1
00:00:05,880 --> 00:00:08,080
All right, hey, I'm Kwadi.

2
00:00:08,240 --> 00:00:13,900
I'm a weird guy, but I have a foot in two different worlds.

3
00:00:13,940 --> 00:00:19,820
My day job is I'm an ER doc, so I practice in the emergency department.

4
00:00:19,820 --> 00:00:25,980
I also do a lot of research in the security space, so where medicine and security collide.

5
00:00:27,060 --> 00:00:28,120
Enough of that.

6
00:00:28,120 --> 00:00:29,980
Follow me on Twitter if you want.

7
00:00:31,280 --> 00:00:33,300
Next slide, please.

8
00:00:39,700 --> 00:00:52,500
All right, so, you know, this has been my life until things in my neck of the woods kicked up for COVID.

9
00:00:52,500 --> 00:00:55,580
So, you know, we talked about how toilet paper is worth gold.

10
00:00:55,860 --> 00:00:58,900
There was this crazy-ass Netflix show.

11
00:00:59,300 --> 00:01:09,640
But things have changed, you know, and the pandemic started off about tigers and toilet paper, but it's quickly gotten out of hand, and I promise this will become relevant in a little bit.

12
00:01:09,640 --> 00:01:10,660
Next slide.

13
00:01:15,900 --> 00:01:23,580
You know, one of the biggest disappointments in my life in COVID so far has been my inability to eat burritos like I used to before.

14
00:01:23,580 --> 00:01:27,600
I'm sure many of you out there are experiencing a similar problem.

15
00:01:27,880 --> 00:01:30,660
I haven't figured out what the problem is.

16
00:01:30,660 --> 00:01:38,120
I will say coming from San Diego, DCA 58619, we have the best burritos in America.

17
00:01:38,120 --> 00:01:39,740
And so this is a big bummer.

18
00:01:39,740 --> 00:01:40,640
Next slide.

19
00:01:50,350 --> 00:01:51,650
This is my day job.

20
00:01:51,650 --> 00:01:59,430
So this isn't a shot from my ED, my emergency department, but it's pretty much any of the emergency departments across the country right now.

21
00:01:59,650 --> 00:02:04,850
And this has a lot to do with the problems of air crowding.

22
00:02:07,470 --> 00:02:21,310
And we splashed COVID in on that, and now we have basically a greatly diminished ability to take care of patients, and generally a crazy shift every time I go into work, and we're just seeing patients left and right.

23
00:02:21,310 --> 00:02:22,210
Next slide.

24
00:02:27,400 --> 00:02:31,280
So we built these tents, and this is how crazy it was.

25
00:02:31,280 --> 00:02:40,520
So we were so worried about patients overflowing out into the parking lot, et cetera, that we built these emergency tents.

26
00:02:40,520 --> 00:02:55,320
And all these hospitals across the country started as quickly as possible deploying any connected technology they could to extend the capabilities of a hospital into parking lots.

27
00:02:55,880 --> 00:03:01,880
And generally speaking, across the country, this was the right thing to do.

28
00:03:01,880 --> 00:03:09,180
We were so worried about running out of ventilators, et cetera, that there's a mad rush to plug everything in onto the internet.

29
00:03:09,360 --> 00:03:10,440
Next slide.

30
00:03:17,140 --> 00:03:23,360
Just give me a favor out in the crowd, like throw out some hearts or something, if you've been seeing your doctor by Zoom.

31
00:03:24,100 --> 00:03:26,480
Oh yeah, we got some people out there.

32
00:03:26,480 --> 00:03:27,700
Isn't that the weirdest thing?

33
00:03:27,700 --> 00:03:28,280
I don't know.

34
00:03:28,280 --> 00:03:32,680
I'm also kind of curious how many people out there really would prefer this.

35
00:03:32,680 --> 00:03:43,960
But all of a sudden, we went from this world where in emergency medicine, where we take care of heart attacks and gunshot wounds and appendicitis, and sometimes even like just toenails, you know, hangnails.

36
00:03:44,340 --> 00:03:47,880
All of a sudden, we had this capability to do telemedicine.

37
00:03:47,880 --> 00:03:51,520
We were worried about what happens if our faculty gets sick?

38
00:03:51,520 --> 00:03:56,500
What happens if all these ER docs and nurses get COVID and they can't come into work?

39
00:03:56,500 --> 00:03:58,700
But the patients are just going to keep coming.

40
00:03:58,700 --> 00:04:02,560
So we thought to ourselves, you know, we don't normally do telemedicine in emergency medicine.

41
00:04:02,560 --> 00:04:06,740
That's for like primary care doc or your crazy dermatologist or whatever.

42
00:04:06,740 --> 00:04:08,300
But in emergency medicine for the first time,

43
00:04:11,700 --> 00:04:19,460
from our homes when we get COVID, because otherwise those are going to be lost resources and patients aren't going to see doctors.

44
00:04:19,460 --> 00:04:24,820
So it'd be better to see them over an iPad than not see a doctor at all.

45
00:04:24,900 --> 00:04:25,920
Next slide.

46
00:04:32,980 --> 00:04:35,660
And so all of this is kind of my day job.

47
00:04:35,660 --> 00:04:38,860
But for the longest time I've been a hacker, just like you guys out there.

48
00:04:38,860 --> 00:04:40,960
This is me playing OpenCTF.

49
00:04:41,280 --> 00:04:44,340
Shoot, I must have been like DEF CON 14 or 15.

50
00:04:44,340 --> 00:04:45,980
No, I was probably like 16.

51
00:04:46,680 --> 00:05:06,400
And so when you grow up a hacker, and all of a sudden you find yourself in healthcare, and you can't help but think about how easy it would be to socially engineer people in your space, or how insecure some of these systems are, or that you're using medical technology with legacy operating systems,

52
00:05:06,400 --> 00:05:09,640
machines that have been unpatched for over a decade.

53
00:05:09,900 --> 00:05:29,500
These types of things are realities in a lot of places in the world, is that the race to digitize medicine in the race to increase electronic health records and a variety of other things, what we had at the end of the day was hyper connectivity without the commensurate attention to security.

54
00:05:30,100 --> 00:05:37,580
And it's not one of those things that people pay a lot of attention to, but primarily because it's expensive.

55
00:05:38,080 --> 00:05:42,120
There's a lot of other things going on in the space like COVID, for example.

56
00:05:42,260 --> 00:05:51,080
And then also when you buy a medical device, there's a decent chance that that medical device is going to be in production for years and years and years, right?

57
00:05:51,080 --> 00:06:03,700
So if you're at a bank or another company, you might have a much quicker hardware and software lifecycle, as opposed to something like an MRI machine that costs over a million dollars for a hospital .

58
00:06:03,700 --> 00:06:09,820
And when they buy one, they literally have to knock down walls in their hospital to put it in.

59
00:06:09,820 --> 00:06:12,960
And that device is going to be in production for 10 years.

60
00:06:12,960 --> 00:06:20,480
Well, if it took five years to develop it, what operating system do you think it's using its very first day it's on market?

61
00:06:20,480 --> 00:06:23,240
It's going to be the operating system from five years ago.

62
00:06:23,240 --> 00:06:37,120
And so what we have been seeing, unfortunately, a lot of time is these legacy machines are, sorry, our medical devices are obsolete and using basically legacy operating systems while they're still brand new.

63
00:06:37,140 --> 00:06:38,200
Next slide.

64
00:06:46,480 --> 00:06:47,920
I do some research.

65
00:06:47,920 --> 00:06:50,080
So I actually have to publish and do a bunch of stuff.

66
00:06:50,080 --> 00:06:57,340
So one piece of research we did that turned into a DEF CON Talk at 20 was we looked at the 911 system.

