start	end	text
770	7390	All right, well welcome folks. It's my pleasure and honor to introduce some great friends of mine.
7390	12110	They are all hackers, and we have our moderator today. I'll do a brief introduction for him,
12110	17430	but first and foremost, welcome to the biohacking panel. How independent security researchers,
17430	22930	vis-a-vis hackers, work with MDMs, or that notorious medical device manufacturer. This
22930	28330	is the bad, the ugly, and the great, also affectionately known as bug. My name is the
28330	32710	Red Dragon 1949. You know me as the volunteer coordinator. But more importantly, I'd like to
32710	37130	introduce you to the panelists. First and foremost, ladies first, we have Veronica,
37130	43290	or Bea Schmidt. Yesterday was her birthday, so happy birthday Bea. She is a former federal law
43290	50130	enforcement in South Africa. She has done forensic investigations. She is a cardiac implant patient
50130	55890	three times, and she is doing some great forensic work for one of the MDMs that will be showcased
55890	62430	here at the Biohacking Village Medtronic. Welcome Bea. Second, we have Ms. Natalie Shuva.
62430	69290	She is the CEO for Sternum out of Tel Aviv, Israel. She comes to us from the UDIN 8200 of the
69290	74490	Israeli Defense Force. She can do things remotely with a mobile phone and the applications that are
74490	79870	fascinating and yet scary at the same time, so welcome Natalie. And then last but not least,
79870	85970	we have Mr. Peter Morgan out of San Diego, California. Mr. Morgan is quite,
85970	91110	how shall we say, effective at basically taking a medical device down to its very
91110	95630	fundamental binary level and doing things with it that would surprise you, not only from a
95630	101070	software and a firmware level, but certainly from a vulnerability exposure. He has notable
101070	104990	common vulnerabilities and exposures to his name associated with some Medtronic devices,
104990	110790	so welcome Peter. And then last but not least, our moderator, Mr. Kyle Erickson. He's the Director
110790	115670	for Product Security Engineering with the Cardiac Rhythm Heart Failure Business Division
115670	121530	at Medtronic out of Minneapolis, Minnesota. He has extensive breach and incident response
121530	127610	experience with one of the largest healthcare organizations here in the Minnesota area as well
127610	131930	as globally, so he has faced some of these individuals on the panel that he's going to
131930	136130	be moderating. So welcome, Mr. Erickson, and I will turn it over to you.
138030	143910	Thank you, Red Dragon, for those great introductions. I have the luxury to be here on the panel with
143910	149570	Pete, Natalie, and Vi, and I'm really excited to dig into their story and learn how they've
149570	154390	been working with medical device manufacturers, what medical device manufacturers can do better,
154390	159810	and what we're working on to improve in the industry. So I want to start out with an origin
159810	165630	story, and I'm going to start with Natalie. Natalie, what makes you a hacker, and how did
165630	173170	you really get involved in the security movement around medical devices? Yeah, well, I actually
173170	180810	don't refer to myself as a hacker, but I can tell you basically my story. I grew up with four big
180810	188910	brothers and started my undergraduate degree at the age of 14, computer science. It wasn't just
188910	193890	weird because I was 14, it was also weird because nobody in my family ever went to college or
193890	200910	something like that, so I was like the black sheep in the family. And once I graduated, then I just
201550	208730	started my period in the Israeli Unit A200, one of the elite technological units there,
208730	214850	and this is where I got exposed to cybersecurity, low-level development, and research and
214850	222730	exploitation in general. We did some significant things in the unit, handled the most advanced
222730	231690	techniques and technology, and after the period of time there, I wanted to keep using
231690	239350	cybersecurity to create impact. So during my time in Cetebrite, I did a lot of vulnerability research
239350	244810	and exploitation, mainly on Linux kernel and Android platforms, and I didn't consider it
245670	255290	as being a hacker, but mainly to provide evidence to stop pedophiles and human trafficking and stuff
255290	259930	like that, because using the vulnerabilities and exploitation, we were able to extract
260630	266790	forensics and basically evidence from the mobile devices, including encrypted ones.
266790	275730	So for me, it was the passion and the impact that such tools can create. And the medical device was
275730	283730	actually not a coincidence. I was always dreaming and thinking about becoming a doctor. So when I
283730	290250	finished my master's in computer science, I figured that this is like my last opportunity to go into
290250	296490	the medical industry. I thought about starting medical school, but with the knowledge I had
296490	302970	in cybersecurity, I met with a few friends and entrepreneurs, and one of them is my partner Boaz,
302970	309710	and we started thinking about medical devices and cybersecurity. And when I saw that remote care
309710	316090	and remote monitoring could have such a tremendous effect on our lives, and they were not
316090	323470	properly secure, this was something that attracted me tremendously, because I figured that creating
323470	330250	the right security to these devices could really improve patients' lives and improve quality of
330250	338750	care and treatment. And I saw how the knowledge that we have from the cybersecurity industry
338750	346270	could leverage this kind of technology. And this is what actually attracted me to Cofan External.
347230	351830	That's excellent. Obviously, you may not call yourself a hacker, but you have the tactics,
351830	360530	techniques, and capabilities. Correct. So, Vee, I'd like to go to you. And obviously, we know you have a unique story.
360530	366730	You're not only a hacker, a researcher, a goon, but you have implanted a medical device and refer to
366730	370730	yourself as a cyborg. So why don't you just give us a little bit more about your background and how
370730	375510	you've been getting more and more involved with medical device manufacturers in the industry.
377210	383330	Yeah, so I wasn't a very good hacker when I was a child. And I basically got caught changing
383330	389450	records at school, because I felt everyone should have a good year. Unfortunately, that led me down
389610	397070	a path that my parents weren't very proud of. But going back at the age of 18, I joined the
397070	401650	Special Emergency Learning Unit, which is a law enforcement agency that deals with cross-border
401650	408410	human trafficking, child pornography, some really nasty things. We actually made use of
408410	414070	Celebrite. So I'm very familiar with what Nati's referring to. And let me tell you, if you want to
414070	422250	get a physical image, those things that they develop are key. But at 19, I also had about
422250	428190	approximately two weeks left to live when I got my device implanted. And I know the quality of
428190	434130	life that it gave me. But since then, I was obsessed with what my device does, for the pure
434130	440950	fact that I believed in the saying, trust but verify. But I could never verify what was keeping
440950	447030	me alive. And that was the biggest, greatest frustration. I reached out to you guys about
447030	456490	three years ago, and I was met with the ugly part of Medtronic, sadly. I got met with the legal team.
457350	462970	And I felt that the conversation wasn't going very well. I remember these words, and
462970	467210	Tara, that used to work with you, knows this well. I said to them, well, if you want to bring your
467210	472950	lawyers to the table, I can do the same, and then we can have a conversation. But that's where it
472950	480710	ended. And in walks Biohack Village three years ago. Nina, being forever the master planner, put
480710	486770	me on the path for Bill. But then I came to severe loggerheads last year, because he could
486770	493670	not confirm to me that he was from Medtronic, even though I knew he was. And we went at it,
493670	500530	and we had our conversation. And fast forward a couple of months, I'm now finding my feet
500530	506710	within Medtronic and doing research into early detection. Because I didn't want to focus on the
506710	513170	problem. I wanted to find the problem and then solve it. So it's not just about whether the
513170	517770	device can be hacked. We all know everything can be hacked. But it's actually about having
517770	523730	some tangible evidence to deal with, to early detect and to mitigate it. For me, literally
523730	529570	close to my heart is the embedded implanted devices that are often misunderstood, forgotten
529570	536990	about. And these are the things that are connected to people, flesh and bones. And I just decided to
536990	542230	take this on and put my story out there and say, you know, these things are cool, but they're also
542230	546890	scary. But that doesn't mean we need to go burn the internet. It just means we need to do more
546890	554570	to make it safer. Absolutely. And we're glad that we can make some inroads there. I know it's been
554910	560590	a journey, to say the least. Pete, you've had a similar journey. I'd love to just kind of hear
560590	565850	your origin story and what got you interested in medical device security. And not only do you have
565850	570350	vulnerability discovery on your side, you've also looked at solutions and improving the problem. So
570350	577650	give us your background. Sure. So I started out as a kid learning how to hack video games and
577650	585150	change them before the advent of client mutual authentication. And that really got me hooked.
