WEBVTT 00:00.000 --> 00:10.560 Hi everyone, and welcome to How Do We Uniform November Foxtrot Uniform Charlie Kilo Unfuck Things. 00:11.880 --> 00:16.360 Can we really unfuck these things, or is it GARFU? 00:16.800 --> 00:24.120 And for those that don't know the military slang, this is... well, go Google it. 00:24.120 --> 00:26.020 It's more fun, right? 00:26.020 --> 00:28.060 I don't want to tell it all to you guys. 00:28.460 --> 00:30.020 Just go Google that. 00:31.100 --> 00:34.520 This talk is not your normal talk, right? 00:34.520 --> 00:36.280 This is an interpretive dance. 00:36.280 --> 00:42.440 This is me getting on my soapbox because I'm five foot nothing and tell you all the things that needs to be unfucked. 00:42.680 --> 00:44.560 This is my own opinion. 00:44.560 --> 00:46.020 This is no one else's opinion. 00:46.020 --> 00:47.700 This is conversations that have been had. 00:47.700 --> 00:49.360 This is observations that have been made. 00:49.360 --> 00:53.760 So if you're easily offended, this is not the talk for you. 00:53.760 --> 00:57.020 Scroll past, go do some other fluffy stuff. 00:57.520 --> 00:59.540 So who am I? 00:59.600 --> 01:02.100 I am a DEFCON goon. 01:02.100 --> 01:05.520 I'm the founder of DEC2751. 01:05.620 --> 01:11.880 We solely focus on reverse engineering medical devices and making things better. 01:12.040 --> 01:15.940 I'm also an avid biohacker village supporter. 01:15.940 --> 01:19.020 I think this is the best village at DEFCON. 01:19.020 --> 01:21.880 It's the one I certainly most enjoy. 01:22.000 --> 01:25.860 I'm also a current and independent researcher for Medtronic. 01:25.860 --> 01:32.060 And as you can see in the beautiful picture on the right, that is my Medtronic ICDR. 01:32.660 --> 01:37.620 It's what keeps me breathing and kicking and doing all the things. 01:37.820 --> 01:40.760 I'm also a DFIR lethal forensicator. 01:40.760 --> 01:43.940 I've been doing forensics and incident response for many, many years. 01:43.940 --> 01:48.200 Yes, I look very young, but I'm much older than I look. 01:48.440 --> 01:50.460 I'm a member of I Am The Calvary. 01:50.460 --> 01:54.320 I'm a patient and I proudly refer to myself as a cyborg. 01:55.920 --> 02:05.640 Now, I wanted to do a different talk this year because I believe that if we know what is wrong, we can find ways to fix them. 02:05.780 --> 02:09.540 So this is the talk for all medical device enthusiasts. 02:09.540 --> 02:14.550 Those that want to unfuck the things, those that want to fix it and make it better. 02:16.080 --> 02:20.360 So let's talk about the legacy of all problems, right? 02:20.360 --> 02:22.600 I sat down the day and I did the maths. 02:22.600 --> 02:29.140 In the US alone, there are 600,000 new implantable devices every year. 02:29.340 --> 02:34.300 These devices last for approximately a decade. 02:34.300 --> 02:44.420 So you start adding these up, we have a whole sea of devices that sooner or later will add to our technical debt. 02:45.220 --> 02:56.540 In a single hospital, if you put all the devices together within a hospital in the US, we'll have 10 to 15 million connected medical devices. 02:56.540 --> 03:00.880 That's about 10 to 15 connected devices per patient bed. 03:00.880 --> 03:06.340 To give you an example, I was in ICU because often than not, my heart's an asshole. 03:07.010 --> 03:11.000 And it lands me into ICU for some TLC, right? 03:11.000 --> 03:12.760 So I go have my holidays. 03:12.760 --> 03:23.060 If you look around, you have infusion pumps, you have monitors, you have external monitors monitoring your pacemaker or your ICD. 03:23.440 --> 03:25.900 And you have central stations. 03:25.960 --> 03:30.760 It is this big ocean of leaping lights. 03:30.840 --> 03:35.640 I know Jason Street always refers to it as a box with lengthy lights. 03:35.640 --> 03:39.060 Well, go be in an ICU bed, you'll see lots of those. 03:39.500 --> 03:49.060 So when we start realizing how many hospital beds there are, how many devices are attached to those beds, we start seeing the magnitude of the legacy. 03:49.300 --> 03:54.200 We see the ocean of devices we are faced to protect or to fix. 03:54.740 --> 04:00.720 Now, this is what led me down this path, is that I think we should start fixing the ship now. 04:00.720 --> 04:05.840 We can't wait for another year, can't wait for two, because we're adding to our problem. 04:07.380 --> 04:11.460 And now as we've seen COVID, healthcare has changed forever. 04:11.820 --> 04:15.720 The boundaries have been broken, the perimeters no longer exist. 04:17.900 --> 04:20.540 So you wonder why I say the legacy. 