Thanks. Thanks for coming. So let's get started. Okay so my name is Den Regalado and
we're going to be talking about an infusion pump. We can see it here. Let's talk about the
disclaimer first. This is just for educational purposes. All the vulnerabilities that we
identified we discussed with the vendor. They are committed to a 360 days fix. They work with
us pretty close. They respond right away so I really appreciate the vendor around it. And we
cannot disclose those details. We will show obviously the demos but once the vendor is ready
with the fixes we can then publish the details. A little bit about us. We are Simbox. We are an
IoT security company. I work there as a principal security researcher and have the greater
uh blessed to be part of of great hacking book as a co-author and I'm running the um hack
defender uh academy. Okay so we're going to be talking about uh the infusion pump overview so
I'm going to give you guys a quick demo of how it works uh in case you don't know and why we
picked this specific medical device the pump uh what is the attacker's goal, the challenges during
the investigation, uh the potential vulnerabilities uh obviously uh we're going to be giving
you demos. So uh the, the infusion pump is, first of all is very expensive eh it's more than
$1000 and you can imagine uh hospital we can see around four, from 400- to 1000 of is guys
sitting in a facility. Uh all of them connected. We'll see the details. Uh it is used to deliver
fluids, medications, blood, etc. to the adults, pediatric and neonatal patients. So it just
goes all around the hospital and then they just plug this guy, I'm going to show you in a
second. So you will see a back, you know, and then the other side this is going to be
connected through the human arm and they're going to start doing the fluids and it's
automated and that's the main thing that you can program and say, okay, 50 milliliters for the
next two hours, you leave it there and it's going to start feeding the liquids and if there is
some issues, can you imagine that, for example, if it is insulin and it's request to have 100
milliliters, let's say, and for some reason it's just giving 50 milliliters, it's not enough, so
the patient is going to be not doing good in health or in the opposite side, if you put more
than expected, it's also something that you don't want to have.
Okay, thank you.
So let me just quickly show you, I'm going to be switching back and forth here. I just want to
turn it on and show you how it works. So these are the main components I'm going to describe, all
of them. This is the main unit. This is running the operating system. We're going to talk about
the operating system. In the left side is the actual pump. So this pump, this guy is the one
who's going to have the back with the liquid and then in the other side you are going to have
the, the, the connecting to the, to the patient. Okay? Let's just turn it on. It's going to be
hard for you guys to see it, but at least so that you have an idea, I'm going to put it in the
back so that we can also talk about details. So I'm going to boot it up. This specific pump, you
can have two in each side, so you can program many different infusions. And once it boots up, it is
pretty simple. It's going to ask you for a new patient. You are going to see these devices going
all around the hospital and then eventually if it is a new patient, you say yes, a new patient. You
create a new profile. Or if it is not a new patient, it will load you the profile of that
specific person with all the medication listed for that guy. And then it has some options here,
obviously, to go around and, and to do some configurations. It's really, really limited. You cannot
change anything here. You need an external software connected to a serial cable to do some
changes. So for example, Wi-Fi connection has a Wi-Fi card in the back. And that's something that
you need to do through a software. You cannot do it here. This is just read only. But let's go to
the example of, um, of an infusion. Okay? So the, the person is going to come and is going to
click here. Is going to say, okay, what I'm going to do, let's do a basic infusion. So then he
is going to put very important the rate uh milliliters per hour. And then you are going to put
the V.T.V.I. which is the volume to be infused. Liquid to be infused. And just, just to, to do
some quick test. So let's say we, we put fifty. And then here we put uh a total of two hundred.
And then we click start. And then the infusion pump start working. And that infusion pump is
going to start feeding those fifty.
per hour in a total of 200, total amount 250 per hour. That's pretty simple. That's
obviously not working because we don't have the back but that's the basic idea of the
functionality. Let me just, I'm going to turn it on, turn it off, sorry. So that's the main
functionality of a pump. So let's see what we can do in a malicious way. So let's see what
we can do. While we pick infusion pumps it is expected to be worth 10 billion by 2020 year in
the market. So that means there's going to be explosion of these pumps so it's important for us
to understand what is inside. This specific device is one of the leaders in the world so that
means you can find it everywhere. Next time when you go to the hospital you will see it. It's
important to properly identify vulnerabilities. So what is the attacker's goal of this guy?
