start	end	text
5880	14920	All right, hey, I'm Kwadi. I'm a weird guy, but I have a foot in two different worlds. My day job
16220	19820	is I'm an ER doc, so I practice in the emergency department.
19820	25980	I also do a lot of research in the security space, so where medicine and security collide.
27060	33300	Enough of that. Follow me on Twitter if you want. Next slide, please.
39700	51560	All right, so, you know, this has been my life until things in my neck of the woods kicked up
51560	56780	for COVID. So, you know, we talked about how toilet paper is worth gold. There was this
56780	64420	crazy-ass Netflix show. But things have changed, you know, and the pandemic started off about
64420	68660	tigers and toilet paper, but it's quickly gotten out of hand, and I promise this will
68660	79140	become relevant in a little bit. Next slide. You know, one of the biggest disappointments
79140	83860	in my life in COVID so far has been my inability to eat burritos like I used to before. I'm sure
83860	90180	many of you out there are experiencing a similar problem. I haven't figured out what the problem
90180	98120	is. I will say coming from San Diego, DCA 58619, we have the best burritos in America.
98120	114250	And so this is a big bummer. Next slide. This is my day job. So this isn't a shot from my ED,
114250	118610	my emergency department, but it's pretty much any of the emergency departments across the country
118610	129430	right now. And this has a lot to do with the problems of air crowding. And we splashed COVID
129430	135030	in on that, and now we have basically a greatly diminished ability to take care of patients,
135030	140890	and generally a crazy shift every time I go into work, and we're just seeing patients left and
140890	152460	right. Next slide. So we built these tents, and this is how crazy it was. So we were so worried
152460	159160	about patients overflowing out into the parking lot, et cetera, that we built these emergency
159160	167320	tents. And all these hospitals across the country started as quickly as possible deploying any
167320	175320	connected technology they could to extend the capabilities of a hospital into parking lots.
175880	182960	And generally speaking, across the country, this was the right thing to do. We were so worried
182960	188040	about running out of ventilators, et cetera, that there's a mad rush to plug everything
188040	199120	in onto the internet. Next slide. Just give me a favor out in the crowd,
199120	203360	like throw out some hearts or something, if you've been seeing your doctor by Zoom.
204100	208640	Oh yeah, we got some people out there. Isn't that the weirdest thing? I don't know. I'm also
208640	214120	kind of curious how many people out there really would prefer this. But all of a sudden, we went
214120	218840	from this world where in emergency medicine, where we take care of heart attacks and gunshot wounds
218840	225080	and appendicitis, and sometimes even like just toenails, you know, hangnails. All of a sudden,
225080	230940	we had this capability to do telemedicine. We were worried about what happens if our faculty
230940	236500	gets sick? What happens if all these ER docs and nurses get COVID and they can't come into work?
236500	239740	But the patients are just going to keep coming. So we thought to ourselves,
239740	243580	you know, we don't normally do telemedicine in emergency medicine. That's for like primary care
243580	248300	doc or your crazy dermatologist or whatever. But in emergency medicine for the first time,
251700	258060	from our homes when we get COVID, because otherwise those are going to be lost resources
258060	261520	and patients aren't going to see doctors. So it'd be better to see them over an iPad
262520	265920	than not see a doctor at all. Next slide.
272980	277660	And so all of this is kind of my day job. But for the longest time I've been a hacker,
277660	282620	just like you guys out there. This is me playing OpenCTF. Shoot, I must have been like
282620	289740	DEF CON 14 or 15. No, I was probably like 16. And so when you grow up a hacker, and all of a sudden
289740	296340	you find yourself in healthcare, and you can't help but think about how easy it would be to
296340	301140	socially engineer people in your space, or how insecure some of these systems are,
301140	306900	or that you're using medical technology with legacy operating systems, machines that have
306900	313280	been unpatched for over a decade. These types of things are realities in a lot of places in
313280	320860	the world, is that the race to digitize medicine in the race to increase electronic health records
320860	326500	and a variety of other things, what we had at the end of the day was hyper connectivity without
326500	333380	the commensurate attention to security. And it's not one of those things that people pay a lot of
333380	340140	attention to, but primarily because it's expensive. There's a lot of other things going on in the
340140	346200	space like COVID, for example. And then also when you buy a medical device, there's a decent chance
346200	351080	that that medical device is going to be in production for years and years and years, right?
