All right, hey, I'm Kwadi. I'm a weird guy, but I have a foot in two different worlds. My day job
is I'm an ER doc, so I practice in the emergency department.
I also do a lot of research in the security space, so where medicine and security collide.
Enough of that. Follow me on Twitter if you want. Next slide, please.
All right, so, you know, this has been my life until things in my neck of the woods kicked up
for COVID. So, you know, we talked about how toilet paper is worth gold. There was this
crazy-ass Netflix show. But things have changed, you know, and the pandemic started off about
tigers and toilet paper, but it's quickly gotten out of hand, and I promise this will
become relevant in a little bit. Next slide. You know, one of the biggest disappointments
in my life in COVID so far has been my inability to eat burritos like I used to before. I'm sure
many of you out there are experiencing a similar problem. I haven't figured out what the problem
is. I will say coming from San Diego, DCA 58619, we have the best burritos in America.
And so this is a big bummer. Next slide. This is my day job. So this isn't a shot from my ED,
my emergency department, but it's pretty much any of the emergency departments across the country
right now. And this has a lot to do with the problems of air crowding. And we splashed COVID
in on that, and now we have basically a greatly diminished ability to take care of patients,
and generally a crazy shift every time I go into work, and we're just seeing patients left and
right. Next slide. So we built these tents, and this is how crazy it was. So we were so worried
about patients overflowing out into the parking lot, et cetera, that we built these emergency
tents. And all these hospitals across the country started as quickly as possible deploying any
connected technology they could to extend the capabilities of a hospital into parking lots.
And generally speaking, across the country, this was the right thing to do. We were so worried
about running out of ventilators, et cetera, that there's a mad rush to plug everything
in onto the internet. Next slide. Just give me a favor out in the crowd,
like throw out some hearts or something, if you've been seeing your doctor by Zoom.
Oh yeah, we got some people out there. Isn't that the weirdest thing? I don't know. I'm also
kind of curious how many people out there really would prefer this. But all of a sudden, we went
from this world where in emergency medicine, where we take care of heart attacks and gunshot wounds
and appendicitis, and sometimes even like just toenails, you know, hangnails. All of a sudden,
we had this capability to do telemedicine. We were worried about what happens if our faculty
gets sick? What happens if all these ER docs and nurses get COVID and they can't come into work?
But the patients are just going to keep coming. So we thought to ourselves,
you know, we don't normally do telemedicine in emergency medicine. That's for like primary care
doc or your crazy dermatologist or whatever. But in emergency medicine for the first time,
from our homes when we get COVID, because otherwise those are going to be lost resources
and patients aren't going to see doctors. So it'd be better to see them over an iPad
than not see a doctor at all. Next slide.
And so all of this is kind of my day job. But for the longest time I've been a hacker,
just like you guys out there. This is me playing OpenCTF. Shoot, I must have been like
DEF CON 14 or 15. No, I was probably like 16. And so when you grow up a hacker, and all of a sudden
you find yourself in healthcare, and you can't help but think about how easy it would be to
socially engineer people in your space, or how insecure some of these systems are,
or that you're using medical technology with legacy operating systems, machines that have
been unpatched for over a decade. These types of things are realities in a lot of places in
the world, is that the race to digitize medicine in the race to increase electronic health records
and a variety of other things, what we had at the end of the day was hyper connectivity without
the commensurate attention to security. And it's not one of those things that people pay a lot of
attention to, but primarily because it's expensive. There's a lot of other things going on in the
space like COVID, for example. And then also when you buy a medical device, there's a decent chance
that that medical device is going to be in production for years and years and years, right?
So if you're at a bank or another company, you might have a much quicker hardware and software
lifecycle, as opposed to something like an MRI machine that costs over a million dollars for a
hospital. And when they buy one, they literally have to knock down walls in their hospital
to put it in. And that device is going to be in production for 10 years. Well, if it took
five years to develop it, what operating system do you think it's using its very first day it's
on market? It's going to be the operating system from five years ago. And so what we have been
seeing, unfortunately, a lot of time is these legacy machines are, sorry, our medical devices
are obsolete and using basically legacy operating systems while they're still brand new. Next slide.
