1 00:00:00,000 --> 00:00:07,320 Thanks. Thanks for coming. So let's get started. Okay so my name is Den Regalado and 2 00:00:07,700 --> 00:00:14,460 we're going to be talking about an infusion pump. We can see it here. Let's talk about the 3 00:00:14,460 --> 00:00:20,960 disclaimer first. This is just for educational purposes. All the vulnerabilities that we 4 00:00:20,960 --> 00:00:28,260 identified we discussed with the vendor. They are committed to a 360 days fix. They work with 5 00:00:28,260 --> 00:00:34,180 us pretty close. They respond right away so I really appreciate the vendor around it. And we 6 00:00:34,660 --> 00:00:40,900 cannot disclose those details. We will show obviously the demos but once the vendor is ready 7 00:00:40,900 --> 00:00:48,680 with the fixes we can then publish the details. A little bit about us. We are Simbox. We are an 8 00:00:48,680 --> 00:00:56,140 IoT security company. I work there as a principal security researcher and have the greater 9 00:00:56,140 --> 00:01:04,940 uh blessed to be part of of great hacking book as a co-author and I'm running the um hack 10 00:01:04,940 --> 00:01:11,700 defender uh academy. Okay so we're going to be talking about uh the infusion pump overview so 11 00:01:11,700 --> 00:01:18,460 I'm going to give you guys a quick demo of how it works uh in case you don't know and why we 12 00:01:18,460 --> 00:01:24,860 picked this specific medical device the pump uh what is the attacker's goal, the challenges during 13 00:01:24,860 --> 00:01:29,840 the investigation, uh the potential vulnerabilities uh obviously uh we're going to be giving 14 00:01:29,840 --> 00:01:38,300 you demos. So uh the, the infusion pump is, first of all is very expensive eh it's more than 15 00:01:38,300 --> 00:01:45,800 $1000 and you can imagine uh hospital we can see around four, from 400- to 1000 of is guys 16 00:01:45,800 --> 00:01:52,480 sitting in a facility. Uh all of them connected. We'll see the details. Uh it is used to deliver 17 00:01:52,480 --> 00:02:02,920 fluids, medications, blood, etc. to the adults, pediatric and neonatal patients. So it just 18 00:02:02,920 --> 00:02:07,960 goes all around the hospital and then they just plug this guy, I'm going to show you in a 19 00:02:07,960 --> 00:02:12,700 second. So you will see a back, you know, and then the other side this is going to be 20 00:02:12,700 --> 00:02:18,980 connected through the human arm and they're going to start doing the fluids and it's 21 00:02:18,980 --> 00:02:23,740 automated and that's the main thing that you can program and say, okay, 50 milliliters for the 22 00:02:23,740 --> 00:02:27,960 next two hours, you leave it there and it's going to start feeding the liquids and if there is 23 00:02:27,960 --> 00:02:32,560 some issues, can you imagine that, for example, if it is insulin and it's request to have 100 24 00:02:32,560 --> 00:02:38,340 milliliters, let's say, and for some reason it's just giving 50 milliliters, it's not enough, so 25 00:02:38,340 --> 00:02:43,880 the patient is going to be not doing good in health or in the opposite side, if you put more 26 00:02:43,880 --> 00:02:46,720 than expected, it's also something that you don't want to have. 27 00:02:48,080 --> 00:02:48,960 Okay, thank you. 28 00:02:49,900 --> 00:02:55,580 So let me just quickly show you, I'm going to be switching back and forth here. I just want to 29 00:02:55,580 --> 00:03:03,500 turn it on and show you how it works. So these are the main components I'm going to describe, all 30 00:03:03,500 --> 00:03:07,660 of them. This is the main unit. This is running the operating system. We're going to talk about 31 00:03:07,660 --> 00:03:13,900 the operating system. In the left side is the actual pump. So this pump, this guy is the one 32 00:03:13,900 --> 00:03:18,840 who's going to have the back with the liquid and then in the other side you are going to have 33 00:03:19,360 --> 00:03:28,040 the, the, the connecting to the, to the patient. Okay? Let's just turn it on. It's going to be 34 00:03:28,040 --> 00:03:32,780 hard for you guys to see it, but at least so that you have an idea, I'm going to put it in the 35 00:03:32,780 --> 00:03:40,080 back so that we can also talk about details. So I'm going to boot it up. This specific pump, you 36 00:03:40,080 --> 00:03:47,900 can have two in each side, so you can program many different infusions. And once it boots up, it is 37 00:03:51,520 --> 00:03:55,860 pretty simple. It's going to ask you for a new patient. You are going to see these devices going 38 00:03:55,860 --> 00:04:01,020 all around the hospital and then eventually if it is a new patient, you say yes, a new