04:20.540 --> 04:24.640 Well, in case you did not know, most medical devices are coded in C. 04:25.180 --> 04:28.000 So I decided to do a dad joke. 04:30.490 --> 04:34.830 The question is, how are we getting it so wrong? 04:34.870 --> 04:38.330 And yeah, this someone said that someone was me. 04:39.050 --> 04:46.190 I want to know why in three years we've made no strides or why in three years we're doing the same things over and over. 04:47.230 --> 04:49.350 Well, let's start at the beginning. 04:49.490 --> 04:51.450 Lack of clear definitions. 04:51.710 --> 04:55.050 There's no consistencies in the terms that we use. 04:55.650 --> 05:10.690 I often go to talks and I realize, well, we're talking about medical device security, but the more that we are listening, I realize it is a Windows 10 endpoint within a healthcare establishment that we're talking about. 05:11.050 --> 05:16.930 Surely that's not the same as an insulin pump, an infusion pump, or even a pacemaker. 05:17.190 --> 05:19.770 Those things don't even look or act the same. 05:20.030 --> 05:24.590 So I decided to do what any good researcher does and I went to the dictionary. 05:24.590 --> 05:26.310 I looked up the terms. 05:26.870 --> 05:28.630 So let's explore healthcare. 05:29.430 --> 05:35.250 The field concerned with the maintenance and restoration of the health of the body and mind. 05:37.330 --> 05:41.530 It's hard, but this is what healthcare does. 05:41.530 --> 05:43.490 This is what hospitals do. 05:44.010 --> 05:51.510 So surely any device that they put there to help facilitate this should be called a healthcare device. 05:52.570 --> 06:00.710 So let's explore what is the meaning of medical relating to medicine or the practice of medicine. 06:01.130 --> 06:04.990 So it is something that allows us to practice medicine. 06:04.990 --> 06:08.090 Healthcare is something that we give to our patients. 06:08.830 --> 06:14.330 For me, I started to see the clear separation between the two. 06:14.530 --> 06:16.850 Each one has different responsibilities. 06:16.850 --> 06:18.770 Each one has a different function. 06:18.770 --> 06:23.090 It is very important that we start differentiating from the two. 06:23.750 --> 06:25.730 An interesting useless fact. 06:25.730 --> 06:29.210 Did you know that a cotton swab is seen as a medical device? 06:30.250 --> 06:33.490 Yes, that is for ICD-10 and billing purposes. 06:34.310 --> 06:36.350 I sure as hell don't think it's a device. 06:36.350 --> 06:37.970 I think it's a disposable. 06:38.010 --> 06:40.050 It's something we only use once. 06:40.730 --> 06:42.270 So let's see. 06:42.270 --> 06:43.970 What is a device? 06:43.990 --> 06:49.430 Something contrived for a specific purpose, usually a simple mechanical apparatus. 06:49.970 --> 06:57.250 Okay, so your insulin pump, your pacemaker, those are all a device, right? 06:57.790 --> 07:00.990 Well, now the question is, is it medical or is it healthcare? 07:01.030 --> 07:11.130 We need to start differentiating because each one of the two have different controls, different threats, different weaknesses and vulnerabilities. 07:11.390 --> 07:14.450 In fact, they have different operating systems. 07:14.450 --> 07:19.110 We need to clearly understand what we are dealing with. 07:19.950 --> 07:23.850 Now the question is, is it a healthcare or a medical device? 07:23.850 --> 07:25.970 Which button will you choose? 07:26.070 --> 07:28.010 Which one will you use? 07:28.430 --> 07:39.370 I get very confused because we're using the same terminology for everything because medical device sounds much more sexier than a healthcare endpoint or a healthcare device. 07:40.010 --> 07:52.690 But that leads me to the point that if we don't start defining these things out and understanding the ecosystem we are set to protect, we are setting ourselves up for a hiding. 07:52.810 --> 07:56.350 We are literally looking to be spanked. 07:59.450 --> 08:01.890 This is something that I'm living my life towards. 08:01.890 --> 08:07.670 When you talk, you are only repeating what you know, but when you listen, you learn something new. 08:07.890 --> 08:13.230 So I went on a year-long journey to understand what devices are telling me. 08:13.230 --> 08:17.370 I wanted to know what secrets they hold. 08:20.220 --> 08:26.300 Why things are so wrong is that we're not assigning responsibility accurately. 08:26.500 --> 08:34.840 I know it's a word that everyone fears because no one wants to be accountable or responsible for decisions or things they fault. 08:35.460 --> 08:41.100 So let's explore the MDM or the medical device manufacturer's responsibility. 