67
00:06:57,340 --> 00:07:04,880
So I studied a lot of out-of-hospital cardiac arrest, so basically what happens if your heart stops right before we do shocks and CPR.

68
00:07:05,040 --> 00:07:07,680
And I listened to thousands of 911 calls.

69
00:07:07,680 --> 00:07:11,940
And after I listened to so many of them, there were some failures I noticed.

70
00:07:11,940 --> 00:07:13,680
And one of them were technical failures.

71
00:07:13,680 --> 00:07:25,060
So for example, someone would pop up on their phone, try to get some location service to identify where they were, because a dispatcher on the 911 call would be asking for their location, and they would say, you know, I'm here.

72
00:07:25,060 --> 00:07:29,960
But in actuality, they were half a mile away because of bad location technology.

73
00:07:29,960 --> 00:07:40,720
Or if they were using cell phone triangulation, for example, to identify where a patient in distress was, we can tell based on, you know, there's a whole bunch of reasons why that technology could fail.

74
00:07:41,380 --> 00:07:53,940
And one of the things I realized was, like, what is the security and technical underpinnings of a 911 system, you know, a system that so many patients rely on every single day in the most dire circumstances to make sure that they live.

75
00:07:53,940 --> 00:07:56,900
And so we did some research over a year that talks up on YouTube.

76
00:07:56,900 --> 00:07:59,080
I think it's Defcon 20 or 22.

77
00:07:59,180 --> 00:08:00,240
I can't remember.

78
00:08:00,320 --> 00:08:06,480
But the talk just goes through basically how insecure and antiquated our 911 infrastructure is.

79
00:08:06,480 --> 00:08:14,120
If you're an old phone freaker, you're going to get a kick out of the top, because of just how old the technology is that they were using back then.

80
00:08:14,120 --> 00:08:21,860
And then we did some stuff a couple years ago looking at how secure are your laboratory information systems?

81
00:08:21,860 --> 00:08:28,140
You know, when you get your labs back from a doctor, you go to your doctor, they order a bunch of blood work or an x-ray.

82
00:08:28,380 --> 00:08:34,260
And how secure, how confident are you in the integrity of that data?

83
00:08:34,260 --> 00:08:49,360
So we looked at these things called laboratory information systems, and we were able to basically show it's relatively easy to perform some very trivial man-in-the-middle attacks or person-in-the-middle attacks, and change laboratory values in patients in the hospital.

84
00:08:49,360 --> 00:08:50,280
So what does that mean?

85
00:08:50,280 --> 00:08:54,780
You go into the hospital, you really just ate a bad burrito, and that's why your stomach's hurting.

86
00:08:54,840 --> 00:09:01,720
I changed your blood work to make it look like you have diabetic ketoacidosis, you know, an emergency condition.

87
00:09:01,820 --> 00:09:06,540
The doctor looks at your labs, and she said, oh, wow, it looks like you're really sick, when in actuality, you're not.

88
00:09:06,540 --> 00:09:10,000
We changed the values, and they give you a treatment you don't need.

89
00:09:10,000 --> 00:09:12,260
And in that case, it would be something like insulin.

90
00:09:12,500 --> 00:09:15,700
If you give someone insulin when they don't need it, they can die.

91
00:09:15,700 --> 00:09:24,800
And so we were able to show you can change all sorts of things, primarily because of this use of an old, antiquated protocol called HL7, or Health Data 7.

92
00:09:25,080 --> 00:09:31,860
We can talk more about that later, and I'll post in the Discord some links to that stuff if you're interested.

93
00:09:31,860 --> 00:09:32,700
Next slide.

94
00:09:38,410 --> 00:09:40,930
All right, I run the Do No Harm panel at DEF CON every year.

95
00:09:40,930 --> 00:09:42,750
Please come check us out.

96
00:09:42,750 --> 00:09:45,150
I run another conference, too, called the CyberMed.

97
00:09:45,150 --> 00:09:48,690
I know, I'm not drinking right now, and I said cyber like 15 times.

98
00:09:48,690 --> 00:09:49,330
I'm sorry.

99
00:09:49,330 --> 00:09:50,210
Forgive me.

100
00:09:50,490 --> 00:09:51,590
Next slide.

101
00:09:57,650 --> 00:09:59,790
All right, so this is what we're going to talk about today.

102
00:09:59,790 --> 00:10:00,530
Wait, what?

103
00:10:00,530 --> 00:10:04,570
I'm here at DEF CON Groups Allspace VR.

104
00:10:04,570 --> 00:10:06,650
Why the hell are we talking about this old-ass picture?

105
00:10:06,650 --> 00:10:09,370
I don't see any badge life in here.

106
00:10:09,370 --> 00:10:13,850
I don't see any alcohol and debauchery of Hacker Jeopardy.

107
00:10:14,470 --> 00:10:19,570
This is the most important thing to me, and this is my favorite painting.

108
00:10:19,730 --> 00:10:23,350
It's called The Doctor, and it was painted in the late 1800s.

109
00:10:23,350 --> 00:10:27,750
And the reason it's my favorite painting is it reminds me why I go to work every day.

110
00:10:27,770 --> 00:10:29,450
Now, quickly, let's just take a look.

111
00:10:29,450 --> 00:10:32,190
The top right, we get a mom and a dad.

112
00:10:32,530 --> 00:10:34,230
At least, that's what I think they are.

113
00:10:34,230 --> 00:10:38,890
And mother has her face down on the table, and dad laid on mine, and she's weeping.

114
00:10:39,090 --> 00:10:40,610
Dad looks concerned.

115
00:10:41,270 --> 00:10:52,210
The left side of the painting, we see the title of this painting, which is The Doctor, looking concerned over a child, the focal point of the entire painting, and that's the patient.

116
00:10:52,210 --> 00:10:54,250
I have been that doctor before.

117
00:10:54,250 --> 00:10:59,690
I know what that doctor is thinking, and I've tried every treatment under the sun.

118
00:10:59,690 --> 00:11:01,210
I've tried every medicine I know.

119
00:11:01,210 --> 00:11:06,050
I've tried every ounce of training I know, and I don't know if this patient is going to make it through.

120
00:11:06,050 --> 00:11:07,010
Next slide.

121
00:11:15,380 --> 00:11:17,220
This is health care today.

122
00:11:17,220 --> 00:11:19,760
So, that was the health care of the late 1800s.

123
00:11:19,760 --> 00:11:22,060
This is the health care of today.

124
00:11:22,060 --> 00:11:23,640
It has something very similar.

125
00:11:23,640 --> 00:11:28,940
It has the patient in the middle, but I want to draw your attention to everything around the patient.

126
00:11:28,940 --> 00:11:30,980
You see all those blinking boxes?

127
00:11:31,440 --> 00:11:33,820
You see all those wires and cables?

128
00:11:34,000 --> 00:11:40,900
Imagine what the wireless is around the station at that exact moment.

129
00:11:41,120 --> 00:11:43,100
This is modern health care.

130
00:11:43,200 --> 00:11:53,540
You cannot engage in health care in most hospitals in the United States without facing this reality that everything's connected.

131
00:11:53,660 --> 00:11:55,700
A lot of it is insecure.

132
00:11:55,740 --> 00:11:58,540
We're doing our best, but we have a long way to go.

133
00:11:58,540 --> 00:11:59,500
Next slide.

134
00:12:08,840 --> 00:12:12,340
So, we screwed this up in medicine a long time.

135
00:12:12,340 --> 00:12:14,000
So, these are two publications.

136
00:12:14,000 --> 00:12:16,000
One was called Two Heirs Human.