585430	590930	And as I grew up learning about software development, networking, reverse engineering,
591650	598050	exploitation, going forward into things like software-defined radio and actually understanding
598050	605010	RF better, it was kind of like I picked up these skills along the way. And as I was able to
605010	609990	escalate in a career path and get better jobs, I finally got into a spot where I was able to
609990	616190	affect what direction our team was going. And previously, I'd spent some time at a hedge fund
616950	620610	kind of protecting a billionaire, making sure their billionaire is still worth billions.
621030	624810	And there wasn't a ton of job satisfaction out of that other than the interest of
624810	632890	how that works. And I got a project at doing a small medical device in a consulting relationship.
632890	640410	And it was really neat because the problem set was really interesting from like the requirements
640410	644450	that how these devices operate, the conditions they have to operate in, the battery life,
644450	648750	processing power, all this kind of stuff gives really interesting constraints. But also,
648750	653130	when you make improvements to something like that, it has a direct impact on people's lives.
654310	658490	And it was a lot more interesting to work on those types of problems.
658490	664930	That's when I got kind of started just doing some research on some of the Medtronic gear and
664930	673190	was able to publish some vulnerabilities after maybe an ugly or bad initial interaction that
673190	678390	then turned quite positive. And then one of the things I'm most proud of, I think, is
679930	686490	having the patience to work through that process with Medtronic and then end up in a productive
686490	692430	working relationship where now I do get to work on solutions and help with fixing things,
692430	696890	not just identifying issues, sending a vulnerability report, and walking away.
696930	702090	So that's been really rewarding. Absolutely. And we thank all three of you. You've all been
702090	708150	influential in the journey here as MDMs have progressed and adapted and understood that
708150	713410	there's a problem but also looked to solutions. So Natalie, I want to come back to you. I have
713550	718210	a specific question and it's more around military-grade technology and techniques.
718210	723330	How do you think that can really help secure medical devices and the infrastructure and
723330	731710	hospital systems that they reside in? Yeah. Well, I think many times in the history,
731710	738770	we saw that the military developed one of the cutting-edge technologies in many areas
738770	743850	in the industry. And as part of it, I think that security techniques are also
744450	749770	well-developed within the military. And when you talk about military-grade security,
749770	755170	I think this is what we want for our medical devices, right? Because you don't want your
755170	762930	security camera to be protected the same way as your pacemaker. I think medical devices do require
762930	773210	some higher extent of security and deeper level of security. And I think what we see in the
773210	780930	military is wide range of attack scenarios and attack techniques and exploitation techniques.
780930	786810	And you realize that for me, at least, securing medical devices just by doing vulnerability
786810	794210	patching or penetration testing or avoiding hard-coded passwords, it was not enough because
794850	801710	I know and I'm familiar with how you can bypass those things pretty easily. And I think that
801710	809350	taking some of the knowledge and basically military-grade techniques can help you understand
809350	816550	the kind of holistic and comprehensive security that these devices deserve. And one of the things
816550	824270	that I think was significant in our way of thinking is that even if you secure the MDMs code
824790	830390	or doing some vulnerability research or pen testing, it's not enough because those devices
830390	836830	contain third-party code as well. And Ripple 20 is a great example, right? We see a TCPIP
837630	843890	library affected millions of devices, power grids, medical devices, and most solutions today
843890	849890	just can't handle third-party vulnerabilities. You can't really protect against vulnerabilities
849890	854590	that are within code that you didn't develop and you don't have the source code to.
854590	861350	And I mention in it because that in the military, we handled a lot with binary code and with embedded
861350	867830	systems and with the ability to reverse engineer other people's code. And actually, we are
867830	873650	leveraging these kinds of techniques in our philosophy to embed protections and security
873650	882570	into these closed-source components. Because in my view, the MDM has to be responsible for
882570	887890	the security of the device regardless of the components within the device. So, we have to
887890	894730	give controls to the MDMs to secure these third parties. And I think these binary-level capabilities
895370	901630	are well-established in the military and can be used to holistically secure medical
901630	909030	devices. And this is what we try to do. Excellent. I just want to say, Natalie,
909030	915030	as a patient and as someone that's been shouting about this stuff very loudly,
915330	921630	it's like you're serenading my ears at the moment. You know, I'm all for what you are saying.
921630	928130	It is solely the MDM's responsibility. They have to take ownership and responsibility
928130	935850	of the tick label, right? As a patient... I agree with you. But on the other hand,
935850	941430	I must say it's not an easy task, right? Because the MDM, it's very difficult to secure third
941430	947030	parties. And there is no way to avoid implementing third parties within your device. So, until
947030	954410	someone wouldn't take the responsibility to create such controls for MDMs and to create
954410	961530	the security products that they can use to basically protect their devices, we really
961530	971050	can't blame them. But we do need to ask them to use the cutting-edge tools to secure their devices.
971050	977390	This is indeed something that I believe in. Yeah, it's embedding the security culture in how
977390	983650	we look at devices, right? But, you know, Medtronic is a good example from this learning
983650	987610	from lessons learned, right? They've come from a place where they were in a really bad position
987610	992390	to where they are now, which is never an easy thing taking that ownership and responsibility
992390	999570	saying, hey, we need to do more. We need help. We can't do it on our own. I often say it takes
999730	1006110	a stronger person to say, hey, I now need help and go to people that can help him versus having
1006110	1011790	the persona of, I know everything, we are a big manufacturer, we can do it on our own.
1011910	1016210	Completely agree with you.
1017770	1021510	That's great. I want to pull on that thread a little bit, Vy, and just talk a little bit more
1021510	1026370	about your patient-hacker relationship and how being a patient maybe changes your perspective
1027210	1033330	on device security and how the more you've learned about how devices are built and a little bit more
1033330	1038130	under the hood, how that's also changed your perspective. Can you talk a little bit about that?
1038710	1043490	Yeah, sure. So, that brings back a memory of mine. I think it was two years ago, February.
1043630	1051210	I was actually in ICU where I had some issues. I had some device issues and I had to be
1051210	1058910	resuscitated. But I was lying in an ICU connected to 15 different kinds of machines doing infusion,
1058910	1065490	monitoring. I had a specific external monitor monitoring my pacemaker at that time.
1065990	1071170	And I was offered guest Wi-Fi, obviously, because hospitals want us to feel safe and
1071170	1077670	connected to the world. And soon realizing that these systems weren't segmented and that I could
1077670	1085730	potentially may have or may not have access to the central station that had my vitals on it.
1085730	1092330	But just realizing from a perspective of a patient how interconnected these systems are.
1092350	1099750	And the more that I watch and just observe the world or even attending talks, I realize that
1099750	1105190	the word medical device is exclusively used for anything in healthcare and hospital and anything
1105190	1111530	that a manufacturer makes, whether it's a Windows 10 machine or versus a complex embedded system.
1112010	1120230	And I think until we start understanding each system's unique, I say language, linguistics or,
1120230	1125090	you know, when you have someone that you're observing, you try and, you know, observe them and
1125090	1131790	learn what they are, how they talk, all those kind of things. But we don't do that with devices.