I do some research. So I actually have to publish and do a bunch of stuff. So one
piece of research we did that turned into a DEF CON Talk at 20 was
we looked at the 911 system. So I studied a lot of out-of-hospital cardiac arrest,
so basically what happens if your heart stops right before we do shocks and CPR.
And I listened to thousands of 911 calls. And after I listened to so many of them,
there were some failures I noticed. And one of them were technical failures. So for example,
someone would pop up on their phone, try to get some location service to identify where they were,
because a dispatcher on the 911 call would be asking for their location, and they would say,
you know, I'm here. But in actuality, they were half a mile away because of bad
location technology. Or if they were using cell phone triangulation, for example, to
identify where a patient in distress was, we can tell based on, you know, there's a whole
bunch of reasons why that technology could fail. And one of the things I realized was, like,
what is the security and technical underpinnings of a 911 system, you know, a system that so many
patients rely on every single day in the most dire circumstances to make sure that they live.
And so we did some research over a year that talks up on YouTube. I think it's Defcon 20 or 22.
I can't remember. But the talk just goes through basically how insecure and antiquated our 911
infrastructure is. If you're an old phone freaker, you're going to get a kick out of the top,
because of just how old the technology is that they were using back then.
And then we did some stuff a couple years ago looking at how secure are your laboratory
information systems? You know, when you get your labs back from a doctor, you go to your doctor,
they order a bunch of blood work or an x-ray. And how secure, how confident are you in the
integrity of that data? So we looked at these things called laboratory information systems,
and we were able to basically show it's relatively easy to perform some very trivial man-in-the-middle
attacks or person-in-the-middle attacks, and change laboratory values in patients in the
hospital. So what does that mean? You go into the hospital, you really just ate a bad burrito,
and that's why your stomach's hurting. I changed your blood work to make it look like you have
diabetic ketoacidosis, you know, an emergency condition. The doctor looks at your labs,
and she said, oh, wow, it looks like you're really sick, when in actuality, you're not.
We changed the values, and they give you a treatment you don't need. And in that case,
it would be something like insulin. If you give someone insulin when they don't need it,
they can die. And so we were able to show you can change all sorts of things, primarily because of
this use of an old, antiquated protocol called HL7, or Health Data 7. We can talk more about
that later, and I'll post in the Discord some links to that stuff if you're interested. Next
slide. All right, I run the Do No Harm panel at DEF CON every year. Please come check us out.
I run another conference, too, called the CyberMed. I know, I'm not drinking right now,
and I said cyber like 15 times. I'm sorry. Forgive me. Next slide.
All right, so this is what we're going to talk about today. Wait, what? I'm here at DEF CON
Groups Allspace VR. Why the hell are we talking about this old-ass picture? I don't see any
badge life in here. I don't see any alcohol and debauchery of Hacker Jeopardy.
This is the most important thing to me, and this is my favorite painting. It's called The Doctor,
and it was painted in the late 1800s. And the reason it's my favorite painting is it reminds
me why I go to work every day. Now, quickly, let's just take a look. The top right, we get a mom
and a dad. At least, that's what I think they are. And mother has her face down on the table,
and dad laid on mine, and she's weeping. Dad looks concerned. The left side of the painting,
we see the title of this painting, which is The Doctor, looking concerned over a child,
the focal point of the entire painting, and that's the patient. I have been that doctor
before. I know what that doctor is thinking, and I've tried every treatment under the sun. I've
tried every medicine I know. I've tried every ounce of training I know, and I don't know if
this patient is going to make it through. Next slide.
This is health care today. So, that was the health care of the late 1800s. This is the
health care of today. It has something very similar. It has the patient in the middle,
but I want to draw your attention to everything around the patient. You see all those blinking
boxes? You see all those wires and cables? Imagine what the wireless is around the station
at that exact moment. This is modern health care. You cannot engage in health care in most
hospitals in the United States without facing this reality that everything's connected.