351080	357440	So if you're at a bank or another company, you might have a much quicker hardware and software
358040	363460	lifecycle, as opposed to something like an MRI machine that costs over a million dollars for a
363460	368480	hospital. And when they buy one, they literally have to knock down walls in their hospital
368480	374320	to put it in. And that device is going to be in production for 10 years. Well, if it took
374320	379680	five years to develop it, what operating system do you think it's using its very first day it's
379680	384080	on market? It's going to be the operating system from five years ago. And so what we have been
384080	391700	seeing, unfortunately, a lot of time is these legacy machines are, sorry, our medical devices
391700	398200	are obsolete and using basically legacy operating systems while they're still brand new. Next slide.
406480	410460	I do some research. So I actually have to publish and do a bunch of stuff. So one
410460	414880	piece of research we did that turned into a DEF CON Talk at 20 was
415340	419600	we looked at the 911 system. So I studied a lot of out-of-hospital cardiac arrest,
419600	424880	so basically what happens if your heart stops right before we do shocks and CPR.
425040	429860	And I listened to thousands of 911 calls. And after I listened to so many of them,
429860	435020	there were some failures I noticed. And one of them were technical failures. So for example,
435020	439720	someone would pop up on their phone, try to get some location service to identify where they were,
439720	444220	because a dispatcher on the 911 call would be asking for their location, and they would say,
444220	448460	you know, I'm here. But in actuality, they were half a mile away because of bad
448460	453520	location technology. Or if they were using cell phone triangulation, for example, to
453520	458200	identify where a patient in distress was, we can tell based on, you know, there's a whole
458200	463280	bunch of reasons why that technology could fail. And one of the things I realized was, like,
463280	468460	what is the security and technical underpinnings of a 911 system, you know, a system that so many
468460	473940	patients rely on every single day in the most dire circumstances to make sure that they live.
473940	479080	And so we did some research over a year that talks up on YouTube. I think it's Defcon 20 or 22.
479180	485300	I can't remember. But the talk just goes through basically how insecure and antiquated our 911
485300	489460	infrastructure is. If you're an old phone freaker, you're going to get a kick out of the top,
489460	494120	because of just how old the technology is that they were using back then.
494120	500480	And then we did some stuff a couple years ago looking at how secure are your laboratory
500480	505040	information systems? You know, when you get your labs back from a doctor, you go to your doctor,
505040	512720	they order a bunch of blood work or an x-ray. And how secure, how confident are you in the
512720	517540	integrity of that data? So we looked at these things called laboratory information systems,
517540	524100	and we were able to basically show it's relatively easy to perform some very trivial man-in-the-middle
524100	528840	attacks or person-in-the-middle attacks, and change laboratory values in patients in the
528840	533220	hospital. So what does that mean? You go into the hospital, you really just ate a bad burrito,
533220	537620	and that's why your stomach's hurting. I changed your blood work to make it look like you have
539380	543200	diabetic ketoacidosis, you know, an emergency condition. The doctor looks at your labs,
543200	546540	and she said, oh, wow, it looks like you're really sick, when in actuality, you're not.
546540	550700	We changed the values, and they give you a treatment you don't need. And in that case,
550700	554760	it would be something like insulin. If you give someone insulin when they don't need it,
554760	559760	they can die. And so we were able to show you can change all sorts of things, primarily because of
559760	566200	this use of an old, antiquated protocol called HL7, or Health Data 7. We can talk more about
566200	572060	that later, and I'll post in the Discord some links to that stuff if you're interested. Next
572060	582750	slide. All right, I run the Do No Harm panel at DEF CON every year. Please come check us out.
582750	586970	I run another conference, too, called the CyberMed. I know, I'm not drinking right now,
586970	591590	and I said cyber like 15 times. I'm sorry. Forgive me. Next slide.
597650	602610	All right, so this is what we're going to talk about today. Wait, what? I'm here at DEF CON
602610	607550	Groups Allspace VR. Why the hell are we talking about this old-ass picture? I don't see any
607550	613850	badge life in here. I don't see any alcohol and debauchery of Hacker Jeopardy.
