start	end	text
0	9480	Hi everyone, and welcome to How Do We Uniform November Foxtrot Uniform Charlie Kilo Unfuck
9480	17920	Things. Can we really unfuck these things, or is it GARFU? And for those that don't know
17920	26540	the military slang, this is... well, go Google it. It's more fun, right? I don't want to
26540	34520	tell it all to you guys. Just go Google that. This talk is not your normal talk, right?
34520	39240	This is an interpretive dance. This is me getting on my soapbox because I'm five foot
39240	44700	nothing and tell you all the things that needs to be unfucked. This is my own opinion. This
44700	48800	is no one else's opinion. This is conversations that have been had. This is observations that
48800	54580	have been made. So if you're easily offended, this is not the talk for you. Scroll past,
54580	65520	go do some other fluffy stuff. So who am I? I am a DEFCON goon. I'm the founder of DEC2751.
65620	73020	We solely focus on reverse engineering medical devices and making things better. I'm also
73020	79360	an avid biohacker village supporter. I think this is the best village at DEFCON. It's the
79360	86120	one I certainly most enjoy. I'm also a current and independent researcher for Medtronic. And
86120	93720	as you can see in the beautiful picture on the right, that is my Medtronic ICDR. It's what keeps
93720	100840	me breathing and kicking and doing all the things. I'm also a DFIR lethal forensicator. I've been
100840	106660	doing forensics and incident response for many, many years. Yes, I look very young, but I'm much
106660	112560	older than I look. I'm a member of I Am The Calvary. I'm a patient and I proudly refer to
112560	122080	myself as a cyborg. Now, I wanted to do a different talk this year because I believe that if we know
122080	129540	what is wrong, we can find ways to fix them. So this is the talk for all medical device enthusiasts.
129540	134550	Those that want to unfuck the things, those that want to fix it and make it better.
136080	142600	So let's talk about the legacy of all problems, right? I sat down the day and I did the maths.
142600	150320	In the US alone, there are 600,000 new implantable devices every year. These devices
150980	157260	last for approximately a decade. So you start adding these up,
157260	164420	we have a whole sea of devices that sooner or later will add to our technical debt.
165220	172440	In a single hospital, if you put all the devices together within a hospital in the US,
172440	179320	we'll have 10 to 15 million connected medical devices. That's about 10 to 15 connected devices
179320	186340	per patient bed. To give you an example, I was in ICU because often than not, my heart's an asshole.
187010	194180	And it lands me into ICU for some TLC, right? So I go have my holidays. If you look around,
194180	201220	you have infusion pumps, you have monitors, you have external monitors monitoring your pacemaker
201220	211700	or your ICD. And you have central stations. It is this big ocean of leaping lights. I know Jason
211700	218120	Street always refers to it as a box with lengthy lights. Well, go be in an ICU bed, you'll see lots
218120	224380	of those. So when we start realizing how many hospital beds there are, how many devices are
224380	230440	attached to those beds, we start seeing the magnitude of the legacy. We see the ocean of
230440	237580	devices we are faced to protect or to fix. Now, this is what led me down this path,
237580	242540	is that I think we should start fixing the ship now. We can't wait for another year,
242540	245840	can't wait for two, because we're adding to our problem.
247380	251460	And now as we've seen COVID, healthcare has changed forever.
251820	255720	The boundaries have been broken, the perimeters no longer exist.
257900	263620	So you wonder why I say the legacy. Well, in case you did not know, most medical devices are coded
263620	275630	in C. So I decided to do a dad joke. The question is, how are we getting it so wrong? And yeah,
275630	282810	this someone said that someone was me. I want to know why in three years we've made no strides or
282810	289350	why in three years we're doing the same things over and over. Well, let's start at the beginning.
289490	295050	Lack of clear definitions. There's no consistencies in the terms that we use.
