,
and usually pretty quickly we got domain admin to the network.
Bottom right-hand corner is just what we do with some of the proof of concepts
of once we get access, is taking some webcam pictures
of some of the different workstations that are out there.
So in health care, there's these things called workstations on wheels, right?
And so they're used around the clinicians are moving around,
bringing them into exam rooms. They got webcams on them.
We pop on those. I mean, we've been able to take pictures of nurses in exam rooms
examining somebody and monitoring them while they're getting exams.
So you really talk about some serious privacy issues that are happening with this,
you know, as you get hacked and just some of the stuff that somebody could actually do,
you know, with getting that type of data.
Insufficient user awareness. So when I think about this, you know,
primarily speaking about social engineering, phishing, and some bad security practices
that are happening from phishing, from our phishing assessments,
what we've seen here, and if you see in here in the left-hand corner,
just kind of a tally of people who fell for the different phish that we sent.
So 27 people posted their credentials in this phishing campaign that we launched,
just a sample of employees in the environment.
And the red line there is the all industries average, and you see the blue.
That is, you know, kind of where they're at, and that's typical in health care.
We're seeing at least double, if not more, of individuals falling for phishing
when we send them different phishing campaigns.
Social engineering. This social engineering is really interesting in health care.
You know, we've come up with a lot of different scenarios that work a lot.
One is posing as a doctor. So we'll call the IT help desk.
You know, hey, I'm Dr. Such and Such. I've got a patient in the room right now.
I need to get into my system. I don't know what the heck my password is.
Can you reset it? And we use that authority, and when we're using that authority
to be aggressive with the help desk person, they'll bypass any type of verification.
Even if they do, you know, we've been able to work around that and give them some story
and get them, you know, they'll usually start shaking a little bit, and they'll get nervous
just because, you know, they're talking to a doctor.
We have this projection of authority on the doctors, so they want to give up and give that information.
And they also don't want to cause any types of problems or get in trouble.
So we take advantage of a lot of that when we're doing this with health care.
Other things is, you know, calling employees, impersonating different IT folks.
You know, I have a little bit of background in psychology, which is interesting.
You know, like social engineering for me is always about gaining trust.
It's about building a relationship with somebody and establishing trust.
So we'll do some research on the person that we're targeting, gather that information,
and start giving them that information and build a connection with that person
and also let them know we have some information on them.
And, you know, as we're doing that, we're building trust.
We tell them this is their password, and, you know, it's a fake password that we're giving them.
And then they'll usually respond and say, hey, that's the wrong password.
Oh, can we get you updated? That's what the problem is.
You know, we usually make a whole IT thing out of it, and they're usually okay with that.
Or we'll talk them through it. Okay, we know it's security.
You know, 15 minutes later, can you just do this and change your password?
And they're usually comfortable with that.
You know, in that 15 minutes' time, we can use that password, get on, and gain access to the network.
Another big thing we see is just kind of a lot of scripts out there, IT keeping scripts out there
with different passwords in it.
Active Directory is a big one.
Once we get a user account on the network,
we'll go into Active Directory, pull what's in the description fields,
and we have read-only access with any user usually typically in an environment for Active Directory.
And there's usually a bunch of different passwords sitting in the description field.
We found domain, admin, service accounts.
You know, it's really simple stuff, really basic stuff that we'd see out there.
So this is like the biggest pet peeve of mine is password management.
You know, every year I read these different, like, breach reports, Pokemon, Verizon,
these different surveys that are going out to the healthcare community
and the healthcare security professionals that are out there, the CIO, the CSSO.
And what, like, I'm seeing is, you know, always on the bottom of their concerns is passwords.
You know, it's not really making, like, they're not really that concerned about it,
which for me, as a hacker, I'm like, there's really bad passwords out there.
And you see on the right-hand corner, you'll see, you know, we usually grab the AD database,
do some analysis on their passwords.
This is an actual healthcare provider, a large provider.
You know, 6,476 accounts with password 1.
You know, ABT123.
I mean, really, really bad passwords.
You know, you see that worst password let's get.
This is where you're seeing it, like, and it's here.
And this is in, you know, protecting our sensitive healthcare information and our medical devices,
everything that's out there on this network, which is just crazy to me.