614470	620870	This is the most important thing to me, and this is my favorite painting. It's called The Doctor,
620870	625830	and it was painted in the late 1800s. And the reason it's my favorite painting is it reminds
625830	630950	me why I go to work every day. Now, quickly, let's just take a look. The top right, we get a mom
630950	636710	and a dad. At least, that's what I think they are. And mother has her face down on the table,
636710	642870	and dad laid on mine, and she's weeping. Dad looks concerned. The left side of the painting,
642870	649610	we see the title of this painting, which is The Doctor, looking concerned over a child,
649610	653550	the focal point of the entire painting, and that's the patient. I have been that doctor
653550	659870	before. I know what that doctor is thinking, and I've tried every treatment under the sun. I've
659870	663450	tried every medicine I know. I've tried every ounce of training I know, and I don't know if
663450	667010	this patient is going to make it through. Next slide.
675380	680600	This is health care today. So, that was the health care of the late 1800s. This is the
680600	685000	health care of today. It has something very similar. It has the patient in the middle,
685000	690080	but I want to draw your attention to everything around the patient. You see all those blinking
690080	698880	boxes? You see all those wires and cables? Imagine what the wireless is around the station
698880	706400	at that exact moment. This is modern health care. You cannot engage in health care in most
706400	713540	hospitals in the United States without facing this reality that everything's connected.
713660	719500	A lot of it is insecure. We're doing our best, but we have a long way to go. Next slide.
728840	734680	So, we screwed this up in medicine a long time. So, these are two publications. One was called
734680	739220	Two Heirs Human. This is about the millennial time, and the other one was Crossing the Quality
739220	744600	Chasm. And we talked about basically, let's look at data in medicine. Does this medicine work
744600	748800	compared to this one? Does this treatment work compared to this one? We want doctors to use
748800	754460	evidence-based medicine, but we also want to recognize that a lot of the time, medicines,
754460	759680	health care, doctors, nurses, the infrastructure, all of that actually hurts patients sometimes
759680	765840	because we make mistakes. We give someone medicine that they're allergic to. Can you guys
765840	776750	draw some hearts if the slides are down? Yeah, it looks like they're down. ATX, can we reload those?
806360	809280	I'll just kind of keep going a little bit. So, basically,
811320	814800	there have been plenty of examples of where in medicine
815760	821000	we've actually hurt patients when we went to help them. One of the examples is in about the
821540	827180	20s or 30s, you were almost guaranteed to die if you were a premature infant. The reason was that
827180	832240	premature infants have very immature lungs. They can't breathe. And it takes a long time while
832240	837160	they're in the womb for those lungs to mature. And for the first time ever, when we had better
837160	845120	plastics, and primarily when we had the power to concentrate and store oxygen, we were able
845120	849860	for the first time to allow premature babies to live. So, we had these little incubators,
849860	853960	and we were able to keep babies warm. We were able to give them oxygen because their lungs
853960	861700	weren't very good. Please tell me, I want in the audience, I want you to throw up a
861700	867160	applause if you think you should give the patient 100% oxygen. Let's pump as much oxygen as possible
867160	873560	into that little incubator. Or if you think we should do 50% oxygen, throw up some hearts. So,
873560	880200	hearts for 50%. Okay, we got 50%. Does anyone want to do 100% oxygen? Those lungs are pretty
880200	887200	immature. Throw up some applause. No? So, basically, we answer the question, right? Babies were living
887200	890180	for the first time. I'm going to pick what concentration of oxygen we're going to put
890180	897240	in their incubator. And we went with 100. And then these babies were living. A big percentage
897240	902340	of them were actually turning out blind. This is the cited reason why Stevie Wonder is blind,
902340	907400	because he had retinopathy of prematurity. It actually was the oxygen that was causing the
907400	911320	blindness. We didn't know if it was premature babies are more likely to be blind and now
911320	915740	they're living. Or it actually ended up after we studied tens of thousands of patients that
915740	921560	the oxygen was what was causing these patients to go blind. And so we went from going 100% oxygen
921560	927880	to 50% oxygen. This is one example of how treatment we use actually hurts the patient.
927880	933440	Another one is thalidomide. There was a nausea medication marketed mostly in Germany in the
933440	940700	40s for nausea. It was a drug called thalidomide. Well, for a lot of reasons, a lot of them,
940700	945220	you know, inexcusable. It was never tested in pregnant persons. So what does that mean?
945280	950860	But pregnant persons get nausea and they vomit all the time. So they wanted to use this drug
950860	956620	called thalidomide. They gave it to pregnant persons and basically caused a lot of death.
956620	963180	As a consequence of poor research practices. All right, cool. We're back. This guy is like
963820	977300	ghosting out his iPad. Please go down like three or four slides. All right, other way.