patient. You 39 00:04:01,020 --> 00:04:07,460 create a new profile. Or if it is not a new patient, it will load you the profile of that 40 00:04:07,460 --> 00:04:14,360 specific person with all the medication listed for that guy. And then it has some options here, 41 00:04:14,400 --> 00:04:18,800 obviously, to go around and, and to do some configurations. It's really, really limited. You cannot 42 00:04:18,800 --> 00:04:23,420 change anything here. You need an external software connected to a serial cable to do some 43 00:04:23,420 --> 00:04:29,620 changes. So for example, Wi-Fi connection has a Wi-Fi card in the back. And that's something that 44 00:04:29,620 --> 00:04:36,080 you need to do through a software. You cannot do it here. This is just read only. But let's go to 45 00:04:36,080 --> 00:04:42,680 the example of, um, of an infusion. Okay? So the, the person is going to come and is going to 46 00:04:42,680 --> 00:04:48,680 click here. Is going to say, okay, what I'm going to do, let's do a basic infusion. So then he 47 00:04:48,800 --> 00:04:54,400 is going to put very important the rate uh milliliters per hour. And then you are going to put 48 00:04:54,400 --> 00:05:00,860 the V.T.V.I. which is the volume to be infused. Liquid to be infused. And just, just to, to do 49 00:05:00,860 --> 00:05:08,660 some quick test. So let's say we, we put fifty. And then here we put uh a total of two hundred. 50 00:05:09,580 --> 00:05:16,600 And then we click start. And then the infusion pump start working. And that infusion pump is 51 00:05:16,600 --> 00:05:18,400 going to start feeding those fifty. 52 00:05:18,800 --> 00:05:29,160 per hour in a total of 200, total amount 250 per hour. That's pretty simple. That's 53 00:05:29,160 --> 00:05:33,100 obviously not working because we don't have the back but that's the basic idea of the 54 00:05:33,100 --> 00:05:41,400 functionality. Let me just, I'm going to turn it on, turn it off, sorry. So that's the main 55 00:05:41,400 --> 00:05:48,780 functionality of a pump. So let's see what we can do in a malicious way. So let's see what 56 00:05:48,800 --> 00:05:59,060 we can do. While we pick infusion pumps it is expected to be worth 10 billion by 2020 year in 57 00:05:59,060 --> 00:06:03,260 the market. So that means there's going to be explosion of these pumps so it's important for us 58 00:06:03,260 --> 00:06:09,820 to understand what is inside. This specific device is one of the leaders in the world so that 59 00:06:09,820 --> 00:06:18,260 means you can find it everywhere. Next time when you go to the hospital you will see it. It's 60 00:06:18,260 --> 00:06:23,640 important to properly identify vulnerabilities. So what is the attacker's goal of this guy? 61 00:06:23,760 --> 00:06:31,020 Right? So obviously if there is sensitive information inside like PII data so like you know 62 00:06:31,020 --> 00:06:36,180 congressman which is dealing with cancer or unfortunately the congressman that is dealing 63 00:06:36,180 --> 00:06:40,080 with brain cancer right now so you don't want to know about that right? But someone breaks into 64 00:06:40,080 --> 00:06:45,440 this they can use it in a malicious way. And hijack devices of course this can be also 65 00:06:45,440 --> 00:06:49,860 ransomware based, its running in a Linux, we will see details of that so you can hijack it, you 66 00:06:49,860 --> 00:06:55,400 can ask for ransomware and obviously you can disrupt it so it doesn't work anymore, the patient 67 00:06:55,400 --> 00:07:01,440 doesn't get attended and its bad. And of course you can also use the pump to break into the 68 00:07:01,440 --> 00:07:06,720 LAN. So this can be a breach to break into a network and from there to the whole devices. Not 69 00:07:06,720 --> 00:07:11,980 about medical devices can be anything connected to to to the access point. Keep in mind that this 70 00:07:11,980 --> 00:07:15,420 device connects to an access point so if you are able to break to the Internet then this is 71 00:07:15,420 --> 00:07:21,000 access point through this device you can get access to the network also. And obviously the 72 00:07:21,000 --> 00:07:25,940 most important thing that I I think is is the case here is is the human right? If you find a 73 00:07:25,940 --> 00:07:33,260 way to alter the behavior then you can be eh infusing liquid that can harm a human which is 74 00:07:33,260 --> 00:07:38,980 something that we don't wanna I know. I don't know if I'm not a doctor but probably you can 75 00:07:38,980 --> 00:07:45,180 kill them I I don't know probably. Eh okay main challenge is very important to mention that 76 00:07:45,180 --> 00:07:50,000 these guys it's a black box we just get it eh we just get it in in the package we don't know 77 00:07:50,000 --> 00:07:56,120 what it is we started working on it eh we realized that eh in order to interact with this guy 78 00:07:56,120 --> 00:08:01,200 it runs a real time operating system I'm gonna talk about that eh but just to debug it it's a 79 00:08:01,200 --> 00:08:07,400 $5,000 debugger so and plus it doesn't work through JTAG this guy supports JTAG I wanna talk 80 00:08:07,400 --> 00:08:13,120 about that eh but in order to interact with this you need to have a Ethernet connection to 81 00:08:13,120 --> 00:08:15,160 the board and it costs $5,000. 