And, you know, single-factor authentication,
the majority of our healthcare providers,
are still using single-factor authentication.
Most of them haven't moved to multi-factor authentication.
You know, with combinations of these weak passwords and that,
and Outlook Web Access as well as being single-factor authentication,
we've been successfully been able to get domain administrator from the internet 80 to 90% of the time.
And that's a scary statistic.
You know, and we're under a strict budget with this.
I'm doing this testing in a week or two.
I mean, you know, real bad guys don't got those restraints that I have to put on myself,
to be able to do this.
So, we're going to be under contract to do this work.
Did some other weaknesses here.
Land man hashing, we still see quite a bit of that stuff.
Very easy to crack.
So, yeah, it's just a huge pet peeve of mine is password management.
Default counts and passwords, another big thing.
You know, a lot of those GE type of accounts that are out there,
we see those connected to AD.
Majority of the time, they're sitting there, default password.
They allow their whole AD database through the VPN.
We gain access through that.
And usually there's some servers or some other systems on there
that those accounts actually have local admin privileges on.
So, get access to that and pretty easily you can escalate up.
Other default stuff, SQL databases, still see quite a bit of that out there.
SQL databases sitting out there.
That's pretty easy to gain access to and pop a shell on.
Apache, that's easy to load up a command.asp and get a shell on that as well.
Password hints.
This is another interesting thing you see sometimes.
I had a recent client, they had their password self-service out there
and they're using security questions.
So, I started looking at these security questions.
The security questions, I think they were using six and you had to get three correct.
But the security questions, some of them were hard.
Like, you know, who's your second grade teacher?
That would take quite a bit of research for me to do.
But some of them were pretty easy.
Like, where did I go to elementary school?
Where did I meet my husband?
You know, what town was I born in?
You know, 10, 15 minutes I can do some public profiling on the internet
and find out all that information or at least close to it
or at least a few cities or something, you know, that's there.
So, sit there, plug away those security questions.
I can reset the password.
They're not sending the reset back to an SMS or anything like that.
I get it right.
I can change it right there on the fly, get into the network.
So, a lot of different things.
This one actually here is for a point of sale system that I got access to.
And they had a password hint thing going on.
And what was your favorite color?
My favorite color is blue.
That was the right answer.
Another big area is just medical device security.
And I think there's some other talks and stuff on there
and some stuff on the internet of things that you guys can do some hacking, I heard,
on those really cool stuff.
You know, from my perspective, a lot of times we're going after these
after we get access to the network and going after the ones that are connected to the network.
They're just crazy.
You actually see a picture here.
This is kind of funny.
We were doing a physical security review of some medical devices in a provider.
We actually found a cockroach sitting in, I think this is an insulin pump,
that was sitting in there.
So, they actually do have bugs, real ones.
Default passwords, missing patches, configurations, no AV, remote access, you name it.
You can get VNC access, SSH access, Telnet access, a lot of different access.
Vendor oversight, that's like the main reason behind somebody getting some of these root causes at the end,
if I got some time for these.
But a lot of times what happens is, you know, the vendors come in,
they put these medical devices in, or biomed, or clinical engineering, whatever it's called,
in the facility, sitting there hooking these up.
Either security doesn't know about them,
or security believes that the vendor is taking care of the security of them.
So, there's kind of this finger pointing, like, well, I thought you were doing it.
You know, no, I thought you were doing it.
And, you know, it's been five years.
These things have been connected to the network.
There's a lot of also issues just about the medical devices in general of, you know,
can they actually be updated?
Can they be patched?
Can they run an antivirus?
There's just a lot of different concerns around it, and it really depends on the manufacturer
and also how they're connected.
You know, a lot of environments, we don't see them segmented out.
You know, we have different ways that we do and talk about, you know, medical device
and building a whole security program out there and building separate networks for those ones
that really we can't secure too well and trying to lock that down that way.
Some of the ones that have done that have been fairly successful,
but a lot of times we just see them connected right out on the whole network,
and there's really not a whole lot of asset inventory right now of, you know,
we're knowing what's actually out there that's connected.
So, one big thing that we do see a lot, probably I'd say about 15% to 20% of the time,
we still see wet networks out there.
And these are usually the medical devices.
There's a lot of device equipment that's connected to this because they can't run WPA.