Right? So obviously if there is sensitive information inside like PII data so like you know
congressman which is dealing with cancer or unfortunately the congressman that is dealing
with brain cancer right now so you don't want to know about that right? But someone breaks into
this they can use it in a malicious way. And hijack devices of course this can be also
ransomware based, its running in a Linux, we will see details of that so you can hijack it, you
can ask for ransomware and obviously you can disrupt it so it doesn't work anymore, the patient
doesn't get attended and its bad. And of course you can also use the pump to break into the
LAN. So this can be a breach to break into a network and from there to the whole devices. Not
about medical devices can be anything connected to to to the access point. Keep in mind that this
device connects to an access point so if you are able to break to the Internet then this is
access point through this device you can get access to the network also. And obviously the
most important thing that I I think is is the case here is is the human right? If you find a
way to alter the behavior then you can be eh infusing liquid that can harm a human which is
something that we don't wanna I know. I don't know if I'm not a doctor but probably you can
kill them I I don't know probably. Eh okay main challenge is very important to mention that
these guys it's a black box we just get it eh we just get it in in the package we don't know
what it is we started working on it eh we realized that eh in order to interact with this guy
it runs a real time operating system I'm gonna talk about that eh but just to debug it it's a
$5,000 debugger so and plus it doesn't work through JTAG this guy supports JTAG I wanna talk
about that eh but in order to interact with this you need to have a Ethernet connection to
the board and it costs $5,000.
$5,000 even with this guy we cannot interact with the debugger that is developed by INEA eh it
comes with a image Linux image retail real time operating system fully stripped binary so that
means that you won't see eh anything like here is 35-ish thousand functions only numbers eh
there is nothing no functions names you don't know anything about it it's ARM so eh it's very
good good eh.
Okay so let's talk quickly about the architecture so this guy runs an Intel X-scale this is very
funny because X-scale was from Intel then Intel sold it to JTAG so this guy runs an Intel X-scale
that was run to MARVEL eh and it was present to run a strong ARM but then they switch it to ARM40
which is eh the version that is running right now eh it has models that run with the system on
a on a chip which is just as a small chip running everything inside eh here is the datasheet eh so
but basically this guy is able to run Windows and Linux because at it was based on Intel and
then switched into the into the uh ARM architecture. Here's a little bit of details of the of this
data sheet so but it's basically this guy is able to run Windows and Linux because it was based on
uh uh internals. So here is the JTAG that I mentioned so that you can interact with the
processor uh but unfortunately uh with that debugger that I mentioned you cannot do it
through JTAG. Uh here is the PC card this is very important guys inside of the pump uh
probably you will see it here in a second. It uses this uh small compact flash card. That
compact flash card as as you can see is is mentioned here. So that one is gonna be able to
uh to boot the operating system. The operating system is inside that card which means uh you
can you can play around it. We will see how. Uh obviously it has LCD, it has uh RAM, it has
DRAM and it has a flash uh RAM also that uh we we will see how we can play with that. Okay. So
this it runs what is called real time operating system. A real time operating system is uh a
system that needs to be uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh
needs to support uh deadlines. Which means for example a really good example is an airbag in
the car right? So if there is uh something in the car that the airbag needs to be triggered
right away it must be done immediately. That it cannot be a delay of one or two seconds. It
must be on real time. That's the reason of this architectures that airbags or AVS in the cars
or those specific critical uh systems uh they need to react right away. That's the purpose of
real time operating systems.
Uh this specific company INEA is the creator of this real time system. It's a Linux based ARM
system and it it is all around. It is in medical, it is in uh industry, it is in uh automotive, it
is all around different industries. Uh industrial CS also. Uh and as I said it must meet a
deadline otherwise it's a problem. Uh another details uh this specific architecture only one
process run at a time. We will see that in a second.
And here is a second thing that I found inside which is called flash effects. This is a genetic
block device driver which is basically the interface between the system and the hardware.