82 00:08:15,180 --> 00:08:22,200 $5,000 even with this guy we cannot interact with the debugger that is developed by INEA eh it 83 00:08:22,200 --> 00:08:27,620 comes with a image Linux image retail real time operating system fully stripped binary so that 84 00:08:27,620 --> 00:08:38,440 means that you won't see eh anything like here is 35-ish thousand functions only numbers eh 85 00:08:38,440 --> 00:08:44,140 there is nothing no functions names you don't know anything about it it's ARM so eh it's very 86 00:08:44,140 --> 00:08:44,960 good good eh. 87 00:09:05,060 --> 00:09:12,220 Okay so let's talk quickly about the architecture so this guy runs an Intel X-scale this is very 88 00:09:12,220 --> 00:09:15,160 funny because X-scale was from Intel then Intel sold it to JTAG so this guy runs an Intel X-scale 89 00:09:15,160 --> 00:09:20,220 that was run to MARVEL eh and it was present to run a strong ARM but then they switch it to ARM40 90 00:09:20,220 --> 00:09:25,020 which is eh the version that is running right now eh it has models that run with the system on 91 00:09:25,020 --> 00:09:32,360 a on a chip which is just as a small chip running everything inside eh here is the datasheet eh so 92 00:09:32,360 --> 00:09:38,460 but basically this guy is able to run Windows and Linux because at it was based on Intel and 93 00:09:38,460 --> 00:09:45,020 then switched into the into the uh ARM architecture. Here's a little bit of details of the of this 94 00:09:45,020 --> 00:09:45,140 data sheet so but it's basically this guy is able to run Windows and Linux because it was based on 95 00:09:45,140 --> 00:09:50,660 uh uh internals. So here is the JTAG that I mentioned so that you can interact with the 96 00:09:50,660 --> 00:09:55,680 processor uh but unfortunately uh with that debugger that I mentioned you cannot do it 97 00:09:55,680 --> 00:10:01,080 through JTAG. Uh here is the PC card this is very important guys inside of the pump uh 98 00:10:01,590 --> 00:10:07,340 probably you will see it here in a second. It uses this uh small compact flash card. That 99 00:10:07,340 --> 00:10:14,000 compact flash card as as you can see is is mentioned here. So that one is gonna be able to 100 00:10:14,000 --> 00:10:19,240 uh to boot the operating system. The operating system is inside that card which means uh you 101 00:10:19,240 --> 00:10:25,560 can you can play around it. We will see how. Uh obviously it has LCD, it has uh RAM, it has 102 00:10:25,560 --> 00:10:35,660 DRAM and it has a flash uh RAM also that uh we we will see how we can play with that. Okay. So 103 00:10:37,080 --> 00:10:43,060 this it runs what is called real time operating system. A real time operating system is uh a 104 00:10:43,060 --> 00:10:43,980 system that needs to be uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh 105 00:10:43,980 --> 00:10:49,180 needs to support uh deadlines. Which means for example a really good example is an airbag in 106 00:10:49,180 --> 00:10:53,800 the car right? So if there is uh something in the car that the airbag needs to be triggered 107 00:10:53,800 --> 00:10:59,560 right away it must be done immediately. That it cannot be a delay of one or two seconds. It 108 00:10:59,560 --> 00:11:05,420 must be on real time. That's the reason of this architectures that airbags or AVS in the cars 109 00:11:05,760 --> 00:11:12,000 or those specific critical uh systems uh they need to react right away. That's the purpose of 110 00:11:12,000 --> 00:11:13,220 real time operating systems. 111 00:11:13,980 --> 00:11:19,180 Uh this specific company INEA is the creator of this real time system. It's a Linux based ARM 112 00:11:19,180 --> 00:11:26,040 system and it it is all around. It is in medical, it is in uh industry, it is in uh automotive, it 113 00:11:26,040 --> 00:11:33,560 is all around different industries. Uh industrial CS also. Uh and as I said it must meet a 114 00:11:33,560 --> 00:11:40,640 deadline otherwise it's a problem. Uh another details uh this specific architecture only one 115 00:11:40,640 --> 00:11:43,240 process run at a time. We will see that in a second. 