137
00:12:16,000 --> 00:12:19,680
This is about the millennial time, and the other one was Crossing the Quality Chasm.

138
00:12:19,680 --> 00:12:23,320
And we talked about basically, let's look at data in medicine.

139
00:12:23,320 --> 00:12:25,480
Does this medicine work compared to this one?

140
00:12:25,480 --> 00:12:27,700
Does this treatment work compared to this one?

141
00:12:27,700 --> 00:12:41,620
We want doctors to use evidence-based medicine, but we also want to recognize that a lot of the time, medicines, health care, doctors, nurses, the infrastructure, all of that actually hurts patients sometimes because we make mistakes.

142
00:12:41,620 --> 00:12:44,040
We give someone medicine that they're allergic to.

143
00:12:44,300 --> 00:12:50,540
Can you guys draw some hearts if the slides are down?

144
00:12:53,110 --> 00:12:54,890
Yeah, it looks like they're down.

145
00:12:55,110 --> 00:12:56,750
ATX, can we reload those?

146
00:13:26,360 --> 00:13:28,480
I'll just kind of keep going a little bit.

147
00:13:28,480 --> 00:13:38,740
So, basically, there have been plenty of examples of where in medicine we've actually hurt patients when we went to help them.

148
00:13:38,920 --> 00:13:45,780
One of the examples is in about the 20s or 30s, you were almost guaranteed to die if you were a premature infant.

149
00:13:45,840 --> 00:13:49,260
The reason was that premature infants have very immature lungs.

150
00:13:49,260 --> 00:13:50,620
They can't breathe.

151
00:13:50,620 --> 00:13:54,360
And it takes a long time while they're in the womb for those lungs to mature.

152
00:13:54,940 --> 00:14:08,000
And for the first time ever, when we had better plastics, and primarily when we had the power to concentrate and store oxygen, we were able for the first time to allow premature babies to live.

153
00:14:08,020 --> 00:14:12,320
So, we had these little incubators, and we were able to keep babies warm.

154
00:14:12,320 --> 00:14:15,260
We were able to give them oxygen because their lungs weren't very good.

155
00:14:16,000 --> 00:14:24,560
Please tell me, I want in the audience, I want you to throw up a applause if you think you should give the patient 100% oxygen.

156
00:14:24,560 --> 00:14:28,880
Let's pump as much oxygen as possible into that little incubator.

157
00:14:28,880 --> 00:14:33,340
Or if you think we should do 50% oxygen, throw up some hearts.

158
00:14:33,340 --> 00:14:34,700
So, hearts for 50%.

159
00:14:34,700 --> 00:14:37,600
Okay, we got 50%.

160
00:14:37,600 --> 00:14:39,520
Does anyone want to do 100% oxygen?

161
00:14:39,520 --> 00:14:41,040
Those lungs are pretty immature.

162
00:14:41,260 --> 00:14:42,580
Throw up some applause.

163
00:14:43,160 --> 00:14:43,840
No?

164
00:14:43,840 --> 00:14:46,680
So, basically, we answer the question, right?

165
00:14:46,680 --> 00:14:47,960
Babies were living for the first time.

166
00:14:47,960 --> 00:14:50,860
I'm going to pick what concentration of oxygen we're going to put in their incubator.

167
00:14:50,860 --> 00:14:51,940
And we went with 100.

168
00:14:52,880 --> 00:14:55,040
And then these babies were living.

169
00:14:56,180 --> 00:14:58,960
A big percentage of them were actually turning out blind.

170
00:14:59,440 --> 00:15:04,940
This is the cited reason why Stevie Wonder is blind, because he had retinopathy of prematurity.

171
00:15:05,160 --> 00:15:08,160
It actually was the oxygen that was causing the blindness.

172
00:15:08,160 --> 00:15:12,160
We didn't know if it was premature babies are more likely to be blind and now they're living.

173
00:15:12,280 --> 00:15:19,520
Or it actually ended up after we studied tens of thousands of patients that the oxygen was what was causing these patients to go blind.

174
00:15:19,520 --> 00:15:23,380
And so we went from going 100% oxygen to 50% oxygen.

175
00:15:23,380 --> 00:15:27,880
This is one example of how treatment we use actually hurts the patient.

176
00:15:27,880 --> 00:15:30,280
Another one is thalidomide.

177
00:15:30,280 --> 00:15:36,140
There was a nausea medication marketed mostly in Germany in the 40s for nausea.

178
00:15:36,140 --> 00:15:37,500
It was a drug called thalidomide.

179
00:15:37,500 --> 00:15:42,060
Well, for a lot of reasons, a lot of them, you know, inexcusable.

180
00:15:42,060 --> 00:15:44,000
It was never tested in pregnant persons.

181
00:15:44,000 --> 00:15:45,220
So what does that mean?

182
00:15:45,280 --> 00:15:49,720
But pregnant persons get nausea and they vomit all the time.

183
00:15:49,720 --> 00:15:52,100
So they wanted to use this drug called thalidomide.

184
00:15:52,100 --> 00:15:56,620
They gave it to pregnant persons and basically caused a lot of death.

185
00:15:56,620 --> 00:16:00,160
As a consequence of poor research practices.

186
00:16:00,820 --> 00:16:01,700
All right, cool.

187
00:16:01,800 --> 00:16:02,120
We're back.

188
00:16:02,120 --> 00:16:05,360
This guy is like ghosting out his iPad.

189
00:16:05,360 --> 00:16:09,760
Please go down like three or four slides.

190
00:16:15,500 --> 00:16:17,300
All right, other way.

191
00:16:19,160 --> 00:16:20,700
Keep going, keep going.

192
00:16:24,480 --> 00:16:25,880
No, you're going the wrong way.

193
00:16:26,640 --> 00:16:30,620
No, you're going the wrong way.

194
00:16:30,920 --> 00:16:32,180
Yeah, yeah, there you go.

195
00:16:32,180 --> 00:16:32,940
The other way.

196
00:16:33,000 --> 00:16:34,540
Keep going, keep going.

197
00:16:41,020 --> 00:16:42,720
Keep going, keep going.

198
00:16:58,260 --> 00:17:00,140
Okay, here's thalidomide.

199
00:17:00,140 --> 00:17:00,660
Great.

200
00:17:00,720 --> 00:17:06,100
So this is, okay, now we have this potential new failure.

201
00:17:06,100 --> 00:17:16,640
Now I'm going to start off rapidly by asking myself, wait a minute, you're telling me that the cybers and these malicious cybercriminals, are they hurting patients?

202
00:17:17,800 --> 00:17:18,760
No.

203
00:17:20,120 --> 00:17:25,000
If we make it to the end of this talk, I'll give you a little, a few slides on why I think that's the case.

204
00:17:25,000 --> 00:17:32,100
But what do we know about how security of medical devices and critical hospital infrastructure can affect patients?

205
00:17:32,100 --> 00:17:39,880
All right, this is a slide about a paper I published over 10 years ago by Kevin Foote's group.

206
00:17:39,880 --> 00:17:49,720
This was before Barnaby Jack, and they basically talked about how easy it was to wirelessly attack and implant.

207
00:17:49,760 --> 00:17:59,380
These are devices that can implant into a person's body and wires come from this implant and go into their heart.

208
00:17:59,380 --> 00:18:04,120
There was some concern that they were able to induce shock.

209
00:18:04,120 --> 00:18:10,380
So you were watching TV, then you watch any of those shows about the emergency department, you know, and they shock someone back to life.

210
00:18:10,380 --> 00:18:12,100
Well, these devices can shock.

211
00:18:12,180 --> 00:18:17,260
And if you get shocked and you don't need to, and it happens to shock you at the wrong time, you can actually.

