Hi everyone, and welcome to How Do We Uniform November Foxtrot Uniform Charlie Kilo Unfuck
Things. Can we really unfuck these things, or is it GARFU? And for those that don't know
the military slang, this is... well, go Google it. It's more fun, right? I don't want to
tell it all to you guys. Just go Google that. This talk is not your normal talk, right?
This is an interpretive dance. This is me getting on my soapbox because I'm five foot
nothing and tell you all the things that needs to be unfucked. This is my own opinion. This
is no one else's opinion. This is conversations that have been had. This is observations that
have been made. So if you're easily offended, this is not the talk for you. Scroll past,
go do some other fluffy stuff. So who am I? I am a DEFCON goon. I'm the founder of DEC2751.
We solely focus on reverse engineering medical devices and making things better. I'm also
an avid biohacker village supporter. I think this is the best village at DEFCON. It's the
one I certainly most enjoy. I'm also a current and independent researcher for Medtronic. And
as you can see in the beautiful picture on the right, that is my Medtronic ICDR. It's what keeps
me breathing and kicking and doing all the things. I'm also a DFIR lethal forensicator. I've been
doing forensics and incident response for many, many years. Yes, I look very young, but I'm much
older than I look. I'm a member of I Am The Calvary. I'm a patient and I proudly refer to
myself as a cyborg. Now, I wanted to do a different talk this year because I believe that if we know
what is wrong, we can find ways to fix them. So this is the talk for all medical device enthusiasts.
Those that want to unfuck the things, those that want to fix it and make it better.
So let's talk about the legacy of all problems, right? I sat down the day and I did the maths.
In the US alone, there are 600,000 new implantable devices every year. These devices
last for approximately a decade. So you start adding these up,
we have a whole sea of devices that sooner or later will add to our technical debt.
In a single hospital, if you put all the devices together within a hospital in the US,
we'll have 10 to 15 million connected medical devices. That's about 10 to 15 connected devices
per patient bed. To give you an example, I was in ICU because often than not, my heart's an asshole.
And it lands me into ICU for some TLC, right? So I go have my holidays. If you look around,
you have infusion pumps, you have monitors, you have external monitors monitoring your pacemaker
or your ICD. And you have central stations. It is this big ocean of leaping lights. I know Jason
Street always refers to it as a box with lengthy lights. Well, go be in an ICU bed, you'll see lots
of those. So when we start realizing how many hospital beds there are, how many devices are
attached to those beds, we start seeing the magnitude of the legacy. We see the ocean of
devices we are faced to protect or to fix. Now, this is what led me down this path,
is that I think we should start fixing the ship now. We can't wait for another year,
can't wait for two, because we're adding to our problem.
And now as we've seen COVID, healthcare has changed forever.
The boundaries have been broken, the perimeters no longer exist.
So you wonder why I say the legacy. Well, in case you did not know, most medical devices are coded
in C. So I decided to do a dad joke. The question is, how are we getting it so wrong? And yeah,
this someone said that someone was me. I want to know why in three years we've made no strides or
why in three years we're doing the same things over and over. Well, let's start at the beginning.
Lack of clear definitions. There's no consistencies in the terms that we use.
I often go to talks and I realize, well, we're talking about medical device security, but the
more that we are listening, I realize it is a Windows 10 endpoint within a healthcare establishment
that we're talking about. Surely that's not the same as an insulin pump, an infusion pump, or even
a pacemaker. Those things don't even look or act the same. So I decided to do what any good researcher
does and I went to the dictionary. I looked up the terms. So let's explore healthcare.
The field concerned with the maintenance and restoration of the health of the body and mind.
It's hard, but this is what healthcare does. This is what hospitals do.
So surely any device that they put there to help facilitate this should be called a healthcare
device. So let's explore what is the meaning of medical relating to medicine or the practice of
medicine. So it is something that allows us to practice medicine. Healthcare is something that
we give to our patients. For me, I started to see the clear separation between the two.