979160	988120	Keep going, keep going. No, you're going the wrong way. No,
988120	992940	you're going the wrong way. Yeah, yeah, there you go. The other way.
993000	1002720	Keep going, keep going. Keep going, keep going.
1018260	1026100	Okay, here's thalidomide. Great. So this is, okay, now we have this potential new failure.
1026100	1031340	Now I'm going to start off rapidly by asking myself, wait a minute, you're telling me that
1031340	1040760	the cybers and these malicious cybercriminals, are they hurting patients? No. If we make it to
1040760	1045000	the end of this talk, I'll give you a little, a few slides on why I think that's the case.
1045000	1051160	But what do we know about how security of medical devices and critical hospital infrastructure can
1051160	1057320	affect patients? All right, this is a slide about a paper I published over 10 years ago
1058120	1064380	by Kevin Foote's group. This was before Barnaby Jack, and they basically talked about how
1065520	1074860	easy it was to wirelessly attack and implant. These are devices that can implant into a person's
1074860	1081800	body and wires come from this implant and go into their heart. There was some concern that they
1081800	1087540	were able to induce shock. So you were watching TV, then you watch any of those shows about the
1087540	1091320	emergency department, you know, and they shock someone back to life. Well, these devices can
1091320	1096380	shock. And if you get shocked and you don't need to, and it happens to shock you at the wrong time,
1096380	1099200	you can actually. Next slide.
1115600	1124200	These are some great research done by Jay Radcliffe, who basically reverse-engineered his own insulin pump.
1124220	1130260	He's a hacker himself, and was able to show how easy it would be to deliver a potentially deadly
1130260	1135920	dose of insulin. So if you don't know that, if you get insulin and you're diabetic and it's at the
1135920	1140780	right level, great, you live. But if you don't need insulin and they give it to you, it can actually kill you.
1140800	1154000	Next slide. Some more pacemaker research. And before Barnaby died, he was going to give a talk
1154000	1158180	about hacking pacemakers. Rest in peace, Barnaby. Next slide.
1163420	1169800	Not just medical devices, this is critical hospital infrastructure. If you're interested in this,
1169800	1176380	this is a hospital for about three or four days. A really interesting story. I recommend you read
1176380	1183480	kind of what happened with that. Next slide. Devastating to, you know, hospital operations,
1183480	1186540	essentially put a hospital offline for three days while in hospital.
1188260	1193400	We had some infusion pump stuff, though, you know, it's not always the obvious stuff like an insulin
1193400	1199620	pump or a pacemaker. There's a lot of connected medical technology that is vulnerable. This
1199800	1205560	are infusion pumps. So you go to the hospital and you get an IV. This is a, you know, bag of medicine
1205560	1212000	and a tube that goes into an IV into your arm. Sometimes it's just, you know, saline, essentially
1212000	1218180	water with some salts to help hydrate you. But sometimes we deliver medications through your IV.
1218500	1222560	And sometimes we have to give you those medications over hours. And so we have to control the rate of
1222560	1226500	medication. If you get a little medication, it doesn't help. If you get too much medication,
1226500	1231740	it can kill you. How do we control the rate of medicine going into a patient? We use these
1231740	1239660	things called infusion pumps. They're basically mechanical pumps attached to embedded systems
1239660	1244840	that can be able to look at software, drug libraries, and control the way of medications.
1244840	1248920	Well, you know, I don't know, 10 years, 15 years ago, they were like, you know what the next great
1248920	1255060	generation of these is going to be? Let's put them on Wi-Fi so we can connect them to the network for,
1255060	1259740	what ended up happening was, and this is the most widely publicized example of this,
1259740	1264040	there are some significantly scary vulnerabilities associated with infusion pumps,
1264040	1267140	where they could give you way too much medicine, way too little medication.
1267740	1272560	Primarily vulnerabilities involving really poor or little authentication practices. Next slide,
1272560	1288080	please. Okay. Well, if you're into this, this is such a weird story. So some security researchers,
1288080	1293140	instead of finding, they found some vulnerabilities in the pacemaker. Instead of going to the
1293140	1298760	manufacturer and engaging in, you know, disclosure, coordinated disclosure, they went to like a hedge,
1298760	1302820	like a pseudo hedge fund. And they said, listen, we're going to release all this research about
1302820	1308880	how these pacemakers are FUBAR. We want to short the stock with you. And that was how they made a
1308880	1313220	lot of money, at least temporarily. The stock bounced back and this thing's getting litigated
1313220	1318580	as hell. But long story short, it's a really interesting kind of change in the research
1318580	1333110	landscape. Next slide. I mean, sure, throw some hearts out, throw some applause out,
1333110	1337110	whatever it is. Let me know if you're out there, if you heard about all the ransomware attacks
1337110	1342130	in hospitals. Cool. All right. Now, do it if you're responsible for one.