212
00:18:18,200 --> 00:18:19,200
Next slide.

213
00:18:35,600 --> 00:18:44,200
These are some great research done by Jay Radcliffe, who basically reverse-engineered his own insulin pump.

214
00:18:44,220 --> 00:18:51,480
He's a hacker himself, and was able to show how easy it would be to deliver a potentially deadly dose of insulin.

215
00:18:51,480 --> 00:18:57,200
So if you don't know that, if you get insulin and you're diabetic and it's at the right level, great, you live.

216
00:18:57,200 --> 00:19:00,780
But if you don't need insulin and they give it to you, it can actually kill you.

217
00:19:00,800 --> 00:19:01,860
Next slide.

218
00:19:08,280 --> 00:19:11,000
Some more pacemaker research.

219
00:19:11,020 --> 00:19:15,700
And before Barnaby died, he was going to give a talk about hacking pacemakers.

220
00:19:15,700 --> 00:19:17,240
Rest in peace, Barnaby.

221
00:19:17,320 --> 00:19:18,180
Next slide.

222
00:19:23,420 --> 00:19:28,760
Not just medical devices, this is critical hospital infrastructure.

223
00:19:28,760 --> 00:19:34,120
If you're interested in this, this is a hospital for about three or four days.

224
00:19:34,120 --> 00:19:35,480
A really interesting story.

225
00:19:35,480 --> 00:19:38,680
I recommend you read kind of what happened with that.

226
00:19:38,940 --> 00:19:39,720
Next slide.

227
00:19:40,260 --> 00:19:46,540
Devastating to, you know, hospital operations, essentially put a hospital offline for three days while in hospital.

228
00:19:48,260 --> 00:19:55,680
We had some infusion pump stuff, though, you know, it's not always the obvious stuff like an insulin pump or a pacemaker.

229
00:19:55,680 --> 00:19:59,480
There's a lot of connected medical technology that is vulnerable.

230
00:19:59,480 --> 00:20:01,040
This are infusion pumps.

231
00:20:01,040 --> 00:20:03,660
So you go to the hospital and you get an IV.

232
00:20:03,980 --> 00:20:08,460
This is a, you know, bag of medicine and a tube that goes into an IV into your arm.

233
00:20:08,940 --> 00:20:15,100
Sometimes it's just, you know, saline, essentially water with some salts to help hydrate you.

234
00:20:15,100 --> 00:20:18,180
But sometimes we deliver medications through your IV.

235
00:20:18,500 --> 00:20:21,300
And sometimes we have to give you those medications over hours.

236
00:20:21,300 --> 00:20:23,420
And so we have to control the rate of medication.

237
00:20:23,420 --> 00:20:25,260
If you get a little medication, it doesn't help.

238
00:20:25,260 --> 00:20:28,100
If you get too much medication, it can kill you.

239
00:20:28,100 --> 00:20:31,320
How do we control the rate of medicine going into a patient?

240
00:20:31,320 --> 00:20:33,660
We use these things called infusion pumps.

241
00:20:33,660 --> 00:20:44,840
They're basically mechanical pumps attached to embedded systems that can be able to look at software, drug libraries, and control the way of medications.

242
00:20:44,840 --> 00:20:50,380
Well, you know, I don't know, 10 years, 15 years ago, they were like, you know what the next great generation of these is going to be?

243
00:20:50,380 --> 00:21:05,940
Let's put them on Wi-Fi so we can connect them to the network for, what ended up happening was, and this is the most widely publicized example of this, there are some significantly scary vulnerabilities associated with infusion pumps, where they could give you way too much medicine,

244
00:21:05,940 --> 00:21:07,140
way too little medication.

245
00:21:07,740 --> 00:21:11,780
Primarily vulnerabilities involving really poor or little authentication practices.

246
00:21:11,780 --> 00:21:13,440
Next slide, please.

247
00:21:20,980 --> 00:21:21,740
Okay.

248
00:21:21,860 --> 00:21:26,120
Well, if you're into this, this is such a weird story.

249
00:21:26,120 --> 00:21:32,240
So some security researchers, instead of finding, they found some vulnerabilities in the pacemaker.

250
00:21:32,340 --> 00:21:39,860
Instead of going to the manufacturer and engaging in, you know, disclosure, coordinated disclosure, they went to like a hedge, like a pseudo hedge fund.

251
00:21:39,860 --> 00:21:45,000
And they said, listen, we're going to release all this research about how these pacemakers are FUBAR.

252
00:21:45,000 --> 00:21:47,260
We want to short the stock with you.

253
00:21:47,280 --> 00:21:50,900
And that was how they made a lot of money, at least temporarily.

254
00:21:51,060 --> 00:21:53,920
The stock bounced back and this thing's getting litigated as hell.

255
00:21:53,920 --> 00:21:59,240
But long story short, it's a really interesting kind of change in the research landscape.

256
00:21:59,720 --> 00:22:00,780
Next slide.

257
00:22:10,250 --> 00:22:13,670
I mean, sure, throw some hearts out, throw some applause out, whatever it is.

258
00:22:13,670 --> 00:22:18,110
Let me know if you're out there, if you heard about all the ransomware attacks in hospitals.

259
00:22:19,450 --> 00:22:19,970
Cool.

260
00:22:19,970 --> 00:22:20,170
All right.

261
00:22:20,170 --> 00:22:22,130
Now, do it if you're responsible for one.

262
00:22:23,370 --> 00:22:25,610
Ah, I almost got you there.

263
00:22:28,250 --> 00:22:30,370
Listen, ransomware is in hospitals.

264
00:22:30,370 --> 00:22:39,950
And when COVID started, there was, I remember, I guess in the news headlines, I was like, a bunch of ransomware crews were going to come together and say, we're not going to get hospitals during COVID.

265
00:22:40,030 --> 00:22:41,570
A couple of big ones.

266
00:22:41,630 --> 00:22:45,830
And science, you know, of course, ransomware is a plague.

267
00:22:45,830 --> 00:22:47,030
It's always going around.

268
00:22:47,030 --> 00:22:49,370
There's been a couple hospitals recently.

269
00:22:49,610 --> 00:22:54,050
But largely speaking, it's been sort of research infrastructure.

270
00:22:54,050 --> 00:23:03,890
So there's some news stories recently of state actors going after COVID research or ransom workers going after academic research establishments.

271
00:23:04,450 --> 00:23:11,250
But of course, we can have a conversation about healthcare and hacking without talking about Walmart pride.

272
00:23:11,250 --> 00:23:12,690
It's so crazy.

273
00:23:12,690 --> 00:23:18,010
When this happened, I remember thinking to myself, like, whoa, I don't know if we're ever going to have anything like this again.

274
00:23:18,090 --> 00:23:25,410
It took out over 30% of the United Kingdom's National Health Service's entire infrastructure.

275
00:23:25,410 --> 00:23:26,250
What does that mean?

276
00:23:26,250 --> 00:23:32,490
Imagine if malware hit the US and took out one out of every three hospitals across the country.

277
00:23:32,590 --> 00:23:35,270
Think about how disruptive that would be to clinical care.

278
00:23:35,270 --> 00:23:42,350
Think about the patients that are going to be having strokes and heart attacks and are having life threatening infections.

279
00:23:42,350 --> 00:23:45,470
Imagine how impactful that could have been.

280
00:23:46,170 --> 00:23:50,830
And so that's really changed a lot of things and catalyzed a lot of positive actions.

281
00:23:50,830 --> 00:23:54,230
We're looking at the security of these devices in a better light.

282
00:23:54,230 --> 00:23:58,710
The FDA has done a bunch of great work talking about how we can make these devices more secure.