A lot of it is insecure. We're doing our best, but we have a long way to go. Next slide.
So, we screwed this up in medicine a long time. So, these are two publications. One was called
Two Heirs Human. This is about the millennial time, and the other one was Crossing the Quality
Chasm. And we talked about basically, let's look at data in medicine. Does this medicine work
compared to this one? Does this treatment work compared to this one? We want doctors to use
evidence-based medicine, but we also want to recognize that a lot of the time, medicines,
health care, doctors, nurses, the infrastructure, all of that actually hurts patients sometimes
because we make mistakes. We give someone medicine that they're allergic to. Can you guys
draw some hearts if the slides are down? Yeah, it looks like they're down. ATX, can we reload those?
I'll just kind of keep going a little bit. So, basically,
there have been plenty of examples of where in medicine
we've actually hurt patients when we went to help them. One of the examples is in about the
20s or 30s, you were almost guaranteed to die if you were a premature infant. The reason was that
premature infants have very immature lungs. They can't breathe. And it takes a long time while
they're in the womb for those lungs to mature. And for the first time ever, when we had better
plastics, and primarily when we had the power to concentrate and store oxygen, we were able
for the first time to allow premature babies to live. So, we had these little incubators,
and we were able to keep babies warm. We were able to give them oxygen because their lungs
weren't very good. Please tell me, I want in the audience, I want you to throw up a
applause if you think you should give the patient 100% oxygen. Let's pump as much oxygen as possible
into that little incubator. Or if you think we should do 50% oxygen, throw up some hearts. So,
hearts for 50%. Okay, we got 50%. Does anyone want to do 100% oxygen? Those lungs are pretty
immature. Throw up some applause. No? So, basically, we answer the question, right? Babies were living
for the first time. I'm going to pick what concentration of oxygen we're going to put
in their incubator. And we went with 100. And then these babies were living. A big percentage
of them were actually turning out blind. This is the cited reason why Stevie Wonder is blind,
because he had retinopathy of prematurity. It actually was the oxygen that was causing the
blindness. We didn't know if it was premature babies are more likely to be blind and now
they're living. Or it actually ended up after we studied tens of thousands of patients that
the oxygen was what was causing these patients to go blind. And so we went from going 100% oxygen
to 50% oxygen. This is one example of how treatment we use actually hurts the patient.
Another one is thalidomide. There was a nausea medication marketed mostly in Germany in the
40s for nausea. It was a drug called thalidomide. Well, for a lot of reasons, a lot of them,
you know, inexcusable. It was never tested in pregnant persons. So what does that mean?
But pregnant persons get nausea and they vomit all the time. So they wanted to use this drug
called thalidomide. They gave it to pregnant persons and basically caused a lot of death.
As a consequence of poor research practices. All right, cool. We're back. This guy is like
ghosting out his iPad. Please go down like three or four slides. All right, other way.
Keep going, keep going. No, you're going the wrong way. No,
you're going the wrong way. Yeah, yeah, there you go. The other way.
Keep going, keep going. Keep going, keep going.
Okay, here's thalidomide. Great. So this is, okay, now we have this potential new failure.
Now I'm going to start off rapidly by asking myself, wait a minute, you're telling me that
the cybers and these malicious cybercriminals, are they hurting patients? No. If we make it to
the end of this talk, I'll give you a little, a few slides on why I think that's the case.
But what do we know about how security of medical devices and critical hospital infrastructure can
affect patients? All right, this is a slide about a paper I published over 10 years ago
by Kevin Foote's group. This was before Barnaby Jack, and they basically talked about how
easy it was to wirelessly attack and implant. These are devices that can implant into a person's
body and wires come from this implant and go into their heart. There was some concern that they
were able to induce shock. So you were watching TV, then you watch any of those shows about the
emergency department, you know, and they shock someone back to life. Well, these devices can
shock. And if you get shocked and you don't need to, and it happens to shock you at the wrong time,
you can actually. Next slide.
These are some great research done by Jay Radcliffe, who basically reverse-engineered his own insulin pump.