08:41.300 --> 08:50.380 They have a responsibility to create devices that aren't unhackable because let's face it, nothing's unhackable. 08:50.380 --> 08:54.200 Everyone gets bored and someone figures out how to hack a device. 08:54.280 --> 09:02.320 But they need to have a device that is secure or as secure and safe as you can have it. 09:02.320 --> 09:08.460 But their responsibility is to deal with the devices both pre-market and post-market. 09:08.680 --> 09:15.900 Meaning that if a vulnerability is found pre-market, they need to fix it before going to market with the device. 09:15.900 --> 09:28.540 They need to do everything in their power to make sure what they are building, both on a firmware and a hardware level, takes into consideration the security challenges as well as the clinical features. 09:28.640 --> 09:34.120 Because let's face it, security is not a functional requirement for medical devices. 09:34.120 --> 09:37.080 They are there to offer medical care to patients. 09:38.000 --> 09:48.500 Often we see that security is slapped on after the fact, where it should be coming from design throughout manufacturing to when it goes to market. 09:49.180 --> 09:52.860 Now we have a fairly secure device that's gone to market. 09:52.960 --> 09:56.860 For example, an ICD lasts for 10 to 15 years. 09:56.860 --> 10:01.300 I can almost guarantee you that in that time, someone will find a vulnerability. 10:01.940 --> 10:04.500 Now we need to fix that vulnerability. 10:05.200 --> 10:14.760 The hospital or healthcare establishment has no power to fix the firmware or even fix the physical device if there's a vulnerability found. 10:14.800 --> 10:17.690 This remains the MDM's responsibility. 10:18.420 --> 10:25.660 Part of their responsibility is having a catalog or register of the information on everything that goes into their products. 10:25.760 --> 10:32.560 For every product they put on market, they have responsibility towards the end of the lifetime of that device. 10:33.380 --> 10:38.040 If it breaks, they are the only ones that have the power to fix it. 10:38.040 --> 10:39.280 No one else. 10:41.200 --> 10:44.780 Now we get to what is the FDA's responsibility? 10:45.560 --> 10:53.740 Well, I say the FDA because it's a US conference, but everyone follows suit of the FDA. 10:53.740 --> 11:04.820 If you start researching medical legislation around the world, you will see the terminology used by the FDA being rolled out in other countries, meaning they are the leader in this. 11:04.820 --> 11:07.220 They are the one that everyone looks up to. 11:07.720 --> 11:10.740 They need more legislative power. 11:10.740 --> 11:12.560 They need more teeth. 11:12.800 --> 11:18.280 They need to be an enforcer of what the standard is. 11:18.320 --> 11:22.300 They're the one that has to keep the MDM's on track. 11:22.420 --> 11:26.440 They are the ones that gatekeepers to the market for products. 11:26.440 --> 11:30.260 They are the ones that need to enforce the fixing of the problem. 11:31.220 --> 11:37.940 I know that they're currently working on new guidances, and I surely hope that it's got more teeth. 11:37.940 --> 11:44.960 An example of this is in the guidances currently at state, reasonable risk analysis needs to be done. 11:45.020 --> 11:52.580 However, the reasonable analysis that is required for it to meet the reasonable test is not specified. 11:53.400 --> 11:59.040 So again, we have guidances that don't have enough detail or standards out. 11:59.060 --> 12:11.640 I'm hoping that from a legislative point of view, we can actually start setting the tone of what is expected from a medical device, both on a clinical and both at a security level. 12:12.000 --> 12:14.440 And this is not just for implantables. 12:14.440 --> 12:22.480 I know it's a little bit harder when it's inside someone, but let's start categorizing it. 12:22.480 --> 12:27.080 Let's start standardizing the things and setting up the rules of engagement. 12:28.020 --> 12:30.300 What is expected of a device? 12:30.300 --> 12:34.360 How should it be used and how it should be updated? 12:34.520 --> 12:37.600 These are things that only can be done by the FDA. 12:38.020 --> 12:39.780 They are the rule setters. 12:39.780 --> 12:41.520 They are the rule enforcers. 12:41.520 --> 12:47.580 Let me look at what is the HDO's responsibility. 12:47.840 --> 12:51.880 Their responsibility is to keep their patients alive. 12:51.880 --> 13:14.240 Their responsibility is to have these diversities of devices on their networks, but they have to implement them in a safe way, taking into consideration the type of device it is, how it communicates, and how they are going to introduce it into their ecosystem. 