So, it's really, really interesting.
Like, I was, like, the first time I saw a WEP out there, I was like, really?
I was like, that's nuts.
I was like, this day and age, WEP is still being used out there.
So, kind of this picture down here, went around with one of our smartphones and antenna,
cracked some WEP pretty quickly, got on the network.
That network was directly connected to the internal network,
a whole other entry point right into the network.
From there.
Just some of the other screenshots here are just some devices that we've gotten onto.
Some, I think, one's like a breath monitoring or something, respiration.
Other one's monitoring, looks like heart rate and just basic vitals.
But always cool getting on those type of devices that are out there.
Ooh, got a thing popping up here.
Lack of oversight into vendor security.
I already talked a little bit about this.
I'll tell a little more of a story about this here.
So, this screenshot here is actually a patient sleeping.
So, a lot of healthcare providers have a sleep center for people who are experiencing insomnia,
having a really difficult time sleeping.
So, they go and stay over a couple nights over at the sleep center.
And there are video cameras and everything else.
And there's some live streaming of them sleeping.
So, we hacked into these sleep systems that were connected to the network.
And just really, really bad security.
The password for a miniature was password.
We actually tracked down the server in the sleep center.
And we found a closet.
It's a regular closet.
No lock on it.
The server is sitting on this makeshift desk.
And then the password is written on a little postie right next to it.
So, it's really interesting.
Another client that I had recently, they had a pharmacy dosing network.
One of the vendors came in and put this whole network in.
It had a domain controller.
It had about, I don't know, 50 different systems connected to it.
Domain controller.
No patching.
It had JBoss vulnerability.
We got on it.
We started looking at some of the passwords around it.
The passwords were pretty all the same.
The same as the username.
Three characters long.
Just really horrendous.
You know, very easy to get on there.
We talked to the security officer about it.
You know, he was kind of unaware of it.
Some of the IT guys didn't know about it.
But, you know, like I said, there's just a lot of stuff that's just getting out there.
And healthcare is just so complex.
And there's just, everybody's kind of sticking stuff on the network.
That's just the way it's been.
And there's just this stuff that's sitting out there.
And until they actually do some real testing and having somebody kind of go out there and find this stuff
and identify it on the network, unless they're doing it internally,
you know, they just have no idea.
Physical security.
Like I said, hospital doors are open.
So, pretty easy to walk in, get on the clinical floors.
Some of the screenshots here.
This, I think, was in a doctor's lounge on one of the clinical floors.
We often find workstations sitting in, you know, doctor's lounges, conference rooms,
the type of stuff that's just kind of open that, you know, you're not supposed to kind of walk into, but is open.
I don't know what's going on with that.
Is that me?
Yeah. Yeah.
Okay. Sorry.
There I am.
So, this particular workstation, we got in there.
We're hanging out there.
There's a couple of doctors in there.
They were kind of cool with us hanging out in there.
We asked them.
They were nice.
The workstation was automatically logged in.
And there was also a case.
It wasn't.
There was a little posty next to it that did tell you the username and password for it.
So, we find that stuff quite a bit.
Another thing on the far right here, that's actually me.
I covered myself up.
But that's just hanging out kind of in a clinician's room.
You'll see one of those workstations on wheels.
That was a really interesting client.
We actually did get caught doing the physical security.
But we did get really, really aggressive.
And we were kind of loopy.
I think it was like 12, 1 o'clock in the morning.
And we're like hanging out in this hospital and sneaking around.
So, like one thing we got into, there was where people go and make payments.
And it was like the cash counter.
It had a counter like top like this high or something.
We hopped over that.
There actually was no gate that was down.
We hopped over to that.
And we were like pilfering through some of the drawers that were there.
And we found the keys and the combination for the safe and everything that was in there.
So, like you could open those up, cash, everything.
I mean, just ridiculous.
But this particular one, so we didn't get caught with that.
But we went to an ICU unit.
And we weren't supposed to go in there.
It's supposed to be bad access.
But we were able to walk right in.
But we got in there.
We were hopping on some workstations, pulling some hashes down for some of the workstations.
There were some medical devices we were messing around with in there.
All of a sudden, I hear a little footstep.
And my colleague with me, I see him take off.