295650	302910	I often go to talks and I realize, well, we're talking about medical device security, but the
302910	308910	more that we are listening, I realize it is a Windows 10 endpoint within a healthcare establishment
308910	315670	that we're talking about. Surely that's not the same as an insulin pump, an infusion pump, or even
315810	322430	a pacemaker. Those things don't even look or act the same. So I decided to do what any good researcher
322430	328630	does and I went to the dictionary. I looked up the terms. So let's explore healthcare.
329430	335250	The field concerned with the maintenance and restoration of the health of the body and mind.
337330	343490	It's hard, but this is what healthcare does. This is what hospitals do.
344010	350610	So surely any device that they put there to help facilitate this should be called a healthcare
350610	359490	device. So let's explore what is the meaning of medical relating to medicine or the practice of
359490	366110	medicine. So it is something that allows us to practice medicine. Healthcare is something that
366110	374330	we give to our patients. For me, I started to see the clear separation between the two.
374530	379970	Each one has different responsibilities. Each one has a different function. It is very important
379970	386390	that we start differentiating from the two. An interesting useless fact. Did you know that
386530	393490	a cotton swab is seen as a medical device? Yes, that is for ICD-10 and billing purposes.
394310	397970	I sure as hell don't think it's a device. I think it's a disposable.
398010	403970	It's something we only use once. So let's see. What is a device?
403990	409430	Something contrived for a specific purpose, usually a simple mechanical apparatus.
409970	417250	Okay, so your insulin pump, your pacemaker, those are all a device, right?
417790	423830	Well, now the question is, is it medical or is it healthcare? We need to start differentiating
423830	429830	because each one of the two have different controls, different threats, different weaknesses
429830	436470	and vulnerabilities. In fact, they have different operating systems. We need to clearly understand
437070	443850	what we are dealing with. Now the question is, is it a healthcare or a medical device?
443850	451090	Which button will you choose? Which one will you use? I get very confused because we're using the
451090	456930	same terminology for everything because medical device sounds much more sexier than a healthcare
456930	464450	endpoint or a healthcare device. But that leads me to the point that if we don't start defining
464450	471050	these things out and understanding the ecosystem we are set to protect, we are setting ourselves
471050	481150	up for a hiding. We are literally looking to be spanked. This is something that I'm living my
481150	485950	life towards. When you talk, you are only repeating what you know, but when you listen,
485950	493230	you learn something new. So I went on a year-long journey to understand what devices are telling me.
493230	497370	I wanted to know what secrets they hold.
500220	507260	Why things are so wrong is that we're not assigning responsibility accurately. I know
507260	511560	it's a word that everyone fears because no one wants to be accountable or responsible
512160	518760	for decisions or things they fault. So let's explore the MDM or the medical device
518760	527220	manufacturer's responsibility. They have a responsibility to create devices that aren't
527220	531900	unhackable because let's face it, nothing's unhackable. Everyone gets bored and someone
531900	540280	figures out how to hack a device. But they need to have a device that is secure or as secure and
540280	547100	safe as you can have it. But their responsibility is to deal with the devices both pre-market and
547100	553940	post-market. Meaning that if a vulnerability is found pre-market, they need to fix it before going
553940	559380	to market with the device. They need to do everything in their power to make sure what
559380	564280	they are building, both on a firmware and a hardware level, takes into consideration the
564280	570880	security challenges as well as the clinical features. Because let's face it, security is
570880	577080	not a functional requirement for medical devices. They are there to offer medical care to patients.
578000	584440	Often we see that security is slapped on after the fact, where it should be coming from design
584440	591560	throughout manufacturing to when it goes to market. Now we have a fairly secure device that's
591560	598580	gone to market. For example, an ICD lasts for 10 to 15 years. I can almost guarantee you that in
598580	604500	that time, someone will find a vulnerability. Now we need to fix that vulnerability.
605200	611500	The hospital or healthcare establishment has no power to fix the firmware or even fix the
611500	617690	physical device if there's a vulnerability found. This remains the MDM's responsibility.
618420	623400	Part of their responsibility is having a catalog or register of the information on everything that
623400	629180	goes into their products. For every product they put on market, they have responsibility
629180	632560	towards the end of the lifetime of that device.