13:14.600 --> 13:18.320 Those are the responsibilities of the HDO. 13:18.320 --> 13:27.040 They do not hold a responsibility for updating firmware or even vulnerability management of devices. 13:27.040 --> 13:30.200 That should be a manufacturing role. 13:30.720 --> 13:36.100 We've seen that during COVID-19, HDO's are crumbling globally. 13:36.100 --> 13:39.460 Healthcare is fracturing. 13:39.820 --> 13:45.980 And the fact is that they are designed, their purpose is to deal with pandemics and viruses. 13:46.240 --> 13:54.680 We are now expecting them to take on board cybersecurity and do the job of the manufacturer or do the job of the FDA. 13:55.280 --> 13:57.740 That is not what they're designed for. 13:57.800 --> 14:02.800 So how can we expect that they will not crumble and break even further? 14:02.820 --> 14:08.980 As a security researcher or a hacker, I don't want to be responsible for breaking healthcare more. 14:08.980 --> 14:11.620 I want to be responsible for making it better. 14:12.080 --> 14:19.080 So we should take into consideration that the decisions they make on a daily basis are life and death. 14:19.460 --> 14:22.040 They have patients connected to them. 14:22.040 --> 14:25.240 We shouldn't be making things harder for an HDO. 14:25.240 --> 14:30.020 We should be supporting them and making it safer for them to implement. 14:30.480 --> 14:36.500 The last thing I want is for someone to have a device breached and a patient to lose their life. 14:36.500 --> 14:39.760 It puts signs back tens of decades. 14:40.060 --> 14:44.700 And the fact of the matter is I would not be here without my device. 14:44.720 --> 14:47.020 I would be dead at the age of 19. 14:48.160 --> 14:52.740 It has extended my life and for that I'm grateful and thankful. 14:53.200 --> 15:00.500 So we cannot go forward and break things more until we have an understanding how we can build them up. 15:01.880 --> 15:15.700 Now the third problem is two worlds colliding, meaning we have this complex ecosystem that has different devices but we have one way of implementing them. 15:15.700 --> 15:24.900 We have a cookie cutter approach when it comes to infusing medical devices into a hospital because we don't define these out properly. 15:25.840 --> 15:31.260 Are we heading for a big bang or is it going to be a meeting of the minds? 15:32.260 --> 15:44.260 I think we are facing a situation where we're going to have a big bang because all we need to happen is for these controls to fail. 15:45.080 --> 15:57.600 And can you honestly tell me that you have the same controls for a Windows 10 machine versus a patient bedside monitor running something like BusyBox, VXWorks or proprietary software? 15:58.500 --> 16:00.240 Are these the same? 16:00.240 --> 16:01.520 Do they look the same? 16:01.520 --> 16:02.620 Do they sound the same? 16:02.620 --> 16:04.180 Do they crack the same? 16:04.180 --> 16:05.940 I don't think so. 16:05.940 --> 16:09.360 I think each one comes with different sets of challenges. 16:09.820 --> 16:19.360 I found that a hospital is the most complex sea of devices that I've ever seen and this is just me walking through a hospital. 16:19.480 --> 16:24.080 Have you ever noticed how many different manufacturers can be under one roof? 16:24.800 --> 16:30.400 Do you think that those devices are all made equally and the same? 16:30.400 --> 16:35.180 Do you think every manufacturer implies the same controls? 16:35.320 --> 16:37.740 Has the same way of thinking? 16:38.180 --> 16:42.540 No, everyone functions in a silo because there's no clear standard. 16:42.540 --> 16:50.580 The standards we are using are those for IoT devices or for regular computers or laptops or endpoints. 16:50.600 --> 16:55.820 There's no set of standards specifically catering to medical devices. 16:56.320 --> 17:02.280 And to be clear, when I say medical device, I mean that thing made by a manufacturer. 17:02.860 --> 17:05.560 Not a Windows 10 running software. 17:05.700 --> 17:07.740 That's a different conversation. 17:11.090 --> 17:16.510 Again, leading into this, it's the diversity of it all. 17:17.730 --> 17:29.250 Have you ever spent time in a hospital and just looked around and then think to yourself, I wonder how they've implemented this? 17:29.250 --> 17:32.770 A lot of hospitals will offer Wi-Fi. 17:33.590 --> 17:37.330 Those systems are often not segmented. 17:37.330 --> 17:41.610 There's the saying in security, trust but verify. 17:41.830 --> 17:42.670 Right? 17:42.670 --> 17:44.730 We just give everyone access. 