Each one has different responsibilities. Each one has a different function. It is very important
that we start differentiating from the two. An interesting useless fact. Did you know that
a cotton swab is seen as a medical device? Yes, that is for ICD-10 and billing purposes.
I sure as hell don't think it's a device. I think it's a disposable.
It's something we only use once. So let's see. What is a device?
Something contrived for a specific purpose, usually a simple mechanical apparatus.
Okay, so your insulin pump, your pacemaker, those are all a device, right?
Well, now the question is, is it medical or is it healthcare? We need to start differentiating
because each one of the two have different controls, different threats, different weaknesses
and vulnerabilities. In fact, they have different operating systems. We need to clearly understand
what we are dealing with. Now the question is, is it a healthcare or a medical device?
Which button will you choose? Which one will you use? I get very confused because we're using the
same terminology for everything because medical device sounds much more sexier than a healthcare
endpoint or a healthcare device. But that leads me to the point that if we don't start defining
these things out and understanding the ecosystem we are set to protect, we are setting ourselves
up for a hiding. We are literally looking to be spanked. This is something that I'm living my
life towards. When you talk, you are only repeating what you know, but when you listen,
you learn something new. So I went on a year-long journey to understand what devices are telling me.
I wanted to know what secrets they hold.
Why things are so wrong is that we're not assigning responsibility accurately. I know
it's a word that everyone fears because no one wants to be accountable or responsible
for decisions or things they fault. So let's explore the MDM or the medical device
manufacturer's responsibility. They have a responsibility to create devices that aren't
unhackable because let's face it, nothing's unhackable. Everyone gets bored and someone
figures out how to hack a device. But they need to have a device that is secure or as secure and
safe as you can have it. But their responsibility is to deal with the devices both pre-market and
post-market. Meaning that if a vulnerability is found pre-market, they need to fix it before going
to market with the device. They need to do everything in their power to make sure what
they are building, both on a firmware and a hardware level, takes into consideration the
security challenges as well as the clinical features. Because let's face it, security is
not a functional requirement for medical devices. They are there to offer medical care to patients.
Often we see that security is slapped on after the fact, where it should be coming from design
throughout manufacturing to when it goes to market. Now we have a fairly secure device that's
gone to market. For example, an ICD lasts for 10 to 15 years. I can almost guarantee you that in
that time, someone will find a vulnerability. Now we need to fix that vulnerability.
The hospital or healthcare establishment has no power to fix the firmware or even fix the
physical device if there's a vulnerability found. This remains the MDM's responsibility.
Part of their responsibility is having a catalog or register of the information on everything that
goes into their products. For every product they put on market, they have responsibility
towards the end of the lifetime of that device.
If it breaks, they are the only ones that have the power to fix it. No one else.
Now we get to what is the FDA's responsibility? Well, I say the FDA because it's a US conference,
but everyone follows suit of the FDA. If you start researching medical legislation around the world,
you will see the terminology used by the FDA being rolled out in other countries,
meaning they are the leader in this. They are the one that everyone looks up to.
They need more legislative power. They need more teeth. They need to be an enforcer of
what the standard is. They're the one that has to keep the MDM's on track. They are the ones
that gatekeepers to the market for products. They are the ones that need to enforce the
fixing of the problem. I know that they're currently working on new guidances, and I
surely hope that it's got more teeth. An example of this is in the guidances currently at state,
reasonable risk analysis needs to be done. However, the reasonable analysis that is required
for it to meet the reasonable test is not specified. So again, we have guidances that
don't have enough detail or standards out. I'm hoping that from a legislative point of view,
we can actually start setting the tone of what is expected from a medical device,
both on a clinical and both at a security level. And this is not just for implantables.
I know it's a little bit harder when it's inside someone, but let's start categorizing it.
Let's start standardizing the things and setting up the rules of engagement.
What is expected of a device? How should it be used and how it should be updated? These are
things that only can be done by the FDA. They are the rule setters. They are the rule enforcers.
Let me look at what is the HDO's responsibility. Their responsibility is to keep their patients
alive. Their responsibility is to have these diversities of devices on their networks,
but they have to implement them in a safe way, taking into consideration the type of device it
is, how it communicates, and how they are going to introduce it into their ecosystem.