283
00:23:58,770 --> 00:24:06,330
When they come to market, they're not plagued with a lot of the problems that we've been dealing with for the last 15 years.

284
00:24:06,330 --> 00:24:07,210
Next slide.

285
00:24:27,050 --> 00:24:28,310
All right.

286
00:24:28,310 --> 00:24:29,850
And then check this out.

287
00:24:29,890 --> 00:24:45,010
What's crazy is the FDA actually recalled a medical device, not because the pump was prone to break or because the wiring that goes into it was likely to fray and cause electrocutions, which we do for all sorts of other medical devices on a regular interval.

288
00:24:45,010 --> 00:24:53,850
The first time ever, we actually had a recall because of a nasty vulnerability that could, in this article, as mentioned, lead to death.

289
00:24:53,850 --> 00:24:53,850
So we're going to have to do something about that.

290
00:24:53,850 --> 00:24:56,090
Potential patient safety concerns.

291
00:24:56,090 --> 00:25:00,270
And so for the first time ever, we had the FDA saying, hey, we can't tolerate this.

292
00:25:00,270 --> 00:25:02,030
We're going to actually recall the device.

293
00:25:02,030 --> 00:25:03,690
And then you got there and be like, wait a minute.

294
00:25:03,690 --> 00:25:04,530
Is that the first?

295
00:25:04,550 --> 00:25:06,410
Why isn't this happening all the time?

296
00:25:06,410 --> 00:25:09,370
It's a really big deal to recall a device.

297
00:25:10,130 --> 00:25:13,790
Patients might not trust devices after you recall them.

298
00:25:13,790 --> 00:25:22,270
So if you're a diabetic and you've been told that some hacker can kill you by hacking your insulin pump, you may not add an insulin pump next.

299
00:25:22,270 --> 00:25:25,130
If it's been recalled, you might not trust the technology.

300
00:25:25,590 --> 00:25:37,630
And sometimes these patients will actually suffer from their lack of trust in other devices that might be more secure, just because they don't know the difference between security in one insulin pump versus the other.

301
00:25:37,690 --> 00:25:40,110
So a recall is a really big deal.

302
00:25:40,830 --> 00:25:45,190
It took a lot of guts for the FDA to do this, and I really want to applaud them for that.

303
00:25:45,190 --> 00:25:46,090
Next slide.

304
00:25:53,280 --> 00:25:58,540
So I hope you can see, like, I think of this picture that we're pretty fragile.

305
00:25:58,540 --> 00:26:04,160
There's thousands and thousands of devices on our hospital network.

306
00:26:04,160 --> 00:26:08,440
Hundreds of workstations, depending on how big the organization is.

307
00:26:08,440 --> 00:26:14,080
And in 2017, the National Health and Human Services issued this report.

308
00:26:14,100 --> 00:26:15,500
They had this big task force.

309
00:26:15,500 --> 00:26:29,460
They got a bunch of famous people on this group, including some hackers, and they basically came out to the end of this report basically saying, you know, how scary the vulnerabilities of the healthcare system were.

310
00:26:29,460 --> 00:26:42,760
And one of the things they pointed out was they thought a majority of hospitals, again, sorry, this is like US-focused a little bit, but they thought a majority of hospitals in the United States lacked even a single full-time security professional on staff.

311
00:26:42,980 --> 00:26:45,690
There are some parts or some classrooms.

312
00:26:45,690 --> 00:26:46,830
You think that's crazy?

313
00:26:46,830 --> 00:26:52,690
You think that your hospital system doesn't have a full-time security professional on staff?

314
00:26:52,690 --> 00:26:54,570
Yeah, throw somebody up if you think that's wild.

315
00:26:54,830 --> 00:26:56,650
Yeah, that's insane.

316
00:26:56,690 --> 00:26:58,750
You know, that wouldn't be tolerated at a bank.

317
00:26:58,750 --> 00:27:01,770
It wouldn't be tolerated at a lot of other institutions, likely.

318
00:27:02,470 --> 00:27:05,550
And yet those are patients' lives that are at risk, right?

319
00:27:05,550 --> 00:27:13,050
These are institutions taking care of kids, potentially, and yet they're not going to have the expertise that they need.

320
00:27:13,050 --> 00:27:15,570
It's hard, you know, they can't often pay the salaries.

321
00:27:16,830 --> 00:27:28,870
It's really frustrating for a lot of hackers to work for healthcare because they don't get the freedom to fix a lot of the issues they find, and it's all absolutely valid.

322
00:27:29,110 --> 00:27:36,690
But if you're looking to make a difference, and you're looking to make a career change, and you want to put your skills to good use, I'd really encourage you to check out working for a healthcare organization.

323
00:27:36,690 --> 00:27:49,590
It's a challenging environment, and you have to deal with a lot of these issues, but you're also going to have a little trial by fire, because I think we're also seeing pretty well-documented and publicized campaigns of state hackers going after healthcare.

324
00:27:49,790 --> 00:27:50,810
Next slide.

325
00:27:56,530 --> 00:27:58,670
All right, I'm going to let you guys read this later.

326
00:27:58,770 --> 00:28:03,190
Basically, this says software is what powers modern healthcare.

327
00:28:03,190 --> 00:28:08,870
There's so much of it now, and if we don't pay attention to it, we don't secure it, it's going to be a problem.

328
00:28:08,870 --> 00:28:18,670
If hackers don't step up to help secure patients, the devices that they use, it's not just going to be random death, but medical death that we're dealing with.

329
00:28:18,670 --> 00:28:20,850
It's going to be a much bigger number of consequences.

330
00:28:20,850 --> 00:28:22,030
Next slide.

331
00:28:28,560 --> 00:28:29,840
Next slide.

332
00:28:31,540 --> 00:28:34,880
So I already kind of told you, I can't tell you a story.

333
00:28:35,060 --> 00:28:41,520
I can't show you a news clipping of someone who died because their pacemaker was hacked.

334
00:28:41,920 --> 00:28:47,220
But I'll just tell you, and this slide doesn't translate well, because we cut it into images.

335
00:28:47,640 --> 00:28:49,860
But let's imagine you have a diffusion pump.

336
00:28:49,860 --> 00:28:52,340
It's running embedded Windows.

337
00:28:52,400 --> 00:28:53,420
It gets infected.

338
00:28:53,420 --> 00:28:56,200
It's on the network, on the Wi-Fi, it's exposed.

339
00:28:56,300 --> 00:29:00,660
It gets owned by some crypto mining malware.

340
00:29:00,920 --> 00:29:03,120
And as a consequence of this, the pump...

341
00:29:13,820 --> 00:29:26,060
I told you, I think that this is likely far more relevant than we think, but we lack the sophistication to actually measure it, to go out there and find evidence of it, because we're not even looking.

342
00:29:26,200 --> 00:29:28,400
So this pump's malfunctioning.

343
00:29:28,400 --> 00:29:31,960
Who in a hospital is going to even recognize this malfunction?

344
00:29:31,960 --> 00:29:39,920
Well, the best person is probably going to be the nurse, the person putting medications into the pump, actually interfacing with the pump.

345
00:29:40,000 --> 00:29:43,720
So nurses are overworked, amazing clinicians.

346
00:29:43,720 --> 00:29:46,500
I can't do my job as a doctor without them.

347
00:29:46,500 --> 00:29:50,620
I will say a lot of nurses would not recognize this, because I've asked them.

348
00:29:50,620 --> 00:29:52,040
It's not any fault of their own.

349
00:29:52,040 --> 00:29:52,800
It's that they're busy.

350
00:29:52,800 --> 00:29:54,860
They have four other patients in the ICU.

351
00:29:55,100 --> 00:29:56,280
COVID's happening.