He's a hacker himself, and was able to show how easy it would be to deliver a potentially deadly
dose of insulin. So if you don't know that, if you get insulin and you're diabetic and it's at the
right level, great, you live. But if you don't need insulin and they give it to you, it can actually kill you.
Next slide. Some more pacemaker research. And before Barnaby died, he was going to give a talk
about hacking pacemakers. Rest in peace, Barnaby. Next slide.
Not just medical devices, this is critical hospital infrastructure. If you're interested in this,
this is a hospital for about three or four days. A really interesting story. I recommend you read
kind of what happened with that. Next slide. Devastating to, you know, hospital operations,
essentially put a hospital offline for three days while in hospital.
We had some infusion pump stuff, though, you know, it's not always the obvious stuff like an insulin
pump or a pacemaker. There's a lot of connected medical technology that is vulnerable. This
are infusion pumps. So you go to the hospital and you get an IV. This is a, you know, bag of medicine
and a tube that goes into an IV into your arm. Sometimes it's just, you know, saline, essentially
water with some salts to help hydrate you. But sometimes we deliver medications through your IV.
And sometimes we have to give you those medications over hours. And so we have to control the rate of
medication. If you get a little medication, it doesn't help. If you get too much medication,
it can kill you. How do we control the rate of medicine going into a patient? We use these
things called infusion pumps. They're basically mechanical pumps attached to embedded systems
that can be able to look at software, drug libraries, and control the way of medications.
Well, you know, I don't know, 10 years, 15 years ago, they were like, you know what the next great
generation of these is going to be? Let's put them on Wi-Fi so we can connect them to the network for,
what ended up happening was, and this is the most widely publicized example of this,
there are some significantly scary vulnerabilities associated with infusion pumps,
where they could give you way too much medicine, way too little medication.
Primarily vulnerabilities involving really poor or little authentication practices. Next slide,
please. Okay. Well, if you're into this, this is such a weird story. So some security researchers,
instead of finding, they found some vulnerabilities in the pacemaker. Instead of going to the
manufacturer and engaging in, you know, disclosure, coordinated disclosure, they went to like a hedge,
like a pseudo hedge fund. And they said, listen, we're going to release all this research about
how these pacemakers are FUBAR. We want to short the stock with you. And that was how they made a
lot of money, at least temporarily. The stock bounced back and this thing's getting litigated
as hell. But long story short, it's a really interesting kind of change in the research
landscape. Next slide. I mean, sure, throw some hearts out, throw some applause out,
whatever it is. Let me know if you're out there, if you heard about all the ransomware attacks
in hospitals. Cool. All right. Now, do it if you're responsible for one.
Ah, I almost got you there.
Listen, ransomware is in hospitals. And when COVID started, there was, I remember,
I guess in the news headlines, I was like, a bunch of ransomware crews were going to come
together and say, we're not going to get hospitals during COVID. A couple of big ones. And science,
you know, of course, ransomware is a plague. It's always going around. There's been a couple
hospitals recently. But largely speaking, it's been sort of research infrastructure. So
there's some news stories recently of state actors going after COVID research or ransom workers going
after academic research establishments. But of course, we can have a conversation about healthcare
and hacking without talking about Walmart pride. It's so crazy. When this happened,
I remember thinking to myself, like, whoa, I don't know if we're ever going to have anything
like this again. It took out over 30% of the United Kingdom's National Health Service's entire
infrastructure. What does that mean? Imagine if malware hit the US and took out one out of every
three hospitals across the country. Think about how disruptive that would be to clinical care.
Think about the patients that are going to be having strokes and heart attacks and are having
life threatening infections. Imagine how impactful that could have been.
And so that's really changed a lot of things and catalyzed a lot of positive actions. We're looking
at the security of these devices in a better light. The FDA has done a bunch of great work
talking about how we can make these devices more secure. When they come to market, they're not
plagued with a lot of the problems that we've been dealing with for the last 15 years. Next slide.
All right. And then check this out. What's crazy is the FDA actually recalled a medical device,
not because the pump was prone to break or because the wiring that goes into it was likely to fray
and cause electrocutions, which we do for all sorts of other medical devices on a regular interval.