1131790	1135730	And I think I appreciate what Peter does and what Nathalie does because we reverse
1135730	1141810	engineer things to understand how they work, not only at a, you know, firmware level, but at a
1141810	1149770	file system level, at a binary level. And as a patient, I wanted to know what keeps me alive.
1149770	1156350	I wanted to know what libraries were used, what hardware was used. And I did that through OSINT.
1156350	1160450	I literally Googled manuals and from manuals I pivoted to get more information because
1160450	1164490	the manufacturer wasn't disclosing it to me even as a patient.
1164490	1169910	But I wanted to know that I can trust my device because I've seen that these devices are
1169910	1176590	misunderstood and implemented in a way where we build bridges or walls around our networks,
1176590	1182610	but we're so soft in the middle, but we never consider the malicious insider,
1182610	1188730	which is a big thing because I've realized that the threat from hospitals might come from within,
1188730	1192890	especially with everything with COVID-19 becoming borderless.
1192890	1198050	I don't know where the border stops or the perimeter starts and stops anymore.
1198910	1206030	So I think it's just, we need to take the time to understand the devices, learn their language,
1206030	1209610	and understand their constraints because they're all different.
1210130	1215050	I always say, you know, beautifully broken, wonderfully flawed,
1215050	1219610	meaning we can have the most secure and perfect device, there might still be a flaw
1219610	1224250	and it still might be broken, but that doesn't take away from the beautiful
1224250	1230350	synergy that goes into these devices. I know I geek out because I spoke to one
1230350	1234910	of the engineers and learned what my functions on my pacemaker and ICE does.
1235730	1238790	And let's just say it was like a moment where I sat back and said,
1238790	1243830	this is such a simple, complicated device, but I trust it.
1243830	1250290	And it's the weirdest thing, but I geeked out knowing that the maths behind it is so wonderful
1250290	1255990	that in a nanosecond it raises my heart rate up. So I'm actually getting emotional.
1255990	1262170	Excuse me, but yeah, it's a good thing when you realize that you can trust what's in you,
1262170	1265610	right? I can trust that it's going to do what it needs to do.
1265610	1273710	I must mention just regarding one thing you said about getting the hardware specifications,
1273710	1280770	the software specifications, being exposed to how the device is being built.
1280770	1287090	There are also downsides into publishing this information, meaning bad actors
1289110	1294630	having this information very accessible, having them being able to see what kind of third parties
1294630	1299150	and start looking for vulnerabilities or understand the specs and extract the firmware
1299990	1307890	very easily. You want to make it as hard as possible. So I do think that we need to
1307890	1316230	keep some sort of balance between what information we put public and what information we maybe
1316230	1322990	expose just under certain terms. So I understand you as a patient wanting to know as much as you
1322990	1329050	can about your implantable device, but imagine that bad actors could have access to this
1329050	1339450	information as well. Sorry, Peter. So just to clarify, the reason that I said I OSINT this
1339450	1346590	was before I spoke to them and then I realized that I could get all the information. That's
1346590	1352890	when I went to the MDM, right? So I'm all for that certain things should be on the internet.
1352990	1358570	And this was one of the first things I raised with them. So when I meant as a patient, I went
1358570	1364430	to them, I was concerned. I was petrified because I managed to get technical manuals
1365010	1371150	from technical manuals jump to hardware manuals, which led me to more information that I
1371150	1380230	seriously wanted to find in an OSINT exercise. So yeah, that's what happened. And that's when
1380230	1385170	the legal team slapped down on me and like, where did you get this information? And I'm like,
1385170	1391950	your website. Yeah, we had the same experience where they asked, where did you get the devices?
1391950	1396690	And we're like, eBay. We know about that. Yeah.
1398470	1404910	I think that underscores the point of, I mean, I can understand the request to have a balance, but
1404910	1414970	the minute that comes out, you can't take it back away. And I would caution the idea that
1417590	1423750	hardware designers, software designers that rely on the concept of anonymity and hiding
1423750	1430670	specifications of the device may make worse decisions predicated on the idea that no one's
1430670	1435330	going to know what the hardware is or what the, you know, what radio chip they used,
1435330	1440570	that kind of thing, right? That's an exercise in time. And when you think about the lifetime of
1440570	1447770	these devices, I just caution that concept because once that comes out, we can't take it back away.
1449050	1452030	Yeah, well, I mean... Go ahead, Vi.
1452730	1458930	Sorry. So Peter, I think you and I, I mean, I didn't have to go buy my device. I just got it
1458930	1465250	and I got the doctor. I'm like, hey, hey, hey, I would like my device, please. Can I keep it?
1465730	1470650	And they gave it to me. I mean, your story, of course, is way cooler. I mean, I didn't have to
1470650	1476830	buy it. Yeah. Talk a little bit more about that. Talk a little bit more about that story.
1477110	1483210	So I'm a little bit of an empathic person. So like awkward situations tend to land
1483210	1488630	strongly on me, I guess you might say. And amidst doing some of the work I've done,
1490230	1496250	I've taken apart and reversed the majority of the home monitor device. But I needed to see live
1496250	1501890	communications to understand what some of the implications of that were. So I tried to get my
1501890	1507310	hands on some implantables and I think it was like between 30 and 40 morgues and coroner's
1507310	1513690	offices I called trying to get my hands on before basically anyone that did cremation,
1513690	1518360	right, because they remove the devices before cremation. And it was some really,
1518360	1524320	awkward conversations. I got yelled at a few times pretty aggressively. Understandably so,
1524320	1529660	they didn't see what I was trying to do. But yeah, that was a little bit awkward.
1530460	1535380	Yeah, you should seriously try going to a cardiologist's office and they Googled you
1535380	1541320	and they've seen one of your talks and you get specifically watched doing everything.
1541960	1547480	Yeah, that's a different patient perspective. I'm officially banned from all major hospitals in my
1547480	1553820	hometown from having a laptop, or even getting Wi-Fi access. I think they've grown tired of me
1553820	1559240	saying, hey, we should fix this. Right? Or me spending time fixing it for them and saying,
1559240	1565320	hey, I fixed this for you. You know, here's the credentials go, you know, go wild. It's just
1565320	1572260	that whole culture of when you say to someone, but we can fix this for you. It's not an insult.
1572260	1576840	It's genuinely people, researchers wanting to make things better.
1577160	1583640	And perhaps not having the social... I don't sometimes have the social cues like you would
1583640	1590440	say Pete. I can totally imagine having those conversations with coroners. Like, you know,
1590440	1595520	I can just... I think I wanted to be a fly on the wall for that.
1597020	1601700	So as a medical device manufacturer, I think I'm internalizing two takeaways.
1601700	1607380	Don't rely on security by obscurity, but also make sure you keep operation security in mind,
1607380	1613840	and you're not just posting manuals and details that can be found through open source intelligence
1613840	1619900	gathering. So two takeaways right there. So I want to switch gears and go to you, Pete.
1619900	1623780	You know, I know we talked a lot about your vulnerability discovery. Obviously, we hinted
1623780	1628880	at a few of the CVEs and things that you brought to Medtronic. But how do you see the testing
1628880	1634000	landscape changing for devices? And what should medical device manufacturers do on their own
1634000	1638260	to learn from what researchers have done in the testing space?
1638800	1645460	A great question. Well, I think the testing is going to have to follow the path of development.
1645900	1651480	And one of the major things I see is very important for the medical device community right now
1652620	1657720	is there's a lot of devices that have update functionality, but there's a very,
1657720	1663500	very small percentage that actually use it. And I think there's an opportunity right now to fix that
1663500	1669000	problem before it gets out of hand. Secure update is one of those problems that if you don't design
1669000	1675180	that in early on, you can kind of lose control of what it is you're trying to work with.