But the good thing about this from security perspective is that this specific flash driver
allows you to talk to the flash which is in the chip as a as a normal uh mount drive. So which
means uh this facility allow you to easily play with the flash instead of doing it uh in a in a in a
hardware. Obviously as expected the flash stores sensitive information like credentials to get
access to the network, to get access to the access points. So this is something that's stored in
those kind of uh flash as usual. Very interesting there is a file system manager called
Tequila. So I don't know why they call it that way but it it and I Google it there is no
information about that Tequila but basically it's just uh file system manager for this flash effects. So that really
I don't know why they call it that way but it it and I googled it there is no information about that Tequila but basically it's just a file system manager for this flash effects. So that really
motivates me when I was doing this research because uh it's for Mexico you know right Tequila?
Ok here is the Compact Flash Card. This is the card that I mentioned is inside the
pump. This guide that you are seeing there is right here it is this exactly inside it is the flash, the Compact
Flash this is exactly this one uh and it runs as I said the INEA OC system it stores eh a metal
medical, medical information like the profiles of the different um, um, patients, like the
medications per patient, uh, and here is some content, uh, obviously some of it I removed,
it has some firmware there. Here is the, uh, binary, the elf binary that I told, talked to
you, the real time operating system. This guy comes with a kernel and the application
running this guy. So this has a, it's a 7 megabyte file, fully stripped symbols, so you
can imagine it's very hard to, to, to deal with it. Uh, here is more information about the
patient profiles, uh, some information about the configuration of the, of the, of the, of the
pump. And here is the autorun. This guy, this autorun, when this guy boots, it will read the
autorun and then will execute whatever it is inside. Okay, so, the autorun, it stores the
command to, to boot up this guy, right? So since we have access to the flash card, we can play
with that. So,
integrity check, which means that when you run this operating system, it will do an integrity
check to make sure it's not altered. And here is the first vulnerability that we found, a way
to bypass integrity check. At this point, we cannot release the details, but the main thing is
that we can alter that Linux binary. We can alter it and then start playing with it. What are
the consequences of that? So I prepared a quick demo for you guys so that you can see how
it should work. So what I'm going to do is I'm going to switch. This is the original compact
flash card. And I'm going to just switch it with this one. This one comes with the bypass of
that real-time operating system. It comes with some modifications. Let's see what are those
modifications and what would be the consequence. So you need to plug this in very carefully.
Because otherwise it won't run and I already burned many different cards. So let's start it up.
Probably you can see something around it. So the first thing that you can change is just the boot
up. Here is where you can put a ransomware message. That's obviously one-on-one case, right?
You can put a ransomware, pay me Bitcoin money and then it doesn't boot up and then you get the
scared people, it doesn't work and then you can start playing with that. So that's because we
modify the boot process. Now, once inside, one of the things that is very important is here in
the options. In order to see the network status of the pump, you need to enter a pin number.
By default, if you go and Google it, it's 32211 or something like that. It's the default one.
But since we are able to modify it, we can change it to whatever we want. So for example, my
number, my favorite number is 777. So I just change it to 777 here. And I don't care what is the
number, right? Because I just go, go to the image, find that specific pin where it's stored and
you just replace it with whatever I want. And that gives you access to the network status. So you can
see here that the pump is trying to associate with a default Wi-Fi, right? So it's something
that is already inside. It's already in the ROM. We cannot touch it. We cannot change it. But at
least we know the SSID. Later we can see how we can modify this. So this is another example,
right? You can change pin numbers. You can change sensitive access to the pump. But let me show
you the most interesting one. So if you remember the infusion pump, right, when it is the
top, when you put the rate and you put the volume to be infused. So let's do it again. So here,
if you notice something different, I just put it purposely. I just changed to Primera in
Spanish, the front, the form. Just to show you that you can change this front. But not only
that. Because I can change the screens. I can, what I did, I switched between the rate and the
VTI. So basically the rate is in the bottom and the VTI is in the up. You see that? So what
that means is that if someone comes and, and let's do it again. Someone comes and they want to
prepare the infusion, they're going to say okay let me enter the rate and I don't know let's say
50. And then they are going to say okay so the duration might be 3 hours for example. So what is
happening here is that we are entering the rate but the rate is actually the VTI. And the VTI is
the rate. You know what I mean. So we swap it. So check it out when I say start. It says 50 here
but it's actually infusing 14. So because it got confused and then what you are infusing is not
exactly what the pump is trying to infuse. Also if you notice something that, I didn't test it yet.