The first time ever, we actually had a recall because of a nasty vulnerability that could,
in this article, as mentioned, lead to death. So we're going to have to do something about that.
Potential patient safety concerns. And so for the first time ever, we had the FDA saying, hey,
we can't tolerate this. We're going to actually recall the device. And then you got there and be
like, wait a minute. Is that the first? Why isn't this happening all the time? It's a really big
deal to recall a device. Patients might not trust devices after you recall them. So if you're a
diabetic and you've been told that some hacker can kill you by hacking your insulin pump,
you may not add an insulin pump next. If it's been recalled, you might not trust the technology.
And sometimes these patients will actually suffer from their lack of trust in other devices that
might be more secure, just because they don't know the difference between security in one
insulin pump versus the other. So a recall is a really big deal. It took a lot of guts for
the FDA to do this, and I really want to applaud them for that. Next slide.
So I hope you can see, like, I think of this picture that we're pretty fragile.
There's thousands and thousands of devices on our hospital network. Hundreds of workstations,
depending on how big the organization is. And in 2017, the National Health and Human Services
issued this report. They had this big task force. They got a bunch of famous people on this group,
including some hackers, and they basically came out to the end of this report basically saying,
you know, how scary the vulnerabilities of the healthcare system were. And one of the things
they pointed out was they thought a majority of hospitals, again, sorry, this is like US-focused
a little bit, but they thought a majority of hospitals in the United States lacked even a
single full-time security professional on staff. There are some parts or some
classrooms. You think that's crazy? You think that your hospital system doesn't have a full-time
security professional on staff? Yeah, throw somebody up if you think that's wild. Yeah,
that's insane. You know, that wouldn't be tolerated at a bank. It wouldn't be tolerated
at a lot of other institutions, likely. And yet those are patients' lives that are at risk,
right? These are institutions taking care of kids, potentially, and yet they're not going to have
the expertise that they need. It's hard, you know, they can't often pay the salaries.
It's really frustrating for a lot of hackers to work for healthcare because they don't get the
freedom to fix a lot of the issues they find, and it's all absolutely valid. But if you're looking
to make a difference, and you're looking to make a career change, and you want to put your skills
to good use, I'd really encourage you to check out working for a healthcare organization.
It's a challenging environment, and you have to deal with a lot of these issues,
but you're also going to have a little trial by fire, because I think we're also seeing pretty
well-documented and publicized campaigns of state hackers going after healthcare.
Next slide. All right, I'm going to let you guys read this later. Basically,
this says software is what powers modern healthcare. There's so much of it now,
and if we don't pay attention to it, we don't secure it, it's going to be a problem. If hackers
don't step up to help secure patients, the devices that they use, it's not just going to be
random death, but medical death that we're dealing with. It's going to be a much bigger
number of consequences. Next slide. Next slide. So I already kind of told you, I can't tell you
a story. I can't show you a news clipping of someone who died because their pacemaker was
hacked. But I'll just tell you, and this slide doesn't translate well, because we cut it into
images. But let's imagine you have a diffusion pump. It's running embedded Windows. It gets
infected. It's on the network, on the Wi-Fi, it's exposed. It gets owned by some crypto mining
malware. And as a consequence of this, the pump...
I told you, I think that this is likely far more relevant than we think, but we lack the
sophistication to actually measure it, to go out there and find evidence of it, because we're not
even looking. So this pump's malfunctioning. Who in a hospital is going to even recognize this
malfunction? Well, the best person is probably going to be the nurse, the person putting
medications into the pump, actually interfacing with the pump. So nurses are overworked,
amazing clinicians. I can't do my job as a doctor without them. I will say a lot of nurses would
not recognize this, because I've asked them. It's not any fault of their own. It's that they're
busy. They have four other patients in the ICU. COVID's happening. They're not necessarily
looking at that device to make sure that the right number of drips are coming out of their
IV bag. They trust the technology, and that's what I've heard over and over again from nurses
in the field, is that they are trained to trust these pumps. In fact, the pumps they're taught
are more safe than human beings doing it. Human beings controlling the rate of medication going
into a patient by titrating some little dial is far more prone to mistakes, either underdosing
a patient, than infusion pumps. So they're taught to trust it. Let's say you just have a crazy day,
and the nurse picks up on this malfunctioning device. What are they going to do? Well,
they're going to call bioengineering. This is a part of the hospital. These are people that
take care of medical devices, and they're going to come and replace it. Guess what?