1675480	1681340	It's a perfectly ripe target for attackers, especially when it comes to low power, questionably
1681340	1687700	connected, embedded devices. So I would stress as far as something to develop on,
1687700	1692620	work on secure update and get that working immediately so it can be used. The more
1692620	1697660	confidence you have in that part of the tech stack, the more able you're going to be to
1697660	1703100	respond to things like security incidents or updates because of some binary or open source
1703100	1710020	package that comes in. And that kind of, I think, will drive a lot more of the
1711160	1716860	modifications to testing that's going to happen. As these devices, we've seen a trend now for
1716860	1724900	devices that used to use homegrown protocols and bespoke radio communication systems
1725650	1731340	to communicate, largely shifting over to using things like Bluetooth and something that's a lot
1731340	1738120	more standardized but also tends to work with a smartphone. And as that happens, we're seeing
1738260	1745100	a shift into a lot more open source library usage in these products. That particular thing
1745100	1750520	is a problem near and dear to my heart. We're working on a tool to basically audit the open
1750520	1759480	source ecosystem and mine for malware, mine for backdoors. The vulnerability space, I think,
1759480	1763440	is kind of, well, people are looking at that pretty aggressively right now, but no one's
1763440	1767800	approaching it from the concept of who are the authors of these packages and how they work
1767800	1774080	together. This is going to land very important on the medical device manufacturer. When you think
1774080	1779260	about, I spent a little bit of time in the defense sector myself, and when you think about how
1779260	1784960	nation-states approach problems, there's a tactical and a long-term strategic goal to some of these
1784960	1792340	things. And compromising the GitHub credentials of a developer that writes a package that's three
1792340	1796520	levels upstream from something that goes into a medical device is a great way to weigh in weight
1797100	1802800	for access into an entire fleet of these things. And again, you think about that kind of problem
1802800	1808340	without a good secure update mechanism, and now you have something that is irreversible.
1809000	1816240	So I see this as the trend of development changes with medical devices.
1816740	1821620	The testing requirements are going to change as well. I would love to see a universe where
1821620	1828600	when a device is designed, I mean, we have automated testing through like fuzzing of
1828600	1833820	the protocol, right? I mean, we have knowledge of different aspects of this that we can bolster and
1833820	1839260	use things like computers to help us, and have that built into the design such that when,
1839260	1843480	you know, before release, there's all these different tiers that have happened
1844220	1853140	aside from just someone manually reviewing source code. That is still a strong improvement over
1853740	1859640	requiring people to buy these devices or call corners offices and take them apart,
1859640	1866500	dump firmware, reverse engineer it, and try to find bugs. The more people we can get involved
1866500	1872000	with this at a productive level, I think, is going to be more valuable too. And that's,
1872000	1875680	I think, a large challenge of the medical device manufacturer. How do you
1877020	1882440	adjust the signal-to-noise ratio such that you're getting competent, quality people
1882440	1887680	that really want to help without, you know, wading through the deluge of
1888220	1891500	things that may happen if you just bug-bounty it, let's say.
1892100	1896080	Yeah, I think there's like a diverse approach to this. I think, you know, in a prior life,
1896080	1901200	you were at a boutique shop and, you know, we've used all different types of testing companies,
1901200	1905300	we've internalized some of this, but, you know, even finding those niche boutique shops or those
1905300	1909940	individuals that can really get at certain elements have really helped us, I know.
1910760	1922740	I can, if I may jump in, as a person who researched many platforms that are highly
1923540	1931360	secured, highly being researched, highly being fuzzed and pen-tested, including Linux kernel
1931360	1939060	and iPhone devices, I can tell you that it's impossible to put a device out there without
1939060	1945360	vulnerabilities. And once it's out there and you have enough researchers, some of them will find
1945360	1951480	the vulnerabilities. And if we'll take a look at the long-term strategy and take a look at what
1951480	1959940	the traditional IT security world has gone through, we have endpoint security and we have network
1959940	1966580	security. And the endpoint security is something sitting on the device in real time, capable of
1966580	1973040	preventing and detecting attacks, regardless if the device is vulnerable, regardless what type of
1973040	1981600	attack it is, and regardless of, you know, secure design or where the vulnerability is. Is it in the
1981600	1990740	OTA or improper input validation, etc. So for me, if you ask about what's the right approach,
1990740	1996840	the right approach would be sustainable. Meaning I think secure design is cool, I think penetration
1996840	2005120	testing is cool, but it will never be sufficient. You will never have a 100% vulnerability-free
2005120	2014400	device, especially when you use third-party code. So I don't know how much static analysis or
2014400	2019500	vulnerability assessment tools you use, but they are not very good at finding vulnerabilities in
2019500	2025520	binary code. They don't. And source code is not the only thing that goes into your device, not to
2025520	2030920	mention hardware components that have software within them. So your Wi-Fi module or Bluetooth
2030920	2038480	module, it contains vulnerabilities as well. You have vulnerabilities on the chip level. So in my
2038480	2045340	view and in my opinion, only something that's operating in real time, capable of verifying the
2045340	2053680	integrity of the device, capable of preventing damage, data theft, or basically preventing attacks.
2053680	2058760	And on the other end, also monitor the device, meaning you need to be alerted if something
2058760	2066320	bad happens or maybe happens. This is the approach that I believe in more, because
2067280	2073820	I think this is why endpoint security has been so strong for many years now in the traditional
2073820	2084900	IT space. And I think this is where IoT and IOMT should go to. And obviously there are challenges
2084900	2092300	in installing something on those devices. They are low resource. They are real-time operating
2092300	2099620	systems. They are diversified. They are extremely different from traditional servers or PCs.
2099620	2105200	But this is where innovation comes to the picture. I think we can solve this problem. I even think
2105200	2112180	that we've solved part of the problem for sure. But I don't think that this challenge should
2112180	2118920	keep us from putting something on a device to protect it. We should just do a breakthrough
2118920	2128120	in how we see endpoints for IoT devices. Yeah, so I totally agree with what everyone's saying.
2128120	2134740	Something dawned on me the other day. If we look at the longevity of medical devices, for example,
2134740	2140840	could be a decade. So if you look at just some of the statistics, 600,000 medical devices
2140840	2147760	implanted yearly in the US, those will last 10 years. So if you start adding the numbers up,
2147760	2153800	you're dealing with an ocean of legacy devices that at one point in their lifetime will be
2153800	2161340	vulnerable. And it's not technology that you can rip out of a body or, you know, some people only
2161340	2166320	can have that monitor depending on what device you are talking about. But those things are built
2166320	2172240	to last for a long time. So any solution will have to be a multidisciplinary approach, eating it from
2172240	2178740	all sides, but need to grow with the device, need to be updatable, need to be changeable,
2179340	2184220	and basically grow with the times when the device necessarily can't.
2186000	2191940	I'm glad you brought that up, Vy. So I'm interested and I'll go kind of back around the panel and
2191940	2196840	start with Pete. How do we approach this legacy device problem? I think Vy already teased out
2196840	2204000	the updatability and the forecasting of the life cycle, but we have a lot of legacy debt right now
2204000	2208720	that we're dealing with. So what are some ways that we can work through that? Pete, I'll start with you.
2210040	2217740	That's a super challenging problem. I think there has to be some preparation for
2219540	2225940	a worst-case scenario. And worst-case scenario being, think about the attack surface.
2226660	2235660	If that case is disabling radio connectivity on some of these things,
2235660	2239300	working with some of the medical device manufacturers, come to learn
2240100	2244640	this isn't a software change for a website that can be pushed into the CICD pipeline and
2244640	2252120	show up in 10 minutes. This takes legal and regulatory guidance and preparation and
2252120	2259620	submission to the FDA, and that can take a long time. And my suggestion is prepare for those
2259620	2267200	scenarios now. Get ready for, how do we do this if we have to? Because the reality of
2268700	2273780	explanting devices from hundreds of thousands or millions of people is completely untenable.