when we did it properly it was giving us an error, right? It was flashing. Right now it's
not flashing. It's working. So I cannot do it in humans but if it is a volunteer we can test
it and we can see what happened. But the point here is that because we can modify the
integrity of the Linux system, we can play with the also with the forms and then we can
change them and the infusion pump at the end is going to do whatever we want but as you can
see here, it is in the opposite way. Let me just put this back. So these are just some
examples of what you can do. Obviously if you have time we can change everything. We can
change the front end so that you can do that. So here is what I said. This is the modified
version and here is the original one. One second. This is the original version. So
this is the original version. Okay. So here you can see guys in the right side is the original
version. You remember it was the right here, the VTVI and here is the way it works. In the
right side I just changed this title just to make it evident. But the most important thing is
here, the swap here. I changed the VTVI for the RAID which means the person who is entering
here is entering the opposite way. So that way is going to influence the behavior of the
pump. And that's just because of the integrity. Okay? So let's move to the next one. So here is
some commands that are found that you can use. It's basic Unix related commands but those
Unix commands can help you to do a lot of stuff. So you can, you can do mem copies, you can do
formats, you can do memdoms, you can, you can dump the flash, you can run the, you can run the
LTE. And this one, this guy specifically here is rex scripting language. I don't know you guys
heard of rex scripting language before. It's like a Perl but I never heard before. It's one of
those weird things running in this kind of device. But that one can help us to actually do more
stuff because we don't need to play with ASM assembly. We can play with just Perl script like
Perl script. Here is what I was telling you. This is the process running inside. As you can see,
there is just one process running at a time. When I run PS, it is the one running right now and
other ones are in receiving or delay mode. Here is the PXCA status that I show you. We confirm
that it is an ARM system. It is in supervisor mode. It is the Intel manufacturer even though
now it's Marvel and the version. And here is the most important thing guys. So we found that we
found a way to read the flash without using any chip related. Okay? That's very important
because it is here. In the chip we identified that in the left side there is all the credentials to
connect. This guy talks to a server in order to do hard bits and in order to exchange information.
So that is here and it is in plain text. The AES key is plain text. The credentials are there.
So which means you can use this to decrypt information from this guy and the server. But also in the
right side we can see you remember the WiFi configuration is here. So that means is that we
know what is the credentials and then we can do two things. We're going to describe that. But by
doing this information we cannot change this guy but we can change it through our interaction. So
the first thing that attacker can do obviously is to gain access to the network. So he knows the
credentials. He knows the SSID. I just need to go and plug in to the radius. I just log in and get
access to the same LAN segment where this guy is running. That's the first thing. And you can
attack other hosts right? So you go and you retrieve the cards and WiFi information as we
display the information. Then you connect to the corporate access point and then you can go and you can
start reaching all the different assets within the network. That's the first thing. The second
thing is man in the middle which means we can impersonate the access point. Since we know the
configuration file and we find a way to override the ROM, the internal ROM memory, sorry, we can
reconfigure this guy and say hey don't forget about that. Connect to me. As I said there are from
400 to 1,000 of these devices that are connected to the network. So you can start reaching all the
data in a network. So you can either man in the middle them or you can just ask them to talk to
you so that you can start decrypting the information. So this would be the scenario, right?
So you have the ROC IP. You reconfigure them and then you can actually ask them to talk to you.
Either by using the same SSID so that they reach out to you if you are closest to the access
point. Or you can just replace the full WiFi configuration. So let's see how this works. Let's
see how that works. So that's going to be my last demo. So I'm going to replace again. This is
the flash card. This flash card what it's going to do is at boot time it's going to go and replace
the configuration of the WiFi and to put our own configuration. And in the left side I have a
router which is already configured with our own access point. And the intention is that this guy
is going to connect to us. Let's see. I'm going to connect to this guy. I'm going to connect to
this guy. So we just flip this guy. Give me one second. So normally if you don't connect
this properly, the WiFi is going to just switch off. So I'm going to connect to this guy. And I'm
going to stop working. It's a lot of problems. So hopefully it works now. So I'm going to turn
this guy on. And then it's going to start booting up. During the boot up process it's going to
replace the configuration file. And probably you don't see at the beginning it says if you
remember the SSID was default. So let's see now. So it's a little bit more complicated. So
the same thing. Let me show you the WiFi configuration. Again it asks us for the access.