They're going to replace it with the exact same vulnerable model that's likely unpatched,
and it's going to be pretty quickly infected with the exact same crypto mining malware.
But that aside, they're going to take that infected device, I imagine, in the basement.
You know, this is kind of a joke I say. I think all bioengineers live in the basement.
Not trolls, but that's just in my mind where this device is going. They're going to do some
very basic troubleshooting on it. Throw up a heart or a hand or something, whatever,
if you think that they're going to do forensics on this device.
Oh yeah, you get the pessimists just like me. Yeah, of course they're not going to. They're
not security experts. They know about clinical devices. They know about that. They don't know
about security. If the hospital is lucky to have any security folks, guess what? They live over
in IT, and they're in some closet, usually off campus, where all the cool people hang out like
us. But they aren't going to even know that the device is likely infected. Well, if they can't
fix it, you know, if they flash it and it's still acting up, who are they going to send it to?
It's a device manufacturer. Ask a bunch of device manufacturers. When you get a malfunctioning
medical device back in from a hospital, do you even consider the possibility that it's
infected with malware? And guess what? Raise your hand if you think even one of them said they do
forensics on malfunctioning medical devices. No, they don't. They lack that expertise too.
As a consequence, they're just not going to look for it. The problem we're not even looking for,
and it's perfectly designed for us to not have anyone even ask the question,
let alone the skill set, for us to find. I think the next slide, I think that was a
move along signal. What we don't want to do is have a crisis of confidence. You know,
we don't want patients to not trust medical technology or to trust healthcare. And that's
a big problem. You can go back to that slide of the angry old guy. Eric touched upon this,
which is it's important for us to be trusting some of these systems because we don't want people
having heart attacks and strokes saying, I don't want to go to that hospital. You know, I heard
they had a breach of patient records last week, and I don't want to be hacked. And well, they're
having a heart attack, right? If we don't do a good job, if hackers don't come and help healthcare
do a better job, teach them what they're doing wrong for this infrastructure, we face this very
real possibility that either the infrastructure is not just not even going to work at all in the
case of anonymously dossing Boston Children's, or it might work and it might actually be
somewhat robust and secure, but patients still don't trust because they're reading these news
headlines in the press. So let me go forward a few slides.
Right at the half hour mark, press something up if you want me to stop. Keep going, yeah, keep going.
I'm gonna fix this. Oh god, here we go. So there are so many policy elements to this that I think
are probably gonna bore a lot of hackers out there watching this stream. Thank you for
tolerating this. We won't get into the policy aspects of it, but listen,
if we are going to be buying millions of dollars of new devices for a hospital,
better do a good job recognizing what risk we are going to be accepting on our networks,
right? And that involves a lot of work up front. Vulnerability assessments, you know,
there's a thing called the MTSQ form that basically goes through what are all the security
controls available on this particular device, how secure out of the box is it, and what do you need
to do on the hospital side to make sure when that gets deployed, are you doing so in a way that's
most safe for the patients without causing unnecessary and laborious efforts that won't
help the patients. Next slide. By the way, most of that stuff in there was connected.
All right, listen, we're here at DEF CON, and I'm so amped to be virtually looking at all of
you in this room. And I will say, although COVID has been a little bit of a relief to be here with
my hacker family, presenting something that I'm passionate about. But listen, we, as mentioned
previously, hackers need to step up. We need people to help us in healthcare, basically do
the medical device research to help us with best practices, to help secure our networks. There's
been some actually some great collaborations between hackers and healthcare in these coalitions
where various hackers have pledged to essentially help defend hospitals if they should be under
attack, which I think was a very noble thing. You know, hackers really stepped up during COVID.