Those are the responsibilities of the HDO. They do not hold a responsibility for updating firmware
or even vulnerability management of devices. That should be a manufacturing role.
We've seen that during COVID-19, HDO's are crumbling globally. Healthcare is fracturing.
And the fact is that they are designed, their purpose is to deal with pandemics and viruses.
We are now expecting them to take on board cybersecurity and do the job of the manufacturer
or do the job of the FDA. That is not what they're designed for. So how can we expect that
they will not crumble and break even further? As a security researcher or a hacker, I don't
want to be responsible for breaking healthcare more. I want to be responsible for making it
better. So we should take into consideration that the decisions they make on a daily basis
are life and death. They have patients connected to them. We shouldn't be making things harder for
an HDO. We should be supporting them and making it safer for them to implement. The last thing I
want is for someone to have a device breached and a patient to lose their life. It puts signs back
tens of decades. And the fact of the matter is I would not be here without my device.
I would be dead at the age of 19. It has extended my life and for that I'm grateful and thankful.
So we cannot go forward and break things more until we have an understanding how we can build
them up. Now the third problem is two worlds colliding, meaning we have this complex ecosystem
that has different devices but we have one way of implementing them. We have a cookie
cutter approach when it comes to infusing medical devices into a hospital
because we don't define these out properly. Are we heading for a big bang or is it going to be
a meeting of the minds? I think we are facing a situation where we're going to have a big bang
because all we need to happen is for these controls to fail. And can you honestly tell me
that you have the same controls for a Windows 10 machine versus a patient bedside monitor
running something like BusyBox, VXWorks or proprietary software? Are these the same?
Do they look the same? Do they sound the same? Do they crack the same? I don't think so. I think
each one comes with different sets of challenges. I found that a hospital is the most complex
sea of devices that I've ever seen and this is just me walking through a hospital. Have you
ever noticed how many different manufacturers can be under one roof? Do you think that those
devices are all made equally and the same? Do you think every manufacturer implies
the same controls? Has the same way of thinking? No, everyone functions in a silo because there's
no clear standard. The standards we are using are those for IoT devices or for regular computers
or laptops or endpoints. There's no set of standards specifically catering to medical devices.
And to be clear, when I say medical device, I mean that thing made by a manufacturer.
Not a Windows 10 running software. That's a different conversation.
Again, leading into this, it's the diversity of it all.
Have you ever spent time in a hospital and just looked around
and then think to yourself, I wonder how they've implemented this? A lot of hospitals will offer
Wi-Fi. Those systems are often not segmented. There's the saying in security, trust but verify.
Right? We just give everyone access. All the systems have access to everything
because we want to make it easier. Now I ask you, if you look at this picture,
most of those devices are connected onto the hospital network. These devices all have
communications. But all these devices are most likely very different in how they apply security.
And let me tell you, often we do this thing where security is an afterthought
or a post-market situation. We don't give developers or hardware engineers
the information to become security-minded developers, security-minded hardware engineers.
Security can be built into every portion of your pipeline and should be. We should be taking this
as a requirement to look at. I'm also big that one day these devices will be hacked. In fact,
they might already be hacked because we don't have the data to pull from to say whether or
not the device has been hacked. Always in incident response, we come after the fact and say,
oh, if I only had logs, oh, if I only had this piece of evidence. We should be building in
these controls to be able to visualize what's going on on the device. Now you might ask how I
know this. Well, I have a whole room filled with medical devices. I have a whole library filled
with firmware. I have been doing forensics for the last year. I'm trying to determine whether or not
there's any logging or whether or not I even have the ability to do a forensic investigation.
And I can tell you that no, because no one considers the fact that these devices
will inevitably one day get reached if they have not already.
A big thing that I want to see change is that we have proper standards and rigorous guidances.
These things should be enforced. They should not be if you want to do the following.
There should be repercussions for MDM not following standards and guidances.