633380	639280	If it breaks, they are the only ones that have the power to fix it. No one else.
641200	651500	Now we get to what is the FDA's responsibility? Well, I say the FDA because it's a US conference,
651500	657400	but everyone follows suit of the FDA. If you start researching medical legislation around the world,
657400	662740	you will see the terminology used by the FDA being rolled out in other countries,
662740	667220	meaning they are the leader in this. They are the one that everyone looks up to.
667720	675760	They need more legislative power. They need more teeth. They need to be an enforcer of
675760	683380	what the standard is. They're the one that has to keep the MDM's on track. They are the ones
683380	688500	that gatekeepers to the market for products. They are the ones that need to enforce the
688500	695480	fixing of the problem. I know that they're currently working on new guidances, and I
695480	701820	surely hope that it's got more teeth. An example of this is in the guidances currently at state,
701820	708440	reasonable risk analysis needs to be done. However, the reasonable analysis that is required
708440	715600	for it to meet the reasonable test is not specified. So again, we have guidances that
715600	723140	don't have enough detail or standards out. I'm hoping that from a legislative point of view,
723140	728020	we can actually start setting the tone of what is expected from a medical device,
728020	734440	both on a clinical and both at a security level. And this is not just for implantables.
734440	742480	I know it's a little bit harder when it's inside someone, but let's start categorizing it.
742480	747080	Let's start standardizing the things and setting up the rules of engagement.
748020	754940	What is expected of a device? How should it be used and how it should be updated? These are
754940	761520	things that only can be done by the FDA. They are the rule setters. They are the rule enforcers.
761520	770620	Let me look at what is the HDO's responsibility. Their responsibility is to keep their patients
770620	779520	alive. Their responsibility is to have these diversities of devices on their networks,
779520	787200	but they have to implement them in a safe way, taking into consideration the type of device it
787200	794240	is, how it communicates, and how they are going to introduce it into their ecosystem.
794600	802480	Those are the responsibilities of the HDO. They do not hold a responsibility for updating firmware
802940	810200	or even vulnerability management of devices. That should be a manufacturing role.
810720	819460	We've seen that during COVID-19, HDO's are crumbling globally. Healthcare is fracturing.
819820	825980	And the fact is that they are designed, their purpose is to deal with pandemics and viruses.
826240	832400	We are now expecting them to take on board cybersecurity and do the job of the manufacturer
832400	839480	or do the job of the FDA. That is not what they're designed for. So how can we expect that
839480	845920	they will not crumble and break even further? As a security researcher or a hacker, I don't
845920	850700	want to be responsible for breaking healthcare more. I want to be responsible for making it
850700	857080	better. So we should take into consideration that the decisions they make on a daily basis
857080	864080	are life and death. They have patients connected to them. We shouldn't be making things harder for
864080	871600	an HDO. We should be supporting them and making it safer for them to implement. The last thing I
871600	878040	want is for someone to have a device breached and a patient to lose their life. It puts signs back
878040	884700	tens of decades. And the fact of the matter is I would not be here without my device.
884720	892740	I would be dead at the age of 19. It has extended my life and for that I'm grateful and thankful.
893200	899420	So we cannot go forward and break things more until we have an understanding how we can build
899420	909520	them up. Now the third problem is two worlds colliding, meaning we have this complex ecosystem
910400	916460	that has different devices but we have one way of implementing them. We have a cookie
916460	920420	cutter approach when it comes to infusing medical devices into a hospital
921480	929540	because we don't define these out properly. Are we heading for a big bang or is it going to be
929680	936800	a meeting of the minds? I think we are facing a situation where we're going to have a big bang
938120	947120	because all we need to happen is for these controls to fail. And can you honestly tell me
947120	953200	that you have the same controls for a Windows 10 machine versus a patient bedside monitor
953200	960240	running something like BusyBox, VXWorks or proprietary software? Are these the same?