2274160	2279660	So how do you get... and I realize that maybe there's going to be an inherent trade-off in
2280100	2286460	the quality of care provided, and that's probably a situation you get to only
2286460	2292920	as a worst-worst-case scenario. These devices keep people alive, and that we want to
2293660	2297720	keep enabling that, because like, you know, as V mentioned, these are things that
2298500	2304200	some people wouldn't be here without those things, and we don't want to instill the wrong level of
2304200	2311540	fear. But planning for those scenarios now so that if those need to be enacted, I think is
2311540	2316440	one of the only things you can do for the legacy devices that don't have an update mechanism.
2317420	2323460	If they do, I mean, like setting up the testing for this now and being ready for it,
2324700	2328700	it's an inevitability. It's a when, not if.
2330700	2337220	I think what we are doing together with Medtronic, I think Medtronic is a true
2337220	2346540	pioneer in this support to legacy devices, as what we are doing together, installing protection
2346540	2353860	into a five-year-old device, I think is five years old, enhancing the security infield,
2353860	2362700	getting visibility, getting protection into a really old medical device using the OTA.
2362700	2372740	And I think it's a true innovative play, and I think that I truly support this kind of
2373740	2384360	acts, and I think that I have a lot of respect to Medtronic in being a pioneer in doing such a thing.
2385920	2391540	So I think we can learn from it. I think we can provide enhancements to existing device flits
2392220	2399560	of course with the right controls and the right MDM to take it to the next level and to move
2399560	2412460	forward. But it's a good example what we are doing together, and I hope that we could pave the way.
2414180	2419060	Absolutely. Baby steps in the journey, but exciting stuff. Vi, I know you have an opinion on this.
2422020	2426040	I always have. You're good.
2429310	2432070	You're on mute. Back on mute, Vi.
2432450	2436650	Oh goodness, I'm having audio issues today. It's like the audio day of a howl.
2438150	2444870	So my feelings on this is we can't even start facing the legacy problems until we
2444870	2450210	stop making stupid decisions and choices going forward, right? We have to now nip this in the
2450210	2457930	bud and say, going forward, we're going to do better. I haven't looked into a lot of other
2457930	2461910	things. I've Googled it. I have read up on it. I'm very excited about what you guys are doing
2461910	2468430	with Medtronic. That certainly is a step in the right direction, but visibility is key, right?
2468870	2473350	Like Pete and I have had discussions where everyone's like, we don't know if the ICD or
2473350	2478570	pacemaker has been attacked. Well, do you even have the data to know that that's happened?
2478570	2483170	So we want to deal with legacy. We need to start getting visibility moving forward because
2483170	2489030	otherwise we're adding this amount of... another year goes past. Now we have another group of
2489030	2494970	legacy devices that's going to haunt us for 10 years, right? So get it right going forward
2495430	2501530	and then start dealing, finding solutions for those devices that you don't have visibility on.
2501530	2507870	Find ways to get eyes on your products and your data because where you have a blind spot
2507870	2512290	is most likely where you're going to be attacked. And it's not like a nation state actor is going to
2512290	2517990	say, you know what? I have owned your product, right? Researchers have the courtesy to come,
2517990	2523530	you know, have a discussion. Very bad people looking to do bad, bad things aren't going to
2523530	2528790	have that discussion with you. You're not going to know they're there. And if you need one patient
2528790	2536350	to have your device and they get attacked and they ultimately pay with their lives,
2536350	2540570	I can tell you, you're going to have a string of patients wanting to explode their devices,
2540570	2546150	which is why something I don't want to have happen. It scares me because I look at where
2546150	2553330	I was at 19, where I am now at 33, celebrating my birthday, having two kids, having a master's,
2553330	2558310	thanks to a device that kept me living, right? Otherwise I would be dead. It's as easy and as
2558310	2565190	plain as that. It added years to my life I was not supposed to have. Take that technology away
2565190	2573570	and as a human race, we go backwards. So patients need MDMs. Whether people in security want to see
2573570	2580630	them as an adversary, there are people like me that rely on them to develop the technology to
2580630	2587290	keep us alive, right? It's important to understand that it's a love-hate relationship. You know,
2587290	2591850	we're not all going to do it right, but if we can have the conversations and we can fight it out,
2591850	2601130	we can find the solutions that are super cool and super techy and super new, we should try them,
2601130	2607690	right? What I think Sternum is doing, what Pete's doing, is hitting the same problem from a
2607690	2614050	different side. I'm concentrating more on how do we detect and log these things? How do I investigate
2614050	2620390	it? How can I, you know, have eyes on the prize sooner? That's my passion point. But we're all
2620390	2625890	effectively covering this from a different side, which is good, because all sides are vulnerable
2627050	2628650	and all sides are needed.
2630250	2635190	And I think you're bringing it all together, right? Like, how can we get better visibility?
2635430	2639250	And, you know, Natalie talked a little bit about this, but I'd like you to go into more detail.
2639250	2646010	What are your thoughts around proactive controls in kind of the post-market, which is a term we
2646010	2650950	just use for detection, logging, monitoring. I know we've thrown surveillance out there,
2650950	2656610	but to be more in line with the community, it's incident response, it's logging, detection,
2656610	2660350	that capability. So how do you see proactive controls fitting into that model?
2661210	2669630	Yeah, it's a great question. And I think I want to learn from other industries, which already
2669630	2677110	developed into this direction. So you don't see devices today within enterprise or in cloud
2677110	2683550	infrastructures that are not monitored actively, that do not pop up alerts when something suspicious
2683550	2692450	is happening. And I see the medical space behaving the exact same way. I think with solutions,
2692910	2697450	I won't mention ours, but I think there are many solutions that can do that,
2697450	2701690	provide monitoring and visibility into the device itself. And then I think that
2702190	2709150	this kind of information and incident response should go into two main personas. One is the
2709150	2716090	product security in the MDM. Monitoring is distributed device fleets. Understanding if
2716090	2722470	somebody is researching this device, selling the device on eBay, maybe trying to hack into the
2722920	2728630	information. These kinds of things can be visible with the right controls. And of course,
2728630	2735590	there is a technological challenge of supporting old devices, old code base, which didn't come with
2735590	2741830	visibility inside without logging, without monitoring, but that can be fixed. It can be
2741830	2748890	installed post-market, and it's even easier to install it pre-market. The other persona is the
2748890	2755310	hospital, the clinic, those devices that if they come with built-in protection and monitoring,
2755570	2761930	they can be the eyes of the hospital for a beginning of an attack attempt. Imagine an
2761930	2767650	attack attempt just a month ago, there was a ransomware attack on hospital starting for a
2767650	2774090	remote patient monitor. So the hacker penetrates to the internal network through the vulnerable
2774090	2780270	IoT device. So imagine this device transmits information. Imagine this device is capable of
2780270	2786170	detecting the attack attempt and even preventing it. Not only you prevented the attack, the hospital
2787050	2794810	that moment become aware that is under attack and can act accordingly to secure other devices,
2794810	2800330	maybe unpatched devices. So you don't have to have all the environment protected, but as you
2800330	2806730	have more devices that are transmitting, visible, protected, you have more visibility into your
2806730	2818170	entire enterprise or hospital and can respond accordingly. So I think both personas benefit
2818170	2825370	from this kind of visibility. And I think moving forward, we can use these kind of tools to embed
2825370	2833770	security and visibility. And I'm making a difference between the two, because the kind of
2833770	2840950	solution that I see in mind is first a deterministic solution to prevent attacks in real time, prevent
2840950	2847230	the damage, because in medical devices, there is no time to waste. A successful attack could lead to
2847550	2853930	a little resource, and you don't have enough time to detect the attack and respond in a week or two
2853930	2860530	weeks. Sometimes in enterprise, it takes six months to respond to a security incident. You don't have
2860530	2866090	this kind of time in medical devices, so you have to block the attack in real time. The other aspect
2866090	2872750	is really to become aware. And to become aware means to get alerted when something is behaving
2872750	2878910	differently or suspiciously, or if there were a prevented attack attempt. And once you are aware
2878910	2886510	that this kind of attack happened, let's say in the US, and you have devices that you can't update
2886510	2892150	in another country with the same vulnerability, because you know what the vulnerability at this
2892150	2898530	point, because you have visibility into it, you're capable of providing fast response to alert your
2898530	2905910	patients, to alert the hospital, to update the devices with a patch. So I think it's an essential
2905910	2914930	thing that we need to embed into the medical space, and we're on it.