116 00:11:44,200 --> 00:11:48,960 And here is a second thing that I found inside which is called flash effects. This is a genetic 117 00:11:48,960 --> 00:11:53,400 block device driver which is basically the interface between the system and the hardware. 118 00:11:54,280 --> 00:11:59,980 But the good thing about this from security perspective is that this specific flash driver 119 00:12:00,580 --> 00:12:07,400 allows you to talk to the flash which is in the chip as a as a normal uh mount drive. So which 120 00:12:07,400 --> 00:12:13,820 means uh this facility allow you to easily play with the flash instead of doing it uh in a in a in a 121 00:12:13,820 --> 00:12:20,900 hardware. Obviously as expected the flash stores sensitive information like credentials to get 122 00:12:20,900 --> 00:12:24,680 access to the network, to get access to the access points. So this is something that's stored in 123 00:12:24,680 --> 00:12:30,720 those kind of uh flash as usual. Very interesting there is a file system manager called 124 00:12:30,720 --> 00:12:36,940 Tequila. So I don't know why they call it that way but it it and I Google it there is no 125 00:12:36,940 --> 00:12:43,700 information about that Tequila but basically it's just uh file system manager for this flash effects. So that really 126 00:12:43,700 --> 00:12:43,780 I don't know why they call it that way but it it and I googled it there is no information about that Tequila but basically it's just a file system manager for this flash effects. So that really 127 00:12:43,820 --> 00:12:49,960 motivates me when I was doing this research because uh it's for Mexico you know right Tequila? 128 00:12:52,000 --> 00:12:57,300 Ok here is the Compact Flash Card. This is the card that I mentioned is inside the 129 00:12:57,300 --> 00:13:06,580 pump. This guide that you are seeing there is right here it is this exactly inside it is the flash, the Compact 130 00:13:06,580 --> 00:13:13,800 Flash this is exactly this one uh and it runs as I said the INEA OC system it stores eh a metal 131 00:13:13,820 --> 00:13:19,380 medical, medical information like the profiles of the different um, um, patients, like the 132 00:13:19,380 --> 00:13:26,200 medications per patient, uh, and here is some content, uh, obviously some of it I removed, 133 00:13:26,480 --> 00:13:32,320 it has some firmware there. Here is the, uh, binary, the elf binary that I told, talked to 134 00:13:32,320 --> 00:13:37,360 you, the real time operating system. This guy comes with a kernel and the application 135 00:13:37,360 --> 00:13:43,140 running this guy. So this has a, it's a 7 megabyte file, fully stripped symbols, so you 136 00:13:43,140 --> 00:13:48,160 can imagine it's very hard to, to, to deal with it. Uh, here is more information about the 137 00:13:48,160 --> 00:13:53,440 patient profiles, uh, some information about the configuration of the, of the, of the, of the 138 00:13:53,440 --> 00:13:58,940 pump. And here is the autorun. This guy, this autorun, when this guy boots, it will read the 139 00:13:58,940 --> 00:14:05,860 autorun and then will execute whatever it is inside. Okay, so, the autorun, it stores the 140 00:14:05,860 --> 00:14:10,680 command to, to boot up this guy, right? So since we have access to the flash card, we can play 141 00:14:10,680 --> 00:14:11,820 with that. So, 142 00:14:14,040 --> 00:14:19,360 integrity check, which means that when you run this operating system, it will do an integrity 143 00:14:19,360 --> 00:14:23,720 check to make sure it's not altered. And here is the first vulnerability that we found, a way 144 00:14:23,720 --> 00:14:28,600 to bypass integrity check. At this point, we cannot release the details, but the main thing is 145 00:14:28,600 --> 00:14:36,720 that we can alter that Linux binary. We can alter it and then start playing with it. What are 146 00:14:36,720 --> 00:14:42,420 the consequences of that? So I prepared a quick demo for you guys so that you can see how 147 00:14:42,420 --> 00:14:50,100 it should work. So what I'm going to do is I'm going to switch. This is the original compact 148 00:14:50,100 --> 00:14:58,100 flash card. And I'm going to just switch it with this one. This one comes with the bypass of 149 00:14:58,100 --> 00:15:02,540 that real-time operating system. It comes with some modifications. Let's see what are those 150 00:15:02,540 --> 00:15:12,400 modifications and what would be the consequence. So you need to plug this in very carefully. 