It's been, you know, volunteering to help defend hospitals against adversaries and cyber criminals,
or also printing PPE, being there to help with some of the different disinformation that's really
going out over social media. And as a consequence, I think this is hopefully something that persists.
I hope that COVID, as awful as it is, will help catalyze hackers and healthcare coming together.
If you're looking for more continued engagement with something like this, and as I mentioned,
you can choose for employment, but you can also just do some research. You know, I
went to research on medical devices. I buy them off eBay. You can do a lot of that. You can go
on offer up and buy some crazy medical devices. As long as you're, you know, doing responsible
research, knowing that it's a very big deal, and there's a lot of consequences that you need to
take into consideration, we need a lot of your talent out there to help us be more secure. So
please, please join. You can also, Biohacking Village is one of the DEF CON villages.
We really encourage you to check it out. All right, listen, I don't think we should make
all doctors aware of cybersecurity, make them experts. It's just not, it's not for purview.
And honestly, I've been too busy driving Ferraris. Just kidding, I don't have a Ferrari.
Only cardiologists have Ferraris. But what we need is, we need more nurses, we need more doctors
in this space, because when you change the conversation from, this is just patient data
that we want to secure, hey, we just want to get a violation or a purported breach,
to the NICU, the head NICU nurse saying, hey, listen, if this medical device doesn't work,
it's not available, or if the integrity of the data coming from this has been compromised,
this little 30-week-old baby premature in this incubator is going to suffer. That's the type
of conversation we need to have by partnering with clinicians. And you know what, it's going
to require some patience on our side as hackers. They don't speak our language, just like you
often don't speak theirs. Coming together in these interdisciplinary teams, working together,
going to be able to make people change their minds about what security means in healthcare,
not just HIPAA, not just privacy, but also patient safety. Next slide.
All right, I'm going to finish up after this little bit. So, and open up for some questions,
if anyone has it. So, you know, how many out there are familiar with last mile problem?
Just throw something out. Many industries have last mile problems. Yeah, so I'm not going to
I'm pretty sure if I tried to describe it in detail, I'm going to butcher it. So just forgive
me as I do butcher this. But in many industries, it's not necessarily... there are certain parts
of delivering things to consumers, for example, that are hard. And they might not be what you
think. So, for example, when you're shipping goods that are manufactured in a different country,
you know, you can make the particular product, and you can put it in a container ship,
and you can actually go across an entire ocean and it goes. So you can imagine all the logistics
involved in that. But guess what? All these companies that are doing that actually don't
dread all that stuff. They dread the last mile, which is how do you get it from the distribution
center into someone's home? It's a classic problem with ISPs. There's so many variations
and addresses and buildings that are built differently, et cetera, that the last mile
ends up being the hardest part. Well, healthcare has the last... healthcare security has the last
mile problem. And I'm going to talk to you about it right now. Next slide.
Oh, can you...
So, let's imagine we have an awesome hacker. She's donating her expertise. She buys a device
off of eBay. And she finds a vulnerability in it. She finds a nasty vulnerability that
potentially kills somebody in a medical device that she buys off of eBay. Who does she go and
talk to? Who does she go and talk to? Who does she go and talk to? Who does she go and talk to?
Well, she probably will engage in responsible coordinated disclosure. I know that there's
the language of that or what we used to describe as controversial. And in any regards, she's
elected to do responsible coordinated disclosure. She goes to the medical device manufacturer.
So, what is the medical device manufacturer going to do? Next slide.
Here we go. Medical device manufacturer is obligated to respond to that, right? They've
been plenty of documented examples of medical device manufacturers that screwed this up,
you know, threatened to sue researchers or ignored them. But that hasn't panned out very
well for them. And the FDA has come down pretty hard on those companies. So, as a consequence,
a lot of them are changing and they're actually engaging attackers. What does the medical device
manufacturer have to do? Well, they're obligated to report that to the regulator, which in this
case on medical devices ends up being the FDA. Well, the FDA is like, damn, this vulnerability
is nasty. We don't want any patients to get hurt. So, they're going to issue what's called a safety
communication. They have to, and a lot of this is really hard, they can get out there and tell
patients and doctors and hospitals that they have to worry about this device. And let's imagine that
goes off without a hitch, which has never happened before. You know, it's never an easy thing to do,
but let's imagine they do a great job and everyone that has that device is made aware of that.