We already replaced it. You can see that now it's trying to authenticate the SIM box inside. Which
means we replaced the configuration with our own one. And now if we have an access point with
our radius, it will connect to us. So let me do it right now. So I have here my access point with
my radius. What is going to happen is that as soon as I boot it up, it's going to say associated
here. Let's see. So we have here. So here is my radius. The radius is running now. It's going to
stop working. So I'm going to stop working. So I'm going to stop working. So I'm going to stop
processing request. It's going to take some seconds to hopefully get this guy authenticated
because he's retrying and retrying and retrying. So let's see if it pick it up there. It's going to
take like probably 10 seconds around. Or 15. Or 20. Let's see. Oh, what is this? It is
authenticating. Yeah. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay.
Okay. It's ranked disassociated. Let me check something. Let me just quickly check if I am
connected to the the pump. There. Yeah, it's there. Okay, so now it's working. And bring the
okay let's see. Okay it is now it's receiving information and uh it's associated you see
that here? It says associated and now let's go to the net address and I got a an address
that I assigned to the to the POM. So at this point it is not stable you can see it is
flipping it's gonna get the access access the IP once again and again because it is trying to
connect to the to the server. Since it is not server it is trying to authenticate again and
again and again but as you can see we are giving it the IP address. So as soon as we have
established connection with the server so we are able to just replace whatever we want and
then take it to us do money in the middle but at the end of the day the most important thing
here is that we can uh fully replace the the the configuration store in in in the internal RAM.
Okay. So this is what we just saw. So we have the IP address and we have the IP address.
Uh we saw that uh we got associated and we got the IP address so which is is uh confirmed
that we can replace it. Uh find the summary uh we talk about the integrity check by pass where
we can change the forms we can change the pin numbers and we can keep playing right? It's up
to us to whatever we wanna change because at that point the the file can be altered. Uh we talk
about changing those settings of course the wifi settings. We talk about uh uh uh uh uh uh uh
changing the infusion set up uh to affect the clients you know change the VTVI with the rate
and that can confuse execute commands in the internal shell uh which can be used to destroy
this guy completely uh and impersonate obviously the access point with our own or either we
impersonate it or we just put our own so that they can connect to us. Uh and override the flash
memory internal one as I said which means it's persistent. So my job is to make sure that my
change that I do here since it goes in the internal RAM that means that if someone comes and
just get this guy out and load a new compact flash card the change remains because it's stored
in the in in the internal RAM. It's persistent. And you're gonna say okay so this is physical
access. Yes it's physical access but just talk about let's think about some examples. The ATM's
they are always hacked. Physical access. Uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh uh
ah technically. And it is uh five hundred million dollars being stolen and it keeps doing it.
So which means is that uh and also another thing is that this just takes two seconds, two
minutes and five seconds to boot it up so you can sweep the the compact flash card. But the most
important thing guys is that we need to assume that it's gonna be physical attack. So we don't
we don't need to say oh it is a physical attack like that doesn't work. It's the internal the
insider threads are more bigger than the outsiders. And also we need to assume
someone is going to get access here. If we assume that someone has physical access, we need to
think about how we can protect these guys. That's the main point. Next steps, this is just a
starting point. Obviously now we got, we got the associated point, we have an IP address, we
can talk to this guy. So our next step in this research is now the remote attacks to start
playing with remote information. That's our next phase. We can play with the RECs, scripting
language that I said to help us to create rats or reverse shells. I found actually an
implementation of this RECs scripting language that is running this guy. One guy already
implemented it in an IBM mainframe. So it's totally doable. This is called hooking, that's
very advanced because this guy doesn't have symbols. So but what you can do here is that you
can intercept the calls of the VTI, the rate, and in memory change it on the fly which is
very hard but it's possible with time. We're going to try to do that.
And finally uh we're going to understand that this CMP protocol, this CMP protocol talks
from with the pump and with the server. We're going to try to understand it and see how it
works and decode it. And uh and that's pretty much it guys. Uh thank you so much.