And he's hiding.
So, I'm hiding, too.
And, like, eventually we had to come out.
But there was two night nurses.
It was, like, Nurse Gresham and somebody else.
But they were walking around.
And they were like, we know you're in here.
So, we came out.
We made up a whole cover story that we're, you know, such and such IT vendor.
We're here doing some upgrades.
We only do these at night.
They were okay with that.
But we did get escorted out of the hospital.
But another instance I can give you that we actually did get threatened with a gun.
Which I'm not going to get too much into.
But that was a little bit not of a good section, a good city to be in.
So, physical security is quite interesting, you know, just around a hospital.
Just because it's such an open access type of thing.
And people want to be helpful.
You know, that's a big thing with health care.
People are typically helpful, especially if you're nice.
You know, a lot of times we'll wear suits, walk around.
You know, we don't look like typical hackers walking around in suits.
So, we have good cover stories.
So, you can get around quite a bit.
So, the two center screenshots here are just around some of the actual network hacking that we're doing.
And just getting on some of the physical security devices.
So, getting access to the camera system that's throughout the facilities.
Getting access to badge systems, if you want to make your own badge.
The bottom one here is infant security system monitoring.
So, if you're familiar with babies, it's actually a really locked down section of the hospital.
Just so nobody can steal the baby.
I proposed at our firm to do this type of testing to actually steal babies.
I'm kidding.
I don't think that would go over well.
I never would want to do that because people's father and mother instincts would kick in.
But, yeah, it's a very sensitive area.
But we're just kind of showing that we could get on some of the systems and monitor that.
That we're monitoring those controls.
So, root causes.
There's a lot of root causes.
I tried to cram.
I tried to cram as much as I could on one page.
So, one is 60% of teams lack an information security leader.
A lot of times what we find is a CIO has a security responsibility.
Or a compliance officer has security responsibilities.
No CISO.
Very short-handed.
Teams are very small.
Sometimes one analyst, two analysts at most.
Very limited budget.
If you look at the financial industry, I think it's like 12 or 13%.
Healthcare, I think it's 5 or 6%.
So, half the cost.
A little more complex of an environment.
Culture and leadership.
This is still kind of happening.
It's this prioritization of security's importance.
Like I said, like the ransomware and the different breaches that have been happening.
It's starting to get more and more.
Like the board is starting to ask questions about this.
And like what are we doing around security?
You know, what's happening?
So, some of that is starting to shift.
And it's exciting to see.
But it's still kind of this whole big thing.
Focus on compliance rather than security and risk management.
So, you know, we do HIPAA.
We're good.
You know, HIPAA is kind of vague in a lot of areas.
Not very specific.
Not real world security.
What can a hacker do?
What can somebody do in our network?
And like I said, and this whole talk is really about the basics.
You know, like I don't, you know, like I see a lot of times like, hey, we're going to buy this tool.
We're going to buy this next generation AV.
But at the same time, like I'm like, you guys haven't taken care of the basic stuff, right?
Password management, patching, you know, old systems.
Just taking care of that stuff goes a long way.
Default accounts out there, you know, looking for your SQL databases.
Looking at your applications that have defaults that are sitting out there.
You know, it's stuff that takes time.
But it's very cost effective.
But like that basic stuff really needs to be done before we go and bring in these tools that we don't have enough people to run and look at anyway.
Expansive systems and upgrades.
So, just, you know, huge HIPAA.
HR implementations.
That type of stuff takes away from the security.
Old systems.
I talked about that.
I'm slowly running out of time, so I'm just kind of trying to skim through some of these things here.
Healthcare systems require, you know, high availability.
Patient first mentality.
You know, security has always been an afterthought.
Security is delayed.
I spoke quite a bit about vendor management.
Understanding the assets that are out there.
Responsibilities, risks.
They're definitely the weak point of entry.
You know, a lot of times we're getting in through those routes.
And then just the vendors overall.
So, you know, there's been this lack of secure development life cycle.
You know, I'm actually pretty excited to see the FDA.
A lot of them are starting to put out these different standards around there.
Actually, you know, getting some of these devices secure before they get implemented.
And, you know, and just this whole process around disclosing vulnerability.
Sharing the different processes around that.
You know, and just the business associations.