2916090	2920470	I love that, because I think we're starting our journey to improve our visibility, improve our
2920470	2924790	prevention in near real time, improve our detection capabilities. But we've thought
2924790	2929490	into the future and how we need to better partner with healthcare delivery organizations,
2929490	2933990	hospital systems, and provide some of that information, right, to the example you gave
2933990	2939270	about the ransomware outbreak. And just, you know, having dealt with ransomware myself in a
2939270	2944010	past life, you know, obviously, time is of the essence. And, you know, that's something that
2944010	2948650	we'd love to be able to help out with as an MDM in the future using these techniques and tools
2948650	2955530	that we're talking about today. So V, I want to switch gears a little bit. We're talking about
2955530	2960450	all different types of aspects of, you know, security controls and capabilities to give back,
2960450	2965290	but you have a unique forensics background. How does that make you approach device security
2965290	2969750	differently than, say, you know, the traditional vulnerability disclosure scenarios?
2971310	2977150	Yeah, so I think forensics is this unique focus on scientific processes. I think that's the one
2977150	2983430	thing that was hammered into my head is we need to follow a scientific process. So you need to
2984130	2989050	look at it from every aspect. But I was doing forensics for eight years straight,
2989050	2994930	solely focusing on that and realizing that I wasn't quite understanding all sides of it.
2995030	3001450	So I always say, we have a saying in forensics, we find the truth. So we reconstruct what's
3001450	3007770	happened. So I decided to actually start re-achieving, so learning how to attack.
3007770	3014030	And then I learned how to defend. And then I learned how to investigate. And taking that,
3014030	3021270	I decided to start applying that type of mindset of taking a multidisciplinary view to things,
3021270	3028070	saying, OK, well, I want to know if we're being attacked. I'm kind of tired of having, you know,
3028070	3033910	it told me that we don't have any data that supports any attack. And now knowing that
3034990	3042010	we don't have the data actually available. So to have more visibility, we can start seeing
3042010	3048250	whether devices are actually currently being attacked. Because we don't know. I spoke to
3048250	3054590	multiple coroners around the world through law enforcement agency contacts. And the question I
3054590	3060350	said to them, if you have a cardiac patient that has an implantable, right, they've passed away,
3060350	3064230	doesn't necessarily mean that it's, you know, suspicious circumstances. But do you,
3064230	3071990	do you, you know, get a program, pull the data, look for the time of death, look of any strange,
3071990	3078750	the device itself. And I realized that, yeah, the devices get sent back to the manufacturer that
3078750	3084850	does basically a memory review to see that everything is like it should be. But people
3084850	3090810	forget that programmers can be compromised and something can happen from a programmer to a device.
3091230	3097970	And we don't leverage the information that we have. So the important thing for me is we have
3097970	3105910	no ability at the moment, unless a researcher comes to an NDM, or someone makes a grand gesture
3105910	3115170	that they've hacked a device, unless it causes chaos, or becomes public, somehow, we don't know.
3115270	3120010	And that makes me uneasy as a forensics person, because forensics, we want to know,
3120010	3124630	we want to know the bits and bytes of how something functions. I mean, the LaCroix
3124630	3129990	principle is a big thing that I live my life by. So everything that comes into connection with each
3129990	3136110	other leaves a trace evidence. I want to know what it is. But if we don't have visibility,
3136810	3141610	right, it's there, but we don't have the capabilities to make it visual.
3141770	3148330	So I want to learn more of what we have, what we need, and what we need to do to kick ass to get
3148330	3156290	there. So that's my approach to what I'm doing with Medtronic is I'm assessing what you have,
3156910	3164630	what we need, and holding ass to get there. And I'm seeing it come together with the various
3164630	3169690	aspects that you guys have brought together, you know, covering it from different angles.
3169910	3174490	And the forensics in me is like saying, we can apply forensics in development.
3174490	3179390	You know, we can apply forensics pre-market, post-market. It doesn't necessarily mean
3179390	3184990	it's an investigation, but it's creating the evidence that we need for the future.
3185370	3189070	That's creating the data now for when we do need it.
3189890	3195630	You know, I'm always drawn to the example of Microsoft and how they used other data sets
3195630	3201410	to detect a large Windows vulnerability. And I think really was mining data in Windows
3201410	3206650	event reporting. And I know that a big piece of what we're thinking about is we have a lot of
3206650	3211250	remote monitoring information. We know what is above the line and what's below the line,
3211250	3216550	and we're trying to develop that anomaly detection there. And it can't only be done
3217170	3222910	with that type of detection. That's one leg in the stool. But as we look at on-device agents,
3222910	3227430	as we look at other ways that we can pick this up with our fleet distribution infrastructure,
3227430	3232890	I think that really has to come together to get this full picture. And all of you have hit on
3232890	3238850	that element. And I think it's not to discount testing or threat modeling. All of that has to
3238850	3243750	happen as well. But we really want to emphasize this prevention in real time and then this
3243750	3249050	detection of the current devices and fleet that are legacy and are out there live today. And what
3249050	3252530	can we learn from that? And I just, I really think that's important. And all of you have been bringing
3252650	3258030	a different element of that to this discussion. And it's helping us, I think, learn as a medical
3258030	3267250	device manufacturer how to handle this situation. Yeah, I'm always... Sorry. I'm sorry. I always
3267250	3273810	say data doesn't lie, right? There's a saying, let's follow the money or follow the evidence.
3274410	3279970	But we have so much data, we're just not mining it. We're not learning. I think it's one of your
3279970	3287150	members, Sasha, that said, we need to learn to listen, right? So we need to learn what the
3287150	3293990	data is telling us. And I think that's the big thing. We have all this data, but we're not
3293990	3301650	listening to it. And once we start intuitively tuning in and understanding the data, those
3301650	3307830	numbers don't lie. Then actually, I think an MDM can only really do threat analysis.
3308610	3315750	Because if you don't know what you have, how do you know what to protect? Because then you're
3315750	3319850	always on the back foot, right? You need to get ahead of the problem. You need to know where
3319850	3325330	you're most vulnerable at. You shouldn't wait for that to become public knowledge.
3328070	3333910	So I want to shift gears one more time here. We hear the concept of zero trust in medical
3333910	3341510	devices. And I believe each of you are on the same topic. How do you think that concept can
3341510	3345830	be applied from an MDM perspective or from a medical device perspective? And I'll throw that
3345830	3356530	out to the group. Whoever wants to latch onto that one can start us off. Okay, I'll roll with it.
3356530	3362410	I was waiting for you, V. Pete, I know you got some insight on this, too. Go ahead.
3362410	3368430	I love zero trust. It makes me excited because for once we turn security on its head and say,
3368430	3373730	you know, we're not going to trust but verify. That's not going to be... we're just not going
3373730	3380690	to trust, right? Because the nice thing about zero trust is you can actually understand devices.