151 00:15:14,960 --> 00:15:22,980 Because otherwise it won't run and I already burned many different cards. So let's start it up. 152 00:15:24,980 --> 00:15:32,100 Probably you can see something around it. So the first thing that you can change is just the boot 153 00:15:32,100 --> 00:15:37,080 up. Here is where you can put a ransomware message. That's obviously one-on-one case, right? 154 00:15:37,180 --> 00:15:42,400 You can put a ransomware, pay me Bitcoin money and then it doesn't boot up and then you get the 155 00:15:42,420 --> 00:15:46,780 scared people, it doesn't work and then you can start playing with that. So that's because we 156 00:15:46,780 --> 00:15:58,420 modify the boot process. Now, once inside, one of the things that is very important is here in 157 00:15:58,420 --> 00:16:07,380 the options. In order to see the network status of the pump, you need to enter a pin number. 158 00:16:07,380 --> 00:16:13,820 By default, if you go and Google it, it's 32211 or something like that. It's the default one. 159 00:16:13,980 --> 00:16:19,000 But since we are able to modify it, we can change it to whatever we want. So for example, my 160 00:16:19,000 --> 00:16:26,660 number, my favorite number is 777. So I just change it to 777 here. And I don't care what is the 161 00:16:26,660 --> 00:16:32,240 number, right? Because I just go, go to the image, find that specific pin where it's stored and 162 00:16:32,240 --> 00:16:37,360 you just replace it with whatever I want. And that gives you access to the network status. So you can 163 00:16:37,380 --> 00:16:43,420 see here that the pump is trying to associate with a default Wi-Fi, right? So it's something 164 00:16:43,420 --> 00:16:48,960 that is already inside. It's already in the ROM. We cannot touch it. We cannot change it. But at 165 00:16:48,960 --> 00:16:54,300 least we know the SSID. Later we can see how we can modify this. So this is another example, 166 00:16:54,480 --> 00:16:59,840 right? You can change pin numbers. You can change sensitive access to the pump. But let me show 167 00:16:59,840 --> 00:17:07,220 you the most interesting one. So if you remember the infusion pump, right, when it is the 168 00:17:07,380 --> 00:17:17,840 top, when you put the rate and you put the volume to be infused. So let's do it again. So here, 169 00:17:18,340 --> 00:17:24,260 if you notice something different, I just put it purposely. I just changed to Primera in 170 00:17:24,260 --> 00:17:30,080 Spanish, the front, the form. Just to show you that you can change this front. But not only 171 00:17:30,080 --> 00:17:37,240 that. Because I can change the screens. I can, what I did, I switched between the rate and the 172 00:17:37,380 --> 00:17:44,700 VTI. So basically the rate is in the bottom and the VTI is in the up. You see that? So what 173 00:17:44,700 --> 00:17:51,660 that means is that if someone comes and, and let's do it again. Someone comes and they want to 174 00:17:51,660 --> 00:17:56,740 prepare the infusion, they're going to say okay let me enter the rate and I don't know let's say 175 00:17:56,740 --> 00:18:06,940 50. And then they are going to say okay so the duration might be 3 hours for example. So what is 176 00:18:06,940 --> 00:18:12,740 happening here is that we are entering the rate but the rate is actually the VTI. And the VTI is 177 00:18:12,740 --> 00:18:22,400 the rate. You know what I mean. So we swap it. So check it out when I say start. It says 50 here 178 00:18:22,400 --> 00:18:30,340 but it's actually infusing 14. So because it got confused and then what you are infusing is not 179 00:18:30,340 --> 00:18:35,460 exactly what the pump is trying to infuse. Also if you notice something that, I didn't test it yet. 180 00:18:35,460 --> 00:18:41,260 when we did it properly it was giving us an error, right? It was flashing. Right now it's 181 00:18:41,260 --> 00:18:46,700 not flashing. It's working. So I cannot do it in humans but if it is a volunteer we can test 182 00:18:46,700 --> 00:18:52,740 it and we can see what happened. But the point here is that because we can modify the 183 00:18:52,740 --> 00:18:58,620 integrity of the Linux system, we can play with the also with the forms and then we can 184 00:18:58,620 --> 00:19:04,100 change them and the infusion pump at the end is going to do whatever we want but as you can 185 00:19:04,100 --> 00:19:13,000 see here, it is in the opposite way. Let me just put this back. So these are just some 186 00:19:13,000 --> 00:19:18,060 examples of what you can do. Obviously if you have time we can change everything. We can 187 00:19:18,060 --> 00:19:26,280 change the front end so that you can do that. So here is what I said. This is the modified 188 00:19:26,280 --> 00:19:34,080 version and here is the original