Associates that are all connected into the network and getting those guys secure as well.
So, that is my talk.
I think we got maybe like.
We don't have enough time?
Okay.
Oh, we do?
Okay.
So, yeah.
If anybody has any questions.
Go ahead.
If you have questions, please walk up to the mic.
What if I talk like this?
How do you scope, like, when you're, like, looking at medical devices?
Like, for me, I would be like, okay, I'm in a hospital.
There's an IP address.
That kind of thing.
That could be a respirator.
Like, how do you be careful and not kill people?
Like, what?
Yeah.
Yeah.
It's a very, you know, and it's definitely, you know, one of the big issues in healthcare.
And we have to be very sensitive.
And we usually put ourselves under a lot of restraints when doing this.
We work with the IT teams.
And we really identify, you know, one, you know, is there things you don't want us to
touch at all on the network?
Is there items you want us to be sensitive around?
You know, if we're doing medical devices, a lot of times we may ask for a sampling.
Some sampling.
You know?
Are you doing a little type of things that we know that, you know, they've done?
We talk to them, too.
You know, are you doing vulnerability scanning?
Have you done that?
Have you touched these type of things that are out there?
So there's a lot of considerations to go in, that go into that.
But, yeah, we definitely, you know, want to be cautious.
As well as, like, when we're getting on those, a lot of times we're doing very more passive
type of stuff.
We're like, you know, if it's got, you know, SSH, we're just trying to connect to that.
We're not trying to run, like, some exploit code or something on it.
So we're really cautious around testing those things and just the testing and working really
with, you know, as much as the IT and the security teams know.
You know, what's out there and what's connected.
That's a good question.
Yeah.
Thanks.
Thanks for coming.
Yeah.
I was just curious about Bluetooth and IOT type things.
Has that been a problem?
Has it changed at all, all these other frequencies and stuff
and things that are limited range?
Do you have to do more scoping and try to venture around
to try to find these limited broadcast systems?
Yeah, you know, a lot of times, you know, my work,
we have another guy that is a lot more around the medical device stuff
that, you know, be specific and come in and look at that type of stuff.
A lot of times what I'm getting engaged for is to look at the entire network
and find the weak point of entries
and just do some general threat hunting around that.
So a lot of times I'm not going after that type of stuff.
You know, if the environment is really challenging,
then I'll start, like, kind of pinpointing more of that type of stuff
that's going on there, but usually there's so much stuff to go after
and I only have such a time frame that I'm just trying to get in
and show as much access as I can get and what could I do.
You know, but yeah, there's a lot of risks with that type of stuff.
We have time for one more question.
I guess my only question is,
Lon, like, when you're trying to exploit a certain target,
have you ever accidentally gone to another hospital's network or anything
with any database that they're sharing
or anything that they're using, the same group or anything like that?
Yeah, not, trying to think off the top of my head.
There was one client that did give us some IPs from the external one time
that they scoped it wrong, and we got into some, I think,
I think there's some cameras.
There's some systems out in the internet of some, like, daycare thing,
but it wasn't them.
But, you know, anything major, no.
We haven't gotten into, you know, anything that was, like, totally something else.
I mean, on the network, everything's kind of game that's in scope for them,
so if there's vendor stuff sitting out in the network,
we'll usually go after that, and then they'll work with the vendor,
you know, to secure those type of things.
But, yeah, nothing like that.
So you haven't noticed that there are any use of, say, cloud-like, you know, type stuff
where they're actually...
using out external resources that are unsecure or anything like that?
Or is it generally internalized at the local site?
Yeah, it depends.
You know, there is a lot moved in the cloud,
and sometimes we're engaged to target some of those things.
It's more from the business associate level that are developing apps
and different things that are sitting out in the cloud.
Okay.
But typically we're not going after those things specifically in an environment.
You know, we'll find...
We definitely do find usernames and passwords and that type of stuff.
Okay.
External, like, you know, all their banks and different things,
all that type of stuff, anything that's external,
we find big sheets and stuff with all that type of stuff in it.
But, yeah, we try to keep it contained of what our scope is under contract.
Right.
Okay.
Yeah.
Thank you.
Thank you.
Thank you, Kevin.
Okay.
Thanks.
Thanks.
Thanks.
Thanks.