352
00:29:56,340 --> 00:30:02,640
They're not necessarily looking at that device to make sure that the right number of drips are coming out of their IV bag.

353
00:30:02,960 --> 00:30:13,680
They trust the technology, and that's what I've heard over and over again from nurses in the field, is that they are trained to trust these pumps.

354
00:30:13,700 --> 00:30:19,600
In fact, the pumps they're taught are more safe than human beings doing it.

355
00:30:19,600 --> 00:30:31,220
Human beings controlling the rate of medication going into a patient by titrating some little dial is far more prone to mistakes, either underdosing a patient, than infusion pumps.

356
00:30:31,220 --> 00:30:32,400
So they're taught to trust it.

357
00:30:32,500 --> 00:30:38,200
Let's say you just have a crazy day, and the nurse picks up on this malfunctioning device.

358
00:30:38,500 --> 00:30:39,960
What are they going to do?

359
00:30:40,280 --> 00:30:42,680
Well, they're going to call bioengineering.

360
00:30:42,860 --> 00:30:44,340
This is a part of the hospital.

361
00:30:44,340 --> 00:30:48,120
These are people that take care of medical devices, and they're going to come and replace it.

362
00:30:48,120 --> 00:30:48,420
Guess what?

363
00:30:48,420 --> 00:31:00,040
They're going to replace it with the exact same vulnerable model that's likely unpatched, and it's going to be pretty quickly infected with the exact same crypto mining malware.

364
00:31:00,280 --> 00:31:04,880
But that aside, they're going to take that infected device, I imagine, in the basement.

365
00:31:04,880 --> 00:31:06,420
You know, this is kind of a joke I say.

366
00:31:06,420 --> 00:31:09,040
I think all bioengineers live in the basement.

367
00:31:09,040 --> 00:31:12,240
Not trolls, but that's just in my mind where this device is going.

368
00:31:12,880 --> 00:31:15,840
They're going to do some very basic troubleshooting on it.

369
00:31:16,500 --> 00:31:22,180
Throw up a heart or a hand or something, whatever, if you think that they're going to do forensics on this device.

370
00:31:23,560 --> 00:31:26,040
Oh yeah, you get the pessimists just like me.

371
00:31:26,060 --> 00:31:27,400
Yeah, of course they're not going to.

372
00:31:27,400 --> 00:31:29,160
They're not security experts.

373
00:31:29,160 --> 00:31:31,440
They know about clinical devices.

374
00:31:31,520 --> 00:31:32,560
They know about that.

375
00:31:32,560 --> 00:31:33,940
They don't know about security.

376
00:31:34,140 --> 00:31:37,060
If the hospital is lucky to have any security folks, guess what?

377
00:31:37,060 --> 00:31:43,020
They live over in IT, and they're in some closet, usually off campus, where all the cool people hang out like us.

378
00:31:43,540 --> 00:31:48,180
But they aren't going to even know that the device is likely infected.

379
00:31:48,180 --> 00:31:53,300
Well, if they can't fix it, you know, if they flash it and it's still acting up, who are they going to send it to?

380
00:31:53,300 --> 00:31:55,500
It's a device manufacturer.

381
00:31:55,660 --> 00:31:57,100
Ask a bunch of device manufacturers.

382
00:31:57,100 --> 00:32:03,820
When you get a malfunctioning medical device back in from a hospital, do you even consider the possibility that it's infected with malware?

383
00:32:04,140 --> 00:32:05,880
And guess what?

384
00:32:05,920 --> 00:32:10,280
Raise your hand if you think even one of them said they do forensics on malfunctioning medical devices.

385
00:32:10,280 --> 00:32:12,620
No, they don't.

386
00:32:12,640 --> 00:32:14,360
They lack that expertise too.

387
00:32:14,360 --> 00:32:19,480
As a consequence, they're just not going to look for it.

388
00:32:19,540 --> 00:32:28,980
The problem we're not even looking for, and it's perfectly designed for us to not have anyone even ask the question, let alone the skill set, for us to find.

389
00:32:31,880 --> 00:32:37,660
I think the next slide, I think that was a move along signal.

390
00:32:37,900 --> 00:32:40,740
What we don't want to do is have a crisis of confidence.

391
00:32:40,740 --> 00:32:45,760
You know, we don't want patients to not trust medical technology or to trust healthcare.

392
00:32:45,760 --> 00:32:46,860
And that's a big problem.

393
00:32:46,860 --> 00:32:50,000
You can go back to that slide of the angry old guy.

394
00:32:50,980 --> 00:33:04,240
Eric touched upon this, which is it's important for us to be trusting some of these systems because we don't want people having heart attacks and strokes saying, I don't want to go to that hospital.

395
00:33:04,300 --> 00:33:09,680
You know, I heard they had a breach of patient records last week, and I don't want to be hacked.

396
00:33:09,760 --> 00:33:12,720
And well, they're having a heart attack, right?

397
00:33:12,720 --> 00:33:31,780
If we don't do a good job, if hackers don't come and help healthcare do a better job, teach them what they're doing wrong for this infrastructure, we face this very real possibility that either the infrastructure is not just not even going to work at all in the case of anonymously dossing Boston Children's,

398
00:33:31,780 --> 00:33:42,900
or it might work and it might actually be somewhat robust and secure, but patients still don't trust because they're reading these news headlines in the press.

399
00:33:43,660 --> 00:33:45,840
So let me go forward a few slides.

400
00:33:48,890 --> 00:33:52,870
Right at the half hour mark, press something up if you want me to stop.

401
00:33:53,510 --> 00:33:55,390
Keep going, yeah, keep going.

402
00:33:58,270 --> 00:34:00,030
I'm gonna fix this.

403
00:34:00,030 --> 00:34:01,470
Oh god, here we go.

404
00:34:02,110 --> 00:34:09,470
So there are so many policy elements to this that I think are probably gonna bore a lot of hackers out there watching this stream.

405
00:34:09,470 --> 00:34:12,290
Thank you for tolerating this.

406
00:34:12,330 --> 00:34:27,470
We won't get into the policy aspects of it, but listen, if we are going to be buying millions of dollars of new devices for a hospital, better do a good job recognizing what risk we are going to be accepting on our networks, right?

407
00:34:27,470 --> 00:34:31,550
And that involves a lot of work up front.

408
00:34:33,290 --> 00:34:49,950
Vulnerability assessments, you know, there's a thing called the MTSQ form that basically goes through what are all the security controls available on this particular device, how secure out of the box is it, and what do you need to do on the hospital side to make sure when that gets deployed,

409
00:34:49,950 --> 00:35:00,950
are you doing so in a way that's most safe for the patients without causing unnecessary and laborious efforts that won't help the patients.

410
00:35:00,950 --> 00:35:01,810
Next slide.

411
00:35:07,500 --> 00:35:10,860
By the way, most of that stuff in there was connected.

412
00:35:11,880 --> 00:35:18,120
All right, listen, we're here at DEF CON, and I'm so amped to be virtually looking at all of you in this room.

413
00:35:18,120 --> 00:35:29,040
And I will say, although COVID has been a little bit of a relief to be here with my hacker family, presenting something that I'm passionate about.

414
00:35:29,080 --> 00:35:32,780
But listen, we, as mentioned previously, hackers need to step up.

415
00:35:32,780 --> 00:35:45,300
We need people to help us in healthcare, basically do the medical device research to help us with best practices, to help secure our networks.

416
00:35:45,300 --> 00:36:00,360
There's been some actually some great collaborations between hackers and healthcare in these coalitions where various hackers have pledged to essentially help defend hospitals if they should be under attack, which I think was a very noble thing.