3381050	3388550	But the ideal thing is now we don't have a perimeter. We harden everything. We probe a
3388550	3393650	device and if it meets the specific standards, that device is allowed to have access to the
3393650	3399730	minimum it needs access to, right? It's like a patient monitor doesn't have to be on the Wi-Fi
3399730	3406170	and doesn't have to link to the accounting system or, you know, patient records. We have this thing
3406170	3413290	trying to make everything accessible but too accessible. We take it to the extremes. We either
3413290	3421210	make it too secure and unusable or we go to the other way. But zero trust has really big
3421210	3428670	plus points for me because now we can attend to device manufacturers independently, right? We're
3428670	3434190	not going to have the same controls across the board because everyone builds their devices
3434190	3440490	different. You can understand the device and apply the appropriate rules, privilege, and access.
3440490	3448310	So I think this is a really good solution as we move to a perimeterless remote monitoring and
3448310	3455610	medical service. I mean, I had my first video consultation today which is something very
3455610	3463910	strange but yet it felt normal and the perimeter has just been broken. COVID-19 came in,
3463910	3469390	swept healthcare off its feet and we are facing new territory we'll be having to build
3469390	3475990	while trying to catch up. And this virus has crippled healthcare and I think security should
3475990	3483810	never put such a strain on healthcare that we cripple it more. We should be making it safer
3483810	3490650	and easier to use. And that's our responsibility as security people in this field. It's the
3490650	3498230	responsibility of the MDM. But zero trust is the ability to do catered security based on a device,
3498230	3504670	not necessarily the same rule for everyone. So I'm very excited about it.
3505070	3515170	So I agree with you and I have a slightly different interpretation of zero trust in the
3515170	3523910	concept of medical devices. For me, zero trust basically means we talked earlier about third
3523910	3532310	parties and we talk about embedding communication models within the code and communicating with the
3532310	3539430	patient's mobile app and the patient's maybe home router, you know, each medical device with its
3539430	3545550	communication. And I think zero trust should really mean that we can't trust any of those.
3545550	3550330	We can't trust any of the third party, open source, closed source, embedded. We can't even
3550330	3557350	trust the operating system that a medical device use, whether it's commercial one, Linux based.
3557350	3566470	We should be expecting vulnerabilities throughout the entire supply chain. The code, the hardware,
3566950	3572390	the software within the hardware. And of course, we can't trust that the patient didn't install a
3572390	3579470	malicious application on his mobile, right? Like the last thing we want to trust is the human being
3579470	3585070	not making mistakes. So for me, the concept of zero trust basically means that the kind of
3585070	3591090	security that we choose to implement should take all of this under consideration and to make sure
3591090	3597470	that we keep the integrity of maybe not the entire device, maybe it's impossible, but essentially
3598110	3604850	the critical operation of the device should remain secure regardless of all the things that I
3604850	3610690	mentioned. Like if we talk about the insulin pump, so you want the functionality of injecting
3610690	3618470	insulin will be the most protected functionality of the device. Same goes for personal health
3618470	3625010	information on the device itself. So for me, zero trust basically means taking this
3625010	3628870	into consideration when designing a security solution.
3630710	3637630	Exactly. I like what Natalie said. I think it's the difference in design.
3638070	3643710	And some of you might be, I talk about this all the time, every time someone will listen, but
3645990	3655090	I look at it as a concept of, I think a great example is like cars. When these systems were
3655090	3661930	built to allow a computing interface in a car, they weren't connected to anything.
3662610	3666910	And they designed according to that. And they scaffolded this over years.
3666910	3670450	And then all of a sudden, someone came along and tacked on internet connections and Bluetooth and
3670450	3677670	Wi-Fi. What you should do is go back and redesign everything to consider that new approach.
3677670	3688070	The zero trust concept to me means we think about it from the initial idea stage of defending it
3688070	3692970	in every place it can be. And it's an analogy to what I think Natalie and V were saying about
3694370	3700650	no one operational environment is any more or less secure than any other one,
3700650	3705910	because they're all the same. And building to consider that
3706630	3710910	takes concerted effort from the start, from the very, very start.
3711290	3717710	And I think approaching the problem from that way is another one of those shifts that
3718310	3724530	we have to consider from legacy devices into what is going to be the new normal for this.
3726870	3734170	Everyone's going to have to get there. The quicker a manufacturer of any kind of product
3734170	3738590	can start considering that, the easier their life is going to be in the long run.
3740950	3748650	I must add just one thing about that, because I think we are repeating a lot of
3748650	3755190	think about it in advance. You have to design it. I must mention the other side. Security
3755190	3763930	has always been the last part to be incorporated into things. Everybody would like to go to
3763930	3768930	market faster. Everybody likes to just build their devices, build their technology. Nobody
3768930	3774850	likes to think about security. And I'm saying it's okay, meaning I don't want to say you have
3774850	3780150	to think about it in advance. You don't. History teaches us that nobody thinks about everything
3780150	3787830	in advance, and it's okay. And security comes last, always. So for me, as someone who's looking
3787830	3794670	for solutions, and not just looking to emphasize the problem, I'm looking for solutions that can
3794670	3802850	be developed and installed, even if you didn't think about security. And I have to say, again,
3802850	3809530	it's the best thing to think about it in advance, but I'm just saying it's okay if you didn't.
3810350	3816830	Nobody holds you responsible. I will hold you responsible only if you didn't try to fix it
3817330	3823190	later on. Oh, dude, I'm sorry. I have to disagree there. Like, I want to kick some,
3823190	3829070	you know, I sometimes want to kick an Indian's ass and say, what the hell were you thinking?
3832910	3839330	That's what's happened there. It depends. It's like you have how could it pass for like one,
3839330	3844250	two, three, four, then this is the place where you can think, what the hell were you thinking?
3844250	3851190	I'm just saying, you know, the more advanced stuff, it's harder to think about.
3851890	3859130	Yeah, so it's a twofold problem. We're dealing with legacy, right? I call it the legacy,
3859130	3866110	because that's what it's written in, that joke for the evening. So the problem is we have,
3866110	3872950	we have to stop developing legacy problems, okay? So we need to address it ahead of time.
3872950	3877270	But okay, we have to face the fact that previously, we didn't address it ahead of the
3877270	3882450	time. And there's nothing you can do. Can't pull these things back on, tell me you're going to cut
3882450	3888790	me open, take my device back, give me a new one. I'm not going to let that happen. So we have to
3888790	3895130	deal with that. It's a twofold problem. We have to be realistic, meaning I think
3895130	3900930	you are completely correct. But realistically looking ahead, I don't think we're going to
3900930	3906110	be thinking about it in advance in the years to come, because new problems will appear.
3906350	3914870	And like in the 50 years prior to where we stand today, companies didn't think about it in advance.
3914870	3919770	So we can teach that, we can say that, but to be realistic, I don't think it's going to happen.
3919770	3925190	People will only handle the problem once it bites them in the ass, basically.
3925830	3932630	That's human nature, right? I can't disagree with you because history often repeats itself.
3932630	3938530	I think what's interesting is we're covering it like a triangle from different sides,
3938530	3943890	which is very interesting. I'm concerned with, we have these devices that are diversified.
3943890	3950230	How do we include this on a healthcare network, right? Naki's product literally deals with legacy
3950230	3956930	devices and new devices. And Pete's solution covers it from a different angle. So it's this
3956930	3963090	like diversified opinion that's doing the same thing, but each in a different way.
3963470	3968250	And this is why I think researching is important because we all think differently.
3969370	3973610	So it's having, yeah, it's a big problem. It's massive.
3974410	3977770	I think, yeah, I agree with what you're saying. We're all kind of coming at it from a little bit
3977770	3981690	of a different perspective. And I do agree, Natalie, that there's going to be new attacks
3981690	3986650	we haven't thought of today that come out in the next year, three years, five years.