1343370	1345610	Ah, I almost got you there.
1348250	1352490	Listen, ransomware is in hospitals. And when COVID started, there was, I remember,
1352490	1357030	I guess in the news headlines, I was like, a bunch of ransomware crews were going to come
1357030	1362890	together and say, we're not going to get hospitals during COVID. A couple of big ones. And science,
1362890	1367610	you know, of course, ransomware is a plague. It's always going around. There's been a couple
1367610	1374110	hospitals recently. But largely speaking, it's been sort of research infrastructure. So
1374730	1380650	there's some news stories recently of state actors going after COVID research or ransom workers going
1380650	1387650	after academic research establishments. But of course, we can have a conversation about healthcare
1388250	1393650	and hacking without talking about Walmart pride. It's so crazy. When this happened,
1393650	1396730	I remember thinking to myself, like, whoa, I don't know if we're ever going to have anything
1396730	1404270	like this again. It took out over 30% of the United Kingdom's National Health Service's entire
1404270	1410350	infrastructure. What does that mean? Imagine if malware hit the US and took out one out of every
1410350	1415270	three hospitals across the country. Think about how disruptive that would be to clinical care.
1415270	1420630	Think about the patients that are going to be having strokes and heart attacks and are having
1420630	1425470	life threatening infections. Imagine how impactful that could have been.
1426170	1431390	And so that's really changed a lot of things and catalyzed a lot of positive actions. We're looking
1431390	1436010	at the security of these devices in a better light. The FDA has done a bunch of great work
1436010	1441530	talking about how we can make these devices more secure. When they come to market, they're not
1441530	1447210	plagued with a lot of the problems that we've been dealing with for the last 15 years. Next slide.
1467050	1473370	All right. And then check this out. What's crazy is the FDA actually recalled a medical device,
1473370	1480210	not because the pump was prone to break or because the wiring that goes into it was likely to fray
1480210	1485010	and cause electrocutions, which we do for all sorts of other medical devices on a regular interval.
1485010	1491770	The first time ever, we actually had a recall because of a nasty vulnerability that could,
1491770	1493850	in this article, as mentioned, lead to death. So we're going to have to do something about that.
1493850	1498490	Potential patient safety concerns. And so for the first time ever, we had the FDA saying, hey,
1498490	1502810	we can't tolerate this. We're going to actually recall the device. And then you got there and be
1502810	1507670	like, wait a minute. Is that the first? Why isn't this happening all the time? It's a really big
1507670	1514990	deal to recall a device. Patients might not trust devices after you recall them. So if you're a
1515470	1520270	diabetic and you've been told that some hacker can kill you by hacking your insulin pump,
1520270	1525130	you may not add an insulin pump next. If it's been recalled, you might not trust the technology.
1525590	1532290	And sometimes these patients will actually suffer from their lack of trust in other devices that
1532290	1535990	might be more secure, just because they don't know the difference between security in one
1535990	1542210	insulin pump versus the other. So a recall is a really big deal. It took a lot of guts for
1542210	1546090	the FDA to do this, and I really want to applaud them for that. Next slide.
1553280	1558540	So I hope you can see, like, I think of this picture that we're pretty fragile.
1558540	1566220	There's thousands and thousands of devices on our hospital network. Hundreds of workstations,
1566220	1572220	depending on how big the organization is. And in 2017, the National Health and Human Services
1572220	1579600	issued this report. They had this big task force. They got a bunch of famous people on this group,
1579600	1584260	including some hackers, and they basically came out to the end of this report basically saying,
1584260	1590000	you know, how scary the vulnerabilities of the healthcare system were. And one of the things
1590000	1594920	they pointed out was they thought a majority of hospitals, again, sorry, this is like US-focused
1595200	1599510	a little bit, but they thought a majority of hospitals in the United States lacked even a
1600220	1604210	single full-time security professional on staff. There are some parts or some
1604990	1610470	classrooms. You think that's crazy? You think that your hospital system doesn't have a full-time
1610470	1615290	security professional on staff? Yeah, throw somebody up if you think that's wild. Yeah,
1615290	1619630	that's insane. You know, that wouldn't be tolerated at a bank. It wouldn't be tolerated
1619630	1625390	at a lot of other institutions, likely. And yet those are patients' lives that are at risk,
1625390	1629650	right? These are institutions taking care of kids, potentially, and yet they're not going to have
1629650	1635570	the expertise that they need. It's hard, you know, they can't often pay the salaries.