17:44.730 --> 17:49.990 All the systems have access to everything because we want to make it easier. 17:51.430 --> 18:00.730 Now I ask you, if you look at this picture, most of those devices are connected onto the hospital network. 18:01.170 --> 18:04.910 These devices all have communications. 18:05.710 --> 18:12.710 But all these devices are most likely very different in how they apply security. 18:12.750 --> 18:20.790 And let me tell you, often we do this thing where security is an afterthought or a post-market situation. 18:20.790 --> 18:34.430 We don't give developers or hardware engineers the information to become security-minded developers, security-minded hardware engineers. 18:34.670 --> 18:40.670 Security can be built into every portion of your pipeline and should be. 18:40.670 --> 18:45.290 We should be taking this as a requirement to look at. 18:45.630 --> 18:49.650 I'm also big that one day these devices will be hacked. 18:49.650 --> 18:57.910 In fact, they might already be hacked because we don't have the data to pull from to say whether or not the device has been hacked. 18:58.490 --> 19:06.630 Always in incident response, we come after the fact and say, oh, if I only had logs, oh, if I only had this piece of evidence. 19:06.630 --> 19:13.410 We should be building in these controls to be able to visualize what's going on on the device. 19:13.690 --> 19:16.210 Now you might ask how I know this. 19:16.210 --> 19:20.410 Well, I have a whole room filled with medical devices. 19:20.490 --> 19:23.410 I have a whole library filled with firmware. 19:23.650 --> 19:26.310 I have been doing forensics for the last year. 19:26.310 --> 19:34.430 I'm trying to determine whether or not there's any logging or whether or not I even have the ability to do a forensic investigation. 19:34.430 --> 19:45.610 And I can tell you that no, because no one considers the fact that these devices will inevitably one day get reached if they have not already. 19:46.850 --> 19:53.650 A big thing that I want to see change is that we have proper standards and rigorous guidances. 19:54.030 --> 19:56.950 These things should be enforced. 19:56.950 --> 20:00.730 They should not be if you want to do the following. 20:01.080 --> 20:07.220 There should be repercussions for MDM not following standards and guidances. 20:08.310 --> 20:14.360 I have spent significant time looking at the NIST standards currently used for medical devices. 20:15.250 --> 20:24.500 These things are referencing machines that have Windows or Microsoft or different protocols. 20:24.500 --> 20:29.820 They don't take into consideration what a medical device is. 20:29.980 --> 20:32.040 I want to see controls. 20:32.140 --> 20:38.640 Controls are there for specific devices, but we need to categorize these first. 20:38.840 --> 20:50.720 And I think before we get ahead, the first and foremost thing that needs to change is the fact that we need to start understanding what a medical device is as well as subcategories of that device. 20:51.460 --> 20:57.800 I think once we have clearer understanding, we can have better standards. 20:58.040 --> 21:08.720 I would love to see a NIST standard specifically catering to medical devices, specifically taking into consideration the unique challenges they face. 21:12.040 --> 21:14.560 And how do I know these things? 21:15.440 --> 21:17.500 Data never lies. 21:17.600 --> 21:21.000 It's the one thing that you can listen to. 21:21.000 --> 21:28.260 Yes, data can be manipulated, but this is data that's collected over long periods of time. 21:29.040 --> 21:33.160 Healthcare has become the biggest target at the moment. 21:33.160 --> 21:39.920 Not only are they facing keeping people alive, they are facing attacks from all avenues. 21:40.340 --> 21:46.640 The internal threat or the malicious actor from within has certainly taken a rise. 21:46.640 --> 21:57.160 I was very shocked to learn the other day that 18% of healthcare workers stated that they would sell patient records for the right price. 21:57.460 --> 22:01.580 We never consider that the greatest threat might come from within. 22:04.130 --> 22:09.730 So now we've spoken a lot about the problems, but there is a saving grace. 22:09.730 --> 22:19.590 There's something that I really believe has the right approach to dealing with the complex problem that is medical devices within a hospital. 22:19.870 --> 22:22.750 It is called the Zero Trust Network. 22:23.530 --> 22:26.170 Trust is neither a zero nor a one. 22:26.850 --> 22:32.010 This turns the whole security on its head, where we no longer just trust but verify. 22:32.010 --> 22:34.210 We verify but never trust. 