417
00:36:00,360 --> 00:36:02,280
You know, hackers really stepped up during COVID.

418
00:36:02,280 --> 00:36:17,060
It's been, you know, volunteering to help defend hospitals against adversaries and cyber criminals, or also printing PPE, being there to help with some of the different disinformation that's really going out over social media.

419
00:36:17,200 --> 00:36:20,820
And as a consequence, I think this is hopefully something that persists.

420
00:36:20,820 --> 00:36:27,660
I hope that COVID, as awful as it is, will help catalyze hackers and healthcare coming together.

421
00:36:27,880 --> 00:36:35,300
If you're looking for more continued engagement with something like this, and as I mentioned, you can choose for employment, but you can also just do some research.

422
00:36:35,300 --> 00:36:37,420
You know, I went to research on medical devices.

423
00:36:37,420 --> 00:36:38,580
I buy them off eBay.

424
00:36:38,780 --> 00:36:40,100
You can do a lot of that.

425
00:36:40,100 --> 00:36:42,980
You can go on offer up and buy some crazy medical devices.

426
00:36:43,600 --> 00:36:56,320
As long as you're, you know, doing responsible research, knowing that it's a very big deal, and there's a lot of consequences that you need to take into consideration, we need a lot of your talent out there to help us be more secure.

427
00:36:56,320 --> 00:36:58,200
So please, please join.

428
00:36:58,200 --> 00:37:02,660
You can also, Biohacking Village is one of the DEF CON villages.

429
00:37:02,800 --> 00:37:04,540
We really encourage you to check it out.

430
00:37:05,200 --> 00:37:10,920
All right, listen, I don't think we should make all doctors aware of cybersecurity, make them experts.

431
00:37:10,920 --> 00:37:12,680
It's just not, it's not for purview.

432
00:37:12,680 --> 00:37:16,480
And honestly, I've been too busy driving Ferraris.

433
00:37:16,560 --> 00:37:18,260
Just kidding, I don't have a Ferrari.

434
00:37:18,980 --> 00:37:21,760
Only cardiologists have Ferraris.

435
00:37:22,120 --> 00:37:38,660
But what we need is, we need more nurses, we need more doctors in this space, because when you change the conversation from, this is just patient data that we want to secure, hey, we just want to get a violation or a purported breach, to the NICU, the head NICU nurse saying,

436
00:37:38,660 --> 00:37:52,500
hey, listen, if this medical device doesn't work, it's not available, or if the integrity of the data coming from this has been compromised, this little 30-week-old baby premature in this incubator is going to suffer.

437
00:37:52,780 --> 00:37:56,440
That's the type of conversation we need to have by partnering with clinicians.

438
00:37:56,440 --> 00:37:59,600
And you know what, it's going to require some patience on our side as hackers.

439
00:37:59,600 --> 00:38:02,860
They don't speak our language, just like you often don't speak theirs.

440
00:38:02,860 --> 00:38:18,040
Coming together in these interdisciplinary teams, working together, going to be able to make people change their minds about what security means in healthcare, not just HIPAA, not just privacy, but also patient safety.

441
00:38:18,040 --> 00:38:19,120
Next slide.

442
00:38:29,100 --> 00:38:31,620
All right, I'm going to finish up after this little bit.

443
00:38:31,620 --> 00:38:34,960
So, and open up for some questions, if anyone has it.

444
00:38:34,960 --> 00:38:38,540
So, you know, how many out there are familiar with last mile problem?

445
00:38:38,580 --> 00:38:39,340
Just throw something out.

446
00:38:39,420 --> 00:38:42,200
Many industries have last mile problems.

447
00:38:42,200 --> 00:38:47,140
Yeah, so I'm not going to I'm pretty sure if I tried to describe it in detail, I'm going to butcher it.

448
00:38:47,140 --> 00:38:49,660
So just forgive me as I do butcher this.

449
00:38:49,660 --> 00:38:58,300
But in many industries, it's not necessarily... there are certain parts of delivering things to consumers, for example, that are hard.

450
00:38:58,300 --> 00:38:59,920
And they might not be what you think.

451
00:38:59,920 --> 00:39:16,820
So, for example, when you're shipping goods that are manufactured in a different country, you know, you can make the particular product, and you can put it in a container ship, and you can actually go across an entire ocean and it goes.

452
00:39:16,820 --> 00:39:19,260
So you can imagine all the logistics involved in that.

453
00:39:19,260 --> 00:39:19,980
But guess what?

454
00:39:19,980 --> 00:39:24,160
All these companies that are doing that actually don't dread all that stuff.

455
00:39:24,160 --> 00:39:29,840
They dread the last mile, which is how do you get it from the distribution center into someone's home?

456
00:39:29,840 --> 00:39:32,660
It's a classic problem with ISPs.

457
00:39:32,920 --> 00:39:41,120
There's so many variations and addresses and buildings that are built differently, et cetera, that the last mile ends up being the hardest part.

458
00:39:41,200 --> 00:39:46,440
Well, healthcare has the last... healthcare security has the last mile problem.

459
00:39:46,440 --> 00:39:47,680
And I'm going to talk to you about it right now.

460
00:39:47,680 --> 00:39:48,480
Next slide.

461
00:39:50,540 --> 00:39:51,820
Oh, can you...

462
00:40:05,950 --> 00:40:12,630
So, let's imagine we have an awesome hacker.

463
00:40:12,670 --> 00:40:14,970
She's donating her expertise.

464
00:40:14,970 --> 00:40:16,950
She buys a device off of eBay.

465
00:40:17,270 --> 00:40:20,390
And she finds a vulnerability in it.

466
00:40:20,390 --> 00:40:26,270
She finds a nasty vulnerability that potentially kills somebody in a medical device that she buys off of eBay.

467
00:40:26,670 --> 00:40:27,970
Who does she go and talk to?

468
00:40:27,970 --> 00:40:27,970
Who does she go and talk to?

469
00:40:27,970 --> 00:40:27,970
Who does she go and talk to?

470
00:40:27,970 --> 00:40:27,970
Who does she go and talk to?

471
00:40:27,970 --> 00:40:32,930
Well, she probably will engage in responsible coordinated disclosure.

472
00:40:32,970 --> 00:40:37,750
I know that there's the language of that or what we used to describe as controversial.

473
00:40:37,750 --> 00:40:43,530
And in any regards, she's elected to do responsible coordinated disclosure.

474
00:40:43,530 --> 00:40:45,610
She goes to the medical device manufacturer.

475
00:40:45,930 --> 00:40:48,170
So, what is the medical device manufacturer going to do?

476
00:40:48,170 --> 00:40:49,030
Next slide.

477
00:40:59,610 --> 00:41:00,890
Here we go.

478
00:41:00,890 --> 00:41:05,610
Medical device manufacturer is obligated to respond to that, right?

479
00:41:05,670 --> 00:41:13,730
They've been plenty of documented examples of medical device manufacturers that screwed this up, you know, threatened to sue researchers or ignored them.

480
00:41:13,730 --> 00:41:15,910
But that hasn't panned out very well for them.

481
00:41:15,910 --> 00:41:18,910
And the FDA has come down pretty hard on those companies.

482
00:41:19,050 --> 00:41:23,690
So, as a consequence, a lot of them are changing and they're actually engaging attackers.

483
00:41:24,270 --> 00:41:26,530
What does the medical device manufacturer have to do?

484
00:41:26,530 --> 00:41:32,430
Well, they're obligated to report that to the regulator, which in this case on medical devices ends up being the FDA.

485
00:41:33,110 --> 00:41:35,730
Well, the FDA is like, damn, this vulnerability is nasty.

486
00:41:35,730 --> 00:41:37,030
We don't want any patients to get hurt.