one. One second. This is the original version. So 189 00:19:38,360 --> 00:19:42,360 this is the original version. Okay. So here you can see guys in the right side is the original 190 00:19:42,360 --> 00:19:48,860 version. You remember it was the right here, the VTVI and here is the way it works. In the 191 00:19:48,860 --> 00:19:53,840 right side I just changed this title just to make it evident. But the most important thing is 192 00:19:53,840 --> 00:19:58,980 here, the swap here. I changed the VTVI for the RAID which means the person who is entering 193 00:19:58,980 --> 00:20:04,080 here is entering the opposite way. So that way is going to influence the behavior of the 194 00:20:04,100 --> 00:20:13,080 pump. And that's just because of the integrity. Okay? So let's move to the next one. So here is 195 00:20:13,080 --> 00:20:21,020 some commands that are found that you can use. It's basic Unix related commands but those 196 00:20:21,020 --> 00:20:26,880 Unix commands can help you to do a lot of stuff. So you can, you can do mem copies, you can do 197 00:20:26,880 --> 00:20:34,080 formats, you can do memdoms, you can, you can dump the flash, you can run the, you can run the 198 00:20:34,100 --> 00:20:39,520 LTE. And this one, this guy specifically here is rex scripting language. I don't know you guys 199 00:20:39,520 --> 00:20:44,880 heard of rex scripting language before. It's like a Perl but I never heard before. It's one of 200 00:20:44,880 --> 00:20:51,180 those weird things running in this kind of device. But that one can help us to actually do more 201 00:20:51,180 --> 00:20:57,300 stuff because we don't need to play with ASM assembly. We can play with just Perl script like 202 00:20:57,300 --> 00:21:04,080 Perl script. Here is what I was telling you. This is the process running inside. As you can see, 203 00:21:04,080 --> 00:21:09,940 there is just one process running at a time. When I run PS, it is the one running right now and 204 00:21:09,940 --> 00:21:17,860 other ones are in receiving or delay mode. Here is the PXCA status that I show you. We confirm 205 00:21:17,860 --> 00:21:24,400 that it is an ARM system. It is in supervisor mode. It is the Intel manufacturer even though 206 00:21:24,400 --> 00:21:32,640 now it's Marvel and the version. And here is the most important thing guys. So we found that we 207 00:21:32,640 --> 00:21:40,680 found a way to read the flash without using any chip related. Okay? That's very important 208 00:21:40,680 --> 00:21:46,420 because it is here. In the chip we identified that in the left side there is all the credentials to 209 00:21:46,420 --> 00:21:52,240 connect. This guy talks to a server in order to do hard bits and in order to exchange information. 210 00:21:52,520 --> 00:22:00,920 So that is here and it is in plain text. The AES key is plain text. The credentials are there. 211 00:22:00,920 --> 00:22:08,880 So which means you can use this to decrypt information from this guy and the server. But also in the 212 00:22:08,880 --> 00:22:15,120 right side we can see you remember the WiFi configuration is here. So that means is that we 213 00:22:15,120 --> 00:22:21,800 know what is the credentials and then we can do two things. We're going to describe that. But by 214 00:22:21,800 --> 00:22:30,000 doing this information we cannot change this guy but we can change it through our interaction. So 215 00:22:30,920 --> 00:22:36,480 the first thing that attacker can do obviously is to gain access to the network. So he knows the 216 00:22:36,480 --> 00:22:43,540 credentials. He knows the SSID. I just need to go and plug in to the radius. I just log in and get 217 00:22:43,540 --> 00:22:49,440 access to the same LAN segment where this guy is running. That's the first thing. And you can 218 00:22:49,440 --> 00:22:56,180 attack other hosts right? So you go and you retrieve the cards and WiFi information as we 219 00:22:56,180 --> 00:23:00,900 display the information. Then you connect to the corporate access point and then you can go and you can 220 00:23:00,920 --> 00:23:06,180 start reaching all the different assets within the network. That's the first thing. The second 221 00:23:06,180 --> 00:23:11,620 thing is man in the middle which means we can impersonate the access point. Since we know the 222 00:23:11,620 --> 00:23:19,640 configuration file and we find a way to override the ROM, the internal ROM memory, sorry, we can 223 00:23:19,640 --> 00:23:27,360 reconfigure this guy and say hey don't forget about that. Connect to me. As I said there are from 224 00:23:27,360 --> 00:23:30,900 400 to 1,000 of these devices that are connected to the network. So you can start reaching all the 225 00:23:30,920 --> 00:23:36,460 data in a network. So you can either man in the middle them or you can just ask them to talk to 226 00:23:36,460 --> 00:23:42,000 you so that you can start decrypting the information. So this would be the scenario, right? 