I have spent significant time looking at the NIST standards currently used for medical devices.
These things are referencing machines that have Windows or Microsoft or different protocols.
They don't take into consideration what a medical device is. I want to see controls.
Controls are there for specific devices, but we need to categorize these first.
And I think before we get ahead, the first and foremost thing that needs to change is the fact
that we need to start understanding what a medical device is as well as subcategories of that device.
I think once we have clearer understanding, we can have better standards.
I would love to see a NIST standard specifically catering to medical devices,
specifically taking into consideration the unique challenges they face.
And how do I know these things? Data never lies. It's the one thing that you can listen to.
Yes, data can be manipulated, but this is data that's collected over long periods of time.
Healthcare has become the biggest target at the moment. Not only are they facing keeping people
alive, they are facing attacks from all avenues. The internal threat or the malicious actor from
within has certainly taken a rise. I was very shocked to learn the other day that 18% of
healthcare workers stated that they would sell patient records for the right price.
We never consider that the greatest threat might come from within.
So now we've spoken a lot about the problems, but there is a saving grace. There's something
that I really believe has the right approach to dealing with the complex problem that is
medical devices within a hospital. It is called the Zero Trust Network.
Trust is neither a zero nor a one. This turns the whole security on its head, where we no longer
just trust but verify. We verify but never trust. We no longer have this perimeter-based defense
structure that we used to have. I think most hospitals build this huge wall and make their
perimeter hard, but never considering that patients walk in and out of a hospital wearing
wearables with embedded devices or, you know, introducing medical devices that are connected.
I've often seen that hospitals get breached via a phishing email or via a system that
should not have access to the whole entire network. This is a very important thing for me,
because this could lead to us defining that, you know, the least privilege and the least access
that a device should have on a network. And especially with electronic healthcare records
moving to the cloud, not every system needs to have access to that. We should be limiting what
devices have access and how they have access. And I think one of the biggest things and the
most promising things is if we find that a device is no longer conforming to the rules and the
controls we've set up, you can revoke the access for that device. It breaks down the perimeter
and makes it more secure. It makes it more manageable, because now we have the ability
to differentiate between devices and we don't have to have a cookie-cutter approach
to healthcare security. Another big thing I realized is us as researchers or the FDA or the MDM,
we don't like to play nice together. We don't like to listen to someone that has a difference
of opinion than we do. We don't like criticism. We don't like to debate situations. But the fact
remains that working together is the only way that we get to solve healthcare. After all,
it takes a village or even two for that to even happen. I think it's a smarter way
to pull resources together and hit this problem from all sides.
It needs to be a multidisciplinary approach to solving the problem that is healthcare and
medical device security. So let's see some solutions. We need to define things better.
We need to assign the responsibility and accountability to the parties involved.
We need to not trust implicitly. We should not put devices into our networks and trust them
with the keys to the kingdom. We should assume that a device is breached at all times,
because most likely it is, because you don't know otherwise. At one point of time, we are gonna
see medical devices breached. Well, they might already be. We need to standardize and set the
tone, the rules of engagements, the rules that are expected from someone. And by someone, I mean
the MDM. These things need to be defined and clarity needs to be given to what the expectation
of a secure device is. I want to see these things on black and white. I don't want to have the
conversation anymore. I want a call to action to make things better, to change it now before legacy
comes and bites us in the ass. Because every year we wait, every year we take, it adds so much more
to the problem. At one point, the problem will become unmanageable if we don't do something now.
If you as a researcher find a vulnerability, do the proof of concept, reach out,
make things better, but don't just find a problem, find a solution. Because
finding problems are easy, breaking in is easy, but it's finding a way for things to work better
that is going to change the world fundamentally. And it's not one person or two people,
but a whole collective effort that will change the future of connected devices.
Thank you very much and please feel free to reach out. Hit me up on Twitter, email me,
go comment on my blog. But I'm looking forward to your questions and I'm looking forward to
the discussion. And thank you for giving me an opportunity to get on my soapbox and for once
be taught, shout in a room about things that are making me angry.