487
00:41:37,030 --> 00:41:39,330
So, they're going to issue what's called a safety communication.

488
00:41:39,550 --> 00:41:51,210
They have to, and a lot of this is really hard, they can get out there and tell patients and doctors and hospitals that they have to worry about this device.

489
00:41:51,210 --> 00:41:54,470
And let's imagine that goes off without a hitch, which has never happened before.

490
00:41:54,470 --> 00:42:01,650
You know, it's never an easy thing to do, but let's imagine they do a great job and everyone that has that device is made aware of that.

491
00:42:01,650 --> 00:42:02,730
Next slide.

492
00:42:11,230 --> 00:42:17,830
So, the medical manufacturer and the regulator are like, oh man, it's even so concerning that we've got to issue a patch.

493
00:42:17,830 --> 00:42:29,890
Well, patching systems, you know, it's not controversial from a hacker perspective in most cases, but one of these edge cases where it is controversial, one of them is medical devices.

494
00:42:30,050 --> 00:42:42,490
But what if you poorly test your patch and actually cause some type of clinical harm because you're patching something and you didn't do a good job testing patch and actually the medical device malfunctions and hurts someone?

495
00:42:42,890 --> 00:42:48,490
Or there are all sorts of different things, like how are you going to actually patch something that's in a human being?

496
00:42:48,530 --> 00:42:55,250
You know, there are tens of thousands of, you know, tens of thousands of patients all across the globe that have implantable medical devices.

497
00:42:55,250 --> 00:42:59,310
You're going to call them all into the doctor's office and get their systems patched?

498
00:42:59,310 --> 00:43:14,050
Yeah, you get there and say yes, but it's a much harder thing to do than to say, let's imagine they are so on the ball and this medical infrastructure has patched this vulnerability and they've done it in record time and the patch is fantastic.

499
00:43:14,490 --> 00:43:16,710
They have to roll that out.

500
00:43:17,150 --> 00:43:19,010
And this is where the last mile problem is.

501
00:43:19,010 --> 00:43:25,950
How do we get from patching a medical device and get it to the actual patient?

502
00:43:26,030 --> 00:43:30,430
Because in this slide, last part is the clinicians, right?

503
00:43:30,430 --> 00:43:40,030
The doctors and nurses have to call those patients in and they got to put this magnetic interface onto their chest and they have to update the software.

504
00:43:40,150 --> 00:43:40,990
Next slide.

505
00:43:42,170 --> 00:43:43,350
Well, guess what?

506
00:43:43,990 --> 00:43:47,030
I think many of you out there know that's just not going to happen.

507
00:43:47,130 --> 00:43:55,010
It should happen, but it's not going to happen or it's not going to happen in any significant percentages because this last mile problem is really hard.

508
00:43:55,010 --> 00:44:00,250
We have a registry of patients that have these implantables, but guess what?

509
00:44:00,250 --> 00:44:09,010
Half the phone numbers aren't up to date or it was implanted, you know, eight years ago and they moved and we have no idea how to send them a letter or these doctors say, this is stupid.

510
00:44:09,010 --> 00:44:10,230
I'm not going to actually do this.

511
00:44:10,230 --> 00:44:14,150
It's such a pain in the butt patch or I don't think this is really an issue.

512
00:44:14,330 --> 00:44:16,330
And as you can see, we have this last mile problem.

513
00:44:16,330 --> 00:44:20,170
We can do all this great work and everything can go off perfectly.

514
00:44:20,250 --> 00:44:29,570
But if we don't get patients and doctors together and tell them why this is important and have them understand it and advocate for security, it's just not going to happen.

515
00:44:30,510 --> 00:44:31,690
All right, next slide.

516
00:44:32,290 --> 00:44:34,010
So I'm at 42.

517
00:44:34,490 --> 00:44:41,330
You guys are probably thinking to yourself, you know, we can just go to the end of the question slide.

518
00:44:41,890 --> 00:44:45,030
You're probably thinking to yourself, man, why did I get myself into this crazy ass talk?

519
00:44:45,030 --> 00:44:47,130
I was looking in here for overflows.

520
00:44:47,730 --> 00:44:49,490
Why are we talking about this crazy healthcare stuff?

521
00:44:49,490 --> 00:44:51,690
But I want to say I want to thank you for this opportunity.

522
00:44:51,690 --> 00:44:53,390
Thank you, Defcon Groups.

523
00:44:53,390 --> 00:44:58,510
Thank you DCA 58619 for letting me talk about this stuff that's near and dear to my heart.

524
00:44:58,510 --> 00:45:00,090
And this isn't the end of the conversation.

525
00:45:00,230 --> 00:45:02,070
I'm on Twitter, hit me up somewhere.

526
00:45:02,070 --> 00:45:06,470
If you're interested in this space, there's a lot we can do together to help.

527
00:45:06,470 --> 00:45:15,250
And you know, how often do you get a chance to use your skills for more than just privacy and security to really potentially save a life?

528
00:45:15,250 --> 00:45:16,290
That's a big, big deal.

529
00:45:16,290 --> 00:45:17,990
I want to say thank you for what you do.

530
00:45:18,110 --> 00:45:19,170
I miss my family.

531
00:45:19,170 --> 00:45:23,950
And if next year's plague is gone, I want to buy you all a beer in Vegas.

532
00:45:24,610 --> 00:45:25,410
Questions?

533
00:45:33,300 --> 00:45:34,580
I have a question.

534
00:45:35,520 --> 00:45:36,040
Yeah.

535
00:45:36,040 --> 00:45:42,660
What are some of the groups that are valuable for people to reach out to you to help solve this problem?

536
00:45:43,560 --> 00:45:44,360
Yeah, great question.

537
00:45:44,360 --> 00:45:46,880
So for those who didn't hear the question, it was what groups are...

538
00:45:48,120 --> 00:45:51,080
you can go all the way to the end to the question slide.

539
00:45:51,260 --> 00:45:52,460
The very last slide, please.

540
00:45:52,460 --> 00:45:56,920
The question was, what groups should I get involved with if I'm interested in this?

541
00:45:56,920 --> 00:46:01,340
There's the Biohacking Village group, which has an ongoing presence throughout the year.

542
00:46:01,340 --> 00:46:02,960
There's a group called Eye on the Calvary.

543
00:46:02,960 --> 00:46:15,260
I don't know how many of you out there are familiar with this, but they are really a great organization that gets a lot of attention and is able to persuade a lot of regulators like the FDA and other industries.

544
00:46:15,260 --> 00:46:23,760
There's a lot of power and a lot of awesome work being done with Eye on the Calvary, things like Bo Wood and Josh Corman, and there's a lot in that space.

545
00:46:23,760 --> 00:46:27,180
If you want to get involved in that, they have Slack that they'll invite you to.

546
00:46:27,220 --> 00:46:36,380
They don't just do medical, so if you're into hacking cars or airplanes, all sorts of things, but you want to also use your powers for good.

547
00:46:38,280 --> 00:46:39,600
Go to the next slide.

548
00:46:40,920 --> 00:46:42,980
Definitely check out that organization.

549
00:46:44,000 --> 00:46:44,880
All right.

550
00:46:44,880 --> 00:46:45,840
Another question?

551
00:46:52,730 --> 00:46:53,890
All right.

552
00:46:54,390 --> 00:46:54,830
Cool.

553
00:46:54,830 --> 00:46:56,990
Hit me up on Discord if you have any more.

554
00:46:56,990 --> 00:46:58,850
Again, this is a true, true honor.

555
00:46:58,990 --> 00:46:59,850
Take care, everyone.

556
00:46:59,850 --> 00:47:00,490
Thank you.