227 00:23:42,080 --> 00:23:47,480 So you have the ROC IP. You reconfigure them and then you can actually ask them to talk to you. 228 00:23:47,520 --> 00:23:53,740 Either by using the same SSID so that they reach out to you if you are closest to the access 229 00:23:53,740 --> 00:24:00,900 point. Or you can just replace the full WiFi configuration. So let's see how this works. Let's 230 00:24:00,920 --> 00:24:06,040 see how that works. So that's going to be my last demo. So I'm going to replace again. This is 231 00:24:06,040 --> 00:24:10,480 the flash card. This flash card what it's going to do is at boot time it's going to go and replace 232 00:24:11,040 --> 00:24:18,660 the configuration of the WiFi and to put our own configuration. And in the left side I have a 233 00:24:18,660 --> 00:24:24,540 router which is already configured with our own access point. And the intention is that this guy 234 00:24:24,540 --> 00:24:30,900 is going to connect to us. Let's see. I'm going to connect to this guy. I'm going to connect to 235 00:24:32,900 --> 00:24:56,880 this guy. So we just flip this guy. Give me one second. So normally if you don't connect 236 00:24:56,880 --> 00:25:00,900 this properly, the WiFi is going to just switch off. So I'm going to connect to this guy. And I'm 237 00:25:00,920 --> 00:25:05,300 going to stop working. It's a lot of problems. So hopefully it works now. So I'm going to turn 238 00:25:05,300 --> 00:25:11,060 this guy on. And then it's going to start booting up. During the boot up process it's going to 239 00:25:11,060 --> 00:25:15,300 replace the configuration file. And probably you don't see at the beginning it says if you 240 00:25:15,300 --> 00:25:30,900 remember the SSID was default. So let's see now. So it's a little bit more complicated. So 241 00:25:30,920 --> 00:25:43,080 the same thing. Let me show you the WiFi configuration. Again it asks us for the access. 242 00:25:43,240 --> 00:25:52,500 We already replaced it. You can see that now it's trying to authenticate the SIM box inside. Which 243 00:25:52,500 --> 00:25:59,540 means we replaced the configuration with our own one. And now if we have an access point with 244 00:26:00,920 --> 00:26:05,840 our radius, it will connect to us. So let me do it right now. So I have here my access point with 245 00:26:05,840 --> 00:26:10,520 my radius. What is going to happen is that as soon as I boot it up, it's going to say associated 246 00:26:10,520 --> 00:26:30,680 here. Let's see. So we have here. So here is my radius. The radius is running now. It's going to 247 00:26:30,680 --> 00:26:30,900 stop working. So I'm going to stop working. So I'm going to stop working. So I'm going to stop 248 00:26:30,920 --> 00:26:36,560 processing request. It's going to take some seconds to hopefully get this guy authenticated 249 00:26:36,560 --> 00:26:42,920 because he's retrying and retrying and retrying. So let's see if it pick it up there. It's going to 250 00:26:42,920 --> 00:26:58,800 take like probably 10 seconds around. Or 15. Or 20. Let's see. Oh, what is this? It is 251 00:26:58,800 --> 00:27:00,900 authenticating. Yeah. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. 252 00:27:00,920 --> 00:27:11,540 Okay. It's ranked disassociated. Let me check something. Let me just quickly check if I am 253 00:27:11,540 --> 00:27:30,900 connected to the the pump. There. Yeah, it's there. Okay, so now it's working. And bring the 254 00:27:30,900 --> 00:27:38,040 okay let's see. Okay it is now it's receiving information and uh it's associated you see 255 00:27:38,040 --> 00:27:44,200 that here? It says associated and now let's go to the net address and I got a an address 256 00:27:44,200 --> 00:27:48,740 that I assigned to the to the POM. So at this point it is not stable you can see it is 257 00:27:48,740 --> 00:27:53,120 flipping it's gonna get the access access the IP once again and again because it is trying to 258 00:27:53,120 --> 00:27:57,160 connect to the to the server. Since it is not server it is trying to authenticate again and 259 00:27:57,160 --> 00:28:01,120 again and again but as you can see we are giving it the IP address. So as soon as we have 260 00:28:01,120 --> 00:28:06,560 established connection with the server so we are able to just replace whatever we want and 261 00:28:06,560 --> 00:28:10,240 then take it to us do money in the middle but at the end of the day the most important thing 262 00:28:10,240 --> 00:28:16,620 here is that we can uh fully replace the the the configuration store in in in the internal RAM. 263 00:28:23,220 --> 00:28:27,140 Okay. So this is what we just saw. So we have the IP address and we have the IP address. 