22:34.370 --> 22:40.010 We no longer have this perimeter-based defense structure that we used to have. 22:40.390 --> 22:59.840 I think most hospitals build this huge wall and make their perimeter hard, but never considering that patients walk in and out of a hospital wearing wearables with embedded devices or, you know, introducing medical devices that are connected. 23:00.590 --> 23:13.050 I've often seen that hospitals get breached via a phishing email or via a system that should not have access to the whole entire network. 23:13.610 --> 23:25.550 This is a very important thing for me, because this could lead to us defining that, you know, the least privilege and the least access that a device should have on a network. 23:25.750 --> 23:34.910 And especially with electronic healthcare records moving to the cloud, not every system needs to have access to that. 23:35.030 --> 23:40.510 We should be limiting what devices have access and how they have access. 23:40.850 --> 23:54.090 And I think one of the biggest things and the most promising things is if we find that a device is no longer conforming to the rules and the controls we've set up, you can revoke the access for that device. 23:55.190 --> 23:59.750 It breaks down the perimeter and makes it more secure. 23:59.750 --> 24:14.270 It makes it more manageable, because now we have the ability to differentiate between devices and we don't have to have a cookie-cutter approach to healthcare security. 24:15.630 --> 24:24.390 Another big thing I realized is us as researchers or the FDA or the MDM, we don't like to play nice together. 24:24.430 --> 24:29.550 We don't like to listen to someone that has a difference of opinion than we do. 24:30.130 --> 24:32.310 We don't like criticism. 24:32.430 --> 24:35.230 We don't like to debate situations. 24:35.250 --> 24:41.230 But the fact remains that working together is the only way that we get to solve healthcare. 24:41.230 --> 24:47.170 After all, it takes a village or even two for that to even happen. 24:48.150 --> 24:56.990 I think it's a smarter way to pull resources together and hit this problem from all sides. 24:56.990 --> 25:04.970 It needs to be a multidisciplinary approach to solving the problem that is healthcare and medical device security. 25:05.130 --> 25:07.910 So let's see some solutions. 25:07.970 --> 25:10.310 We need to define things better. 25:10.590 --> 25:15.410 We need to assign the responsibility and accountability to the parties involved. 25:16.190 --> 25:19.590 We need to not trust implicitly. 25:19.790 --> 25:26.830 We should not put devices into our networks and trust them with the keys to the kingdom. 25:27.010 --> 25:34.930 We should assume that a device is breached at all times, because most likely it is, because you don't know otherwise. 25:34.930 --> 25:40.330 At one point of time, we are gonna see medical devices breached. 25:40.670 --> 25:43.070 Well, they might already be. 25:43.530 --> 25:51.310 We need to standardize and set the tone, the rules of engagements, the rules that are expected from someone. 25:51.310 --> 25:53.830 And by someone, I mean the MDM. 25:54.130 --> 26:01.690 These things need to be defined and clarity needs to be given to what the expectation of a secure device is. 26:02.390 --> 26:05.990 I want to see these things on black and white. 26:05.990 --> 26:09.250 I don't want to have the conversation anymore. 26:09.350 --> 26:17.270 I want a call to action to make things better, to change it now before legacy comes and bites us in the ass. 26:17.910 --> 26:26.870 Because every year we wait, every year we take, it adds so much more to the problem. 26:27.430 --> 26:33.030 At one point, the problem will become unmanageable if we don't do something now. 26:33.830 --> 26:48.050 If you as a researcher find a vulnerability, do the proof of concept, reach out, make things better, but don't just find a problem, find a solution. 26:48.890 --> 26:59.210 Because finding problems are easy, breaking in is easy, but it's finding a way for things to work better that is going to change the world fundamentally. 26:59.210 --> 27:08.890 And it's not one person or two people, but a whole collective effort that will change the future of connected devices. 27:12.170 --> 27:16.270 Thank you very much and please feel free to reach out. 27:16.610 --> 27:21.750 Hit me up on Twitter, email me, go comment on my blog. 27:21.750 --> 27:25.810 But I'm looking forward to your questions and I'm looking forward to the discussion. 27:25.990 --> 27:34.110 And thank you for giving me an opportunity to get on my soapbox and for once be taught, shout in a room about things that are making me angry.