960240	966340	Do they look the same? Do they sound the same? Do they crack the same? I don't think so. I think
966340	973000	each one comes with different sets of challenges. I found that a hospital is the most complex
973780	979860	sea of devices that I've ever seen and this is just me walking through a hospital. Have you
979860	986220	ever noticed how many different manufacturers can be under one roof? Do you think that those
987480	992860	devices are all made equally and the same? Do you think every manufacturer implies
993480	1001080	the same controls? Has the same way of thinking? No, everyone functions in a silo because there's
1001080	1007800	no clear standard. The standards we are using are those for IoT devices or for regular computers
1007800	1015820	or laptops or endpoints. There's no set of standards specifically catering to medical devices.
1016320	1022280	And to be clear, when I say medical device, I mean that thing made by a manufacturer.
1022860	1027740	Not a Windows 10 running software. That's a different conversation.
1031090	1036510	Again, leading into this, it's the diversity of it all.
1037730	1042790	Have you ever spent time in a hospital and just looked around
1044230	1051050	and then think to yourself, I wonder how they've implemented this? A lot of hospitals will offer
1051390	1061610	Wi-Fi. Those systems are often not segmented. There's the saying in security, trust but verify.
1061830	1066990	Right? We just give everyone access. All the systems have access to everything
1067670	1075190	because we want to make it easier. Now I ask you, if you look at this picture,
1075190	1083330	most of those devices are connected onto the hospital network. These devices all have
1083330	1092710	communications. But all these devices are most likely very different in how they apply security.
1092750	1097290	And let me tell you, often we do this thing where security is an afterthought
1097290	1105070	or a post-market situation. We don't give developers or hardware engineers
1106210	1114430	the information to become security-minded developers, security-minded hardware engineers.
1114670	1122190	Security can be built into every portion of your pipeline and should be. We should be taking this
1122190	1130110	as a requirement to look at. I'm also big that one day these devices will be hacked. In fact,
1130110	1135930	they might already be hacked because we don't have the data to pull from to say whether or
1135930	1142410	not the device has been hacked. Always in incident response, we come after the fact and say,
1142410	1148010	oh, if I only had logs, oh, if I only had this piece of evidence. We should be building in
1148010	1155130	these controls to be able to visualize what's going on on the device. Now you might ask how I
1155130	1162190	know this. Well, I have a whole room filled with medical devices. I have a whole library filled
1162190	1168130	with firmware. I have been doing forensics for the last year. I'm trying to determine whether or not
1168130	1174430	there's any logging or whether or not I even have the ability to do a forensic investigation.
1174430	1180490	And I can tell you that no, because no one considers the fact that these devices
1180490	1185610	will inevitably one day get reached if they have not already.
1186850	1193650	A big thing that I want to see change is that we have proper standards and rigorous guidances.
1194030	1200730	These things should be enforced. They should not be if you want to do the following.
1201080	1207220	There should be repercussions for MDM not following standards and guidances.
1208310	1214360	I have spent significant time looking at the NIST standards currently used for medical devices.
1215250	1224500	These things are referencing machines that have Windows or Microsoft or different protocols.
1224500	1232040	They don't take into consideration what a medical device is. I want to see controls.
1232140	1238640	Controls are there for specific devices, but we need to categorize these first.
1238840	1243980	And I think before we get ahead, the first and foremost thing that needs to change is the fact
1243980	1250720	that we need to start understanding what a medical device is as well as subcategories of that device.
1251460	1257800	I think once we have clearer understanding, we can have better standards.
1258040	1263140	I would love to see a NIST standard specifically catering to medical devices,
1263640	1268720	specifically taking into consideration the unique challenges they face.
1272040	1281000	And how do I know these things? Data never lies. It's the one thing that you can listen to.
1281000	1288260	Yes, data can be manipulated, but this is data that's collected over long periods of time.
1289040	1295500	Healthcare has become the biggest target at the moment. Not only are they facing keeping people
1295500	1303400	alive, they are facing attacks from all avenues. The internal threat or the malicious actor from
1303400	1310080	within has certainly taken a rise. I was very shocked to learn the other day that 18% of
1310080	1317160	healthcare workers stated that they would sell patient records for the right price.