Next slide. So, the medical manufacturer and the regulator are like, oh man, it's even so
concerning that we've got to issue a patch. Well, patching systems, you know, it's not controversial
from a hacker perspective in most cases, but one of these edge cases where it is controversial,
one of them is medical devices. But what if you poorly test your patch and actually cause some
type of clinical harm because you're patching something and you didn't do a good job testing
patch and actually the medical device malfunctions and hurts someone? Or there are all sorts of
different things, like how are you going to actually patch something that's in a human being?
You know, there are tens of thousands of, you know, tens of thousands of patients all across
the globe that have implantable medical devices. You're going to call them all into the doctor's
office and get their systems patched? Yeah, you get there and say yes, but it's a much harder thing
to do than to say, let's imagine they are so on the ball and this medical infrastructure has
patched this vulnerability and they've done it in record time and the patch is fantastic.
They have to roll that out. And this is where the last mile problem is. How do we get
from patching a medical device and get it to the actual patient? Because in this slide,
last part is the clinicians, right? The doctors and nurses have to call those patients in and
they got to put this magnetic interface onto their chest and they have to update the software.
Next slide. Well, guess what? I think many of you out there know that's just not going to happen.
It should happen, but it's not going to happen or it's not going to happen in any significant
percentages because this last mile problem is really hard. We have a registry of patients that
have these implantables, but guess what? Half the phone numbers aren't up to date or it was
implanted, you know, eight years ago and they moved and we have no idea how to send them a letter
or these doctors say, this is stupid. I'm not going to actually do this. It's such a pain in
the butt patch or I don't think this is really an issue. And as you can see, we have this last
mile problem. We can do all this great work and everything can go off perfectly. But if we don't
get patients and doctors together and tell them why this is important and have them understand it
and advocate for security, it's just not going to happen. All right, next slide. So I'm at 42.
You guys are probably thinking to yourself, you know, we can just go to the end of the question
slide. You're probably thinking to yourself, man, why did I get myself into this crazy ass talk? I
was looking in here for overflows. Why are we talking about this crazy healthcare stuff? But
I want to say I want to thank you for this opportunity. Thank you, Defcon Groups. Thank
you DCA 58619 for letting me talk about this stuff that's near and dear to my heart. And this
isn't the end of the conversation. I'm on Twitter, hit me up somewhere. If you're interested in this
space, there's a lot we can do together to help. And you know, how often do you get a chance to
use your skills for more than just privacy and security to really potentially save a life? That's
a big, big deal. I want to say thank you for what you do. I miss my family. And if next year's plague
is gone, I want to buy you all a beer in Vegas. Questions? I have a question. Yeah. What are some
of the groups that are valuable for people to reach out to you to help solve this problem?
Yeah, great question. So for those who didn't hear the question, it was what groups are...
you can go all the way to the end to the question slide. The very last slide, please. The question
was, what groups should I get involved with if I'm interested in this? There's the Biohacking
Village group, which has an ongoing presence throughout the year. There's a group called
Eye on the Calvary. I don't know how many of you out there are familiar with this, but they are
really a great organization that gets a lot of attention and is able to persuade a lot of
regulators like the FDA and other industries. There's a lot of power and a lot of awesome work
being done with Eye on the Calvary, things like Bo Wood and Josh Corman, and there's a lot in that
space. If you want to get involved in that, they have Slack that they'll invite you to.
They don't just do medical, so if you're into hacking cars or airplanes, all sorts of things,
but you want to also use your powers for good. Go to the next slide. Definitely check out that
organization. All right. Another question? All right. Cool. Hit me up on Discord if you
have any more. Again, this is a true, true honor. Take care, everyone. Thank you.