264 00:28:27,160 --> 00:28:35,220 Uh we saw that uh we got associated and we got the IP address so which is is uh confirmed 265 00:28:35,220 --> 00:28:40,880 that we can replace it. Uh find the summary uh we talk about the integrity check by pass where 266 00:28:40,880 --> 00:28:45,380 we can change the forms we can change the pin numbers and we can keep playing right? It's up 267 00:28:45,380 --> 00:28:52,840 to us to whatever we wanna change because at that point the the file can be altered. Uh we talk 268 00:28:52,840 --> 00:28:57,140 about changing those settings of course the wifi settings. We talk about uh uh uh uh uh uh uh 269 00:28:57,140 --> 00:29:04,920 changing the infusion set up uh to affect the clients you know change the VTVI with the rate 270 00:29:04,920 --> 00:29:10,740 and that can confuse execute commands in the internal shell uh which can be used to destroy 271 00:29:10,740 --> 00:29:16,800 this guy completely uh and impersonate obviously the access point with our own or either we 272 00:29:16,800 --> 00:29:23,060 impersonate it or we just put our own so that they can connect to us. Uh and override the flash 273 00:29:23,060 --> 00:29:27,120 memory internal one as I said which means it's persistent. So my job is to make sure that my 274 00:29:27,140 --> 00:29:32,880 change that I do here since it goes in the internal RAM that means that if someone comes and 275 00:29:32,880 --> 00:29:39,840 just get this guy out and load a new compact flash card the change remains because it's stored 276 00:29:39,840 --> 00:29:47,760 in the in in the internal RAM. It's persistent. And you're gonna say okay so this is physical 277 00:29:47,760 --> 00:29:54,400 access. Yes it's physical access but just talk about let's think about some examples. The ATM's 278 00:29:54,400 --> 00:29:57,120 they are always hacked. Physical access. Uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh 279 00:29:57,140 --> 00:30:03,680 ah technically. And it is uh five hundred million dollars being stolen and it keeps doing it. 280 00:30:03,760 --> 00:30:08,720 So which means is that uh and also another thing is that this just takes two seconds, two 281 00:30:08,720 --> 00:30:14,020 minutes and five seconds to boot it up so you can sweep the the compact flash card. But the most 282 00:30:14,020 --> 00:30:18,000 important thing guys is that we need to assume that it's gonna be physical attack. So we don't 283 00:30:18,000 --> 00:30:22,000 we don't need to say oh it is a physical attack like that doesn't work. It's the internal the 284 00:30:22,000 --> 00:30:26,760 insider threads are more bigger than the outsiders. And also we need to assume 285 00:30:26,760 --> 00:30:31,300 someone is going to get access here. If we assume that someone has physical access, we need to 286 00:30:31,300 --> 00:30:37,320 think about how we can protect these guys. That's the main point. Next steps, this is just a 287 00:30:37,320 --> 00:30:41,800 starting point. Obviously now we got, we got the associated point, we have an IP address, we 288 00:30:41,800 --> 00:30:46,700 can talk to this guy. So our next step in this research is now the remote attacks to start 289 00:30:46,700 --> 00:30:52,220 playing with remote information. That's our next phase. We can play with the RECs, scripting 290 00:30:52,220 --> 00:30:57,940 language that I said to help us to create rats or reverse shells. I found actually an 291 00:30:57,940 --> 00:31:03,300 implementation of this RECs scripting language that is running this guy. One guy already 292 00:31:03,300 --> 00:31:09,060 implemented it in an IBM mainframe. So it's totally doable. This is called hooking, that's 293 00:31:09,060 --> 00:31:14,540 very advanced because this guy doesn't have symbols. So but what you can do here is that you 294 00:31:14,540 --> 00:31:19,600 can intercept the calls of the VTI, the rate, and in memory change it on the fly which is 295 00:31:19,600 --> 00:31:22,200 very hard but it's possible with time. We're going to try to do that. 296 00:31:22,220 --> 00:31:29,300 And finally uh we're going to understand that this CMP protocol, this CMP protocol talks 297 00:31:29,300 --> 00:31:34,780 from with the pump and with the server. We're going to try to understand it and see how it 298 00:31:34,780 --> 00:31:39,820 works and decode it. And uh and that's pretty much it guys. Uh thank you so much.