1636830	1644070	It's really frustrating for a lot of hackers to work for healthcare because they don't get the
1644070	1649570	freedom to fix a lot of the issues they find, and it's all absolutely valid. But if you're looking
1649570	1652710	to make a difference, and you're looking to make a career change, and you want to put your skills
1652710	1656690	to good use, I'd really encourage you to check out working for a healthcare organization.
1656690	1659190	It's a challenging environment, and you have to deal with a lot of these issues,
1659190	1662890	but you're also going to have a little trial by fire, because I think we're also seeing pretty
1664110	1669590	well-documented and publicized campaigns of state hackers going after healthcare.
1669790	1680170	Next slide. All right, I'm going to let you guys read this later. Basically,
1680170	1685490	this says software is what powers modern healthcare. There's so much of it now,
1685490	1689170	and if we don't pay attention to it, we don't secure it, it's going to be a problem. If hackers
1689170	1696030	don't step up to help secure patients, the devices that they use, it's not just going to be
1696030	1699550	random death, but medical death that we're dealing with. It's going to be a much bigger
1699550	1713900	number of consequences. Next slide. Next slide. So I already kind of told you, I can't tell you
1714060	1720640	a story. I can't show you a news clipping of someone who died because their pacemaker was
1720640	1726340	hacked. But I'll just tell you, and this slide doesn't translate well, because we cut it into
1726340	1732760	images. But let's imagine you have a diffusion pump. It's running embedded Windows. It gets
1732760	1739380	infected. It's on the network, on the Wi-Fi, it's exposed. It gets owned by some crypto mining
1739380	1743120	malware. And as a consequence of this, the pump...
1753820	1759040	I told you, I think that this is likely far more relevant than we think, but we lack the
1759040	1765040	sophistication to actually measure it, to go out there and find evidence of it, because we're not
1765040	1771300	even looking. So this pump's malfunctioning. Who in a hospital is going to even recognize this
1771300	1775160	malfunction? Well, the best person is probably going to be the nurse, the person putting
1775160	1782440	medications into the pump, actually interfacing with the pump. So nurses are overworked,
1782440	1788560	amazing clinicians. I can't do my job as a doctor without them. I will say a lot of nurses would
1788560	1792380	not recognize this, because I've asked them. It's not any fault of their own. It's that they're
1792380	1797060	busy. They have four other patients in the ICU. COVID's happening. They're not necessarily
1797060	1801700	looking at that device to make sure that the right number of drips are coming out of their
1801700	1808960	IV bag. They trust the technology, and that's what I've heard over and over again from nurses
1808960	1815500	in the field, is that they are trained to trust these pumps. In fact, the pumps they're taught
1815500	1821680	are more safe than human beings doing it. Human beings controlling the rate of medication going
1821680	1828840	into a patient by titrating some little dial is far more prone to mistakes, either underdosing
1829640	1834500	a patient, than infusion pumps. So they're taught to trust it. Let's say you just have a crazy day,
1834500	1840720	and the nurse picks up on this malfunctioning device. What are they going to do? Well,
1840720	1844920	they're going to call bioengineering. This is a part of the hospital. These are people that
1844920	1848420	take care of medical devices, and they're going to come and replace it. Guess what?
1848420	1853560	They're going to replace it with the exact same vulnerable model that's likely unpatched,
1853560	1860040	and it's going to be pretty quickly infected with the exact same crypto mining malware.
1860280	1864880	But that aside, they're going to take that infected device, I imagine, in the basement.
1864880	1869040	You know, this is kind of a joke I say. I think all bioengineers live in the basement.
1869040	1873600	Not trolls, but that's just in my mind where this device is going. They're going to do some
1873600	1879220	very basic troubleshooting on it. Throw up a heart or a hand or something, whatever,
1879220	1882180	if you think that they're going to do forensics on this device.
1883560	1887440	Oh yeah, you get the pessimists just like me. Yeah, of course they're not going to. They're
1887440	1892960	not security experts. They know about clinical devices. They know about that. They don't know
1892960	1897520	about security. If the hospital is lucky to have any security folks, guess what? They live over
1897520	1902380	in IT, and they're in some closet, usually off campus, where all the cool people hang out like
1902380	1908860	us. But they aren't going to even know that the device is likely infected. Well, if they can't
1908860	1913300	fix it, you know, if they flash it and it's still acting up, who are they going to send it to?
1913300	1918120	It's a device manufacturer. Ask a bunch of device manufacturers. When you get a malfunctioning
1918120	1922620	medical device back in from a hospital, do you even consider the possibility that it's
1922620	1927940	infected with malware? And guess what? Raise your hand if you think even one of them said they do
1927940	1934360	forensics on malfunctioning medical devices. No, they don't. They lack that expertise too.
1934360	1941800	As a consequence, they're just not going to look for it. The problem we're not even looking for,
1941800	1946080	and it's perfectly designed for us to not have anyone even ask the question,
1946080	1954980	let alone the skill set, for us to find. I think the next slide, I think that was a
1954980	1960980	move along signal. What we don't want to do is have a crisis of confidence. You know,
1960980	1966000	we don't want patients to not trust medical technology or to trust healthcare. And that's
1966000	1972820	a big problem. You can go back to that slide of the angry old guy. Eric touched upon this,
1972820	1980400	which is it's important for us to be trusting some of these systems because we don't want people
1980400	1984800	having heart attacks and strokes saying, I don't want to go to that hospital. You know, I heard
1984800	1990880	they had a breach of patient records last week, and I don't want to be hacked. And well, they're
1990880	1997760	having a heart attack, right? If we don't do a good job, if hackers don't come and help healthcare
1997760	2003940	do a better job, teach them what they're doing wrong for this infrastructure, we face this very
2003940	2008160	real possibility that either the infrastructure is not just not even going to work at all in the
2008160	2014600	case of anonymously dossing Boston Children's, or it might work and it might actually be
2014600	2019940	somewhat robust and secure, but patients still don't trust because they're reading these news
2019940	2025840	headlines in the press. So let me go forward a few slides.
2028890	2035390	Right at the half hour mark, press something up if you want me to stop. Keep going, yeah, keep going.
2038270	2046150	I'm gonna fix this. Oh god, here we go. So there are so many policy elements to this that I think
2046150	2050110	are probably gonna bore a lot of hackers out there watching this stream. Thank you for
2050950	2054970	tolerating this. We won't get into the policy aspects of it, but listen,
2054970	2061010	if we are going to be buying millions of dollars of new devices for a hospital,
2061010	2067110	better do a good job recognizing what risk we are going to be accepting on our networks,
2067110	2075110	right? And that involves a lot of work up front. Vulnerability assessments, you know,
2075110	2081630	there's a thing called the MTSQ form that basically goes through what are all the security
2081630	2086530	controls available on this particular device, how secure out of the box is it, and what do you need
2086530	2091230	to do on the hospital side to make sure when that gets deployed, are you doing so in a way that's
2091230	2100130	most safe for the patients without causing unnecessary and laborious efforts that won't
2100130	2110860	help the patients. Next slide. By the way, most of that stuff in there was connected.
2111880	2117120	All right, listen, we're here at DEF CON, and I'm so amped to be virtually looking at all of
2117120	2123300	you in this room. And I will say, although COVID has been a little bit of a relief to be here with
2123300	2130940	my hacker family, presenting something that I'm passionate about. But listen, we, as mentioned
2130940	2139300	previously, hackers need to step up. We need people to help us in healthcare, basically do
2139300	2145420	the medical device research to help us with best practices, to help secure our networks. There's
2145420	2150960	been some actually some great collaborations between hackers and healthcare in these coalitions
2150960	2157460	where various hackers have pledged to essentially help defend hospitals if they should be under
2157460	2162280	attack, which I think was a very noble thing. You know, hackers really stepped up during COVID.
2162280	2167640	It's been, you know, volunteering to help defend hospitals against adversaries and cyber criminals,
2167640	2174540	or also printing PPE, being there to help with some of the different disinformation that's really
2174540	2180820	going out over social media. And as a consequence, I think this is hopefully something that persists.
2180820	2187660	I hope that COVID, as awful as it is, will help catalyze hackers and healthcare coming together.
2187880	2192240	If you're looking for more continued engagement with something like this, and as I mentioned