3987610	3993630	But we're talking about medical devices today. And I think we absolutely have to require
3994890	4005170	better work on the design. We got here because of the evolutionary walk of how medical device
4005170	4013230	manufacturers built businesses to help patients. And computers came part of that. And here we are.
4013690	4021230	How we go forward, though, can be changed. And I think the idea that we'd be accepting to someone
4022190	4029470	not working hard at that right now is dangerous. I agree that we need to have things on the other
4029470	4034570	side to prepare for the inevitable, the new things that come out that we haven't thought of.
4036810	4042730	The next thing that shakes the industry, so to speak. And we want to be resilient to that.
4042730	4049730	I completely agree. But in one case, when I was looking at a medical device,
4049730	4058530	I then started reverse engineering an e-bike. And the e-bike was orders of magnitude better.
4058630	4063930	Because the e-bike wanted to prevent someone from bypassing the speed controller
4064930	4071570	and going too fast on the bike that it wasn't regulated for. And they did an incredible job
4071570	4076150	for that. But seeing the stark contrast between those two, the difference there was they designed
4076150	4080910	it to be that way. And I know I harp on that a lot, but I think that's an important point.
4080970	4084770	I think we can all agree that there's some fundamentals that we need to align with.
4084770	4091290	I think this is why we want this diverse experience, background, opinions, because it
4091290	4096410	helps us grow in the industry. And we have time for one quick final question here, and I'll go
4096410	4103230	around the panel and start out with you, Pete. How can researchers, smaller shops,
4103230	4107070	those attending the Biohacking Village, get more involved with device makers?
4109730	4115130	The way I'd put it was eBay and calling. I think there would be a lot that could be
4115130	4124130	improved if there's a way to get your hands on research devices to start learning this space.
4124130	4128550	One of the challenges I think newer people to working in medical device research are going to
4128550	4139390	run into is becoming aware of the monstrosity that is an MDM. And something like when you find a bug
4139390	4147010	and you suggest a fix for it, the realities at scale of making that happen. So on one hand,
4147010	4155910	I would say it would be wonderful if MDMs would start exposing programs for researchers to apply
4155910	4161490	to and be selected to start working on this stuff. And on the other hand, I think there'd be a great
4161490	4168430	spot for education on the MDM side to show what is it we're going to do. We need to do a hypothetical
4168430	4174030	patch to this hypothetical device. What does it actually look like? The legal ramifications,
4174030	4179890	the regulatory ramifications, because without that information, a lot of security researchers
4179890	4185570	I think will be frustrated at the timeline it takes because they don't have any sort of
4185570	4189330	understanding of what's really happening. Especially coming from a place of like
4190030	4195430	the hacker ones and the bug crowds where that's a pretty smooth process when you're looking at
4195430	4200230	web properties, right? And it's a very, very different industry. It's a very different
4200230	4203450	threat model. It's a very different process you have to go through. And I think there's
4203450	4208330	an education opportunity for that. Natalie, I know you've had your journey with medical
4208330	4212370	device manufacturers. Same question to you. How do you think that researchers in smaller
4212370	4219550	shops can get more involved in making a difference? So I completely agree with Peter,
4219550	4232130	and I think that bug bounties programs and exposing the inner processes that happen within
4232130	4237850	medical device development, which is extremely different from traditional development with
4237850	4245290	different regulations and different constraints could help getting more engaged. I think assigning
4245490	4251290	a person or a unit responsible for that is also super important. In some of the medical devices,
4251290	4256290	you just don't know who is the right person to approach. It's not the CISO, right? The CISO is
4256290	4261990	not concerned about medical device security. It's concerned about the network. So I think
4262830	4271610	getting this better approach is good. Transparency is good. Basically saying,
4271610	4278050	we want you involved. We're okay with it. We're not going to send you some terrifying legal
4278050	4288710	documents if you find something. This can be helpful. And I think the research community,
4288710	4297190	maybe thinking about it in a different direction, can also help educate. Meaning I think that what
4297190	4304050	we sometimes do, we go to medical devices, we do some exploitation workshops, we explain
4304050	4310570	what vulnerability means, how to exploit vulnerabilities, how to write code with
4310570	4315930	security in mind to avoid vulnerabilities. We had this experience with Medtronic as well. It was
4315930	4324450	amazing. It was super satisfying for us. And I believe that it was also interesting for medical
4324450	4331130	device engineers and software developers to suddenly see the other side of the code and the
4331130	4337870	other side of what can be done with the code and how devices are being exploited can also raise
4337870	4345250	awareness and can also help them understand what the researchers are doing and why they're doing
4345250	4355990	And this could really be an open-minded and open-hearted conversation, which we had, and
4355990	4364450	I think is a great example. And it's not very common. I mean, device manufacturers, OEMs,
4365410	4372090	some of them do not respond well when researchers approach them with vulnerabilities. And I
4372090	4379190	think positioning yourself as an MDM saying, we respect that, we want to work with you
4379190	4382530	is amazing, and it's the right approach.
4383770	4386690	Last but not least, Vi, you get the final word.
4387530	4394050	Oh, awesome. I'm going to do a call out to all my fellow biohackers, my friends, my goons,
4394050	4400230	my family. Biggest thing I've learned that the constraints with dealing with vulnerabilities
4400230	4407710	from an MDM's perspective is when you do a proof of concept, okay, approach this like a report,
4407710	4417250	approach it like scientifically, give as much information, as much code as you can for the MDM.
4418130	4426330	They need to verify what you have said. And if your document doesn't consist of information that is
4426330	4432710	comprehensive and easy to follow, they're going to have to reverse engineer things themselves.
4432710	4438430	And then the 30 days that you expect to get back from them, it's going to take them 60 to 90 days
4438430	4445610	just to figure out whether it's applicable to their product. So if you come with a problem,
4445610	4451390	come with a solution, right? Let's not just focus on what we've broken, let's try and fix it.
4451390	4457610	So my challenge to all my hacker friends are, let's not just try to break things, let's try and solve things.
4458230	4464990	For me, the term hacker is obviously sometimes associated with cyber criminal. And for me, it's a passion point
4464990	4471130	because hacking is what I do. I'm not a criminal. I try and figure out what's wrong so that I can fix it
4471690	4478150	using alternate ways and means of thinking. That's what a hacker does. That is what a hacker is for me.
4478730	4485430	But we're also scientists and in science we need to be thorough. We need to do the approach better.
4485530	4492370	And for an MDM, don't be such hard asses. We're trying to help. I promise you we're not your enemy,
4492930	4498770	right? Just be a little bit nicer. I have a conversation. Buy someone a coffee. If you see
4498770	4505770	someone at Biohack Village, I promise you I haven't had a hacker that bites unless asked to bite.
4505770	4511170	Right? We don't like having teeth. We like having tech conversations and we like geeking out with
4511170	4518350	you. But it comes from both ways. We both need to open our hearts and open our minds and realize
4518350	4523310	we're working towards the same ideal. And working against each other is not going to get us there
4523310	4529590	any sooner. And from a patient's side, keep on doing the research. Make this stuff better.
4530310	4535570	Because I think either party needs each other. It's a trifecta. It's the medical manufacturer.
4536130	4541730	And it's the FDA or the regulatory body, depending on where you're from.
4542190	4545870	Those are the things that are going to make the future better. And those are basic engineering
4545870	4549910	practices. A triangle is the strongest thing you can enforce something with.
4549990	4555110	So let's enforce this with teamwork. That's all I have to say. V out.
4555150	4561850	With that, I want to thank the panel. Drop the mic. Pete, Natalie, V, we're good to go.
4561950	4564990	Have a good DEF CON Biohacking Village, everyone. Thank you.
4564990	4566670	Thank you very much.