1317460	1321580	We never consider that the greatest threat might come from within.
1324130	1330350	So now we've spoken a lot about the problems, but there is a saving grace. There's something
1330350	1336990	that I really believe has the right approach to dealing with the complex problem that is
1336990	1342750	medical devices within a hospital. It is called the Zero Trust Network.
1343530	1350490	Trust is neither a zero nor a one. This turns the whole security on its head, where we no longer
1350490	1357150	just trust but verify. We verify but never trust. We no longer have this perimeter-based defense
1357150	1365010	structure that we used to have. I think most hospitals build this huge wall and make their
1365010	1371370	perimeter hard, but never considering that patients walk in and out of a hospital wearing
1371370	1379840	wearables with embedded devices or, you know, introducing medical devices that are connected.
1380590	1389090	I've often seen that hospitals get breached via a phishing email or via a system that
1389090	1396390	should not have access to the whole entire network. This is a very important thing for me,
1396390	1402690	because this could lead to us defining that, you know, the least privilege and the least access
1402690	1408750	that a device should have on a network. And especially with electronic healthcare records
1408750	1416590	moving to the cloud, not every system needs to have access to that. We should be limiting what
1416590	1423310	devices have access and how they have access. And I think one of the biggest things and the
1423310	1429030	most promising things is if we find that a device is no longer conforming to the rules and the
1429030	1437410	controls we've set up, you can revoke the access for that device. It breaks down the perimeter
1437410	1443550	and makes it more secure. It makes it more manageable, because now we have the ability
1444190	1451610	to differentiate between devices and we don't have to have a cookie-cutter approach
1451610	1461770	to healthcare security. Another big thing I realized is us as researchers or the FDA or the MDM,
1461770	1467590	we don't like to play nice together. We don't like to listen to someone that has a difference
1467590	1476050	of opinion than we do. We don't like criticism. We don't like to debate situations. But the fact
1476050	1482070	remains that working together is the only way that we get to solve healthcare. After all,
1482070	1490570	it takes a village or even two for that to even happen. I think it's a smarter way
1490970	1496990	to pull resources together and hit this problem from all sides.
1496990	1502850	It needs to be a multidisciplinary approach to solving the problem that is healthcare and
1502850	1510310	medical device security. So let's see some solutions. We need to define things better.
1510590	1515410	We need to assign the responsibility and accountability to the parties involved.
1516190	1524770	We need to not trust implicitly. We should not put devices into our networks and trust them
1524770	1531150	with the keys to the kingdom. We should assume that a device is breached at all times,
1531150	1537710	because most likely it is, because you don't know otherwise. At one point of time, we are gonna
1537710	1546210	see medical devices breached. Well, they might already be. We need to standardize and set the
1546210	1552430	tone, the rules of engagements, the rules that are expected from someone. And by someone, I mean
1552430	1559290	the MDM. These things need to be defined and clarity needs to be given to what the expectation
1559290	1567430	of a secure device is. I want to see these things on black and white. I don't want to have the
1567430	1574850	conversation anymore. I want a call to action to make things better, to change it now before legacy
1574850	1585450	comes and bites us in the ass. Because every year we wait, every year we take, it adds so much more
1585450	1593030	to the problem. At one point, the problem will become unmanageable if we don't do something now.
1593830	1601630	If you as a researcher find a vulnerability, do the proof of concept, reach out,
1602530	1609070	make things better, but don't just find a problem, find a solution. Because
1609830	1616130	finding problems are easy, breaking in is easy, but it's finding a way for things to work better
1616130	1622190	that is going to change the world fundamentally. And it's not one person or two people,
1622190	1628890	but a whole collective effort that will change the future of connected devices.
1632170	1640050	Thank you very much and please feel free to reach out. Hit me up on Twitter, email me,
1640050	1644610	go comment on my blog. But I'm looking forward to your questions and I'm looking forward to
1644610	1649590	the discussion. And thank you for giving me an opportunity to get on my soapbox and for once
1649590	1654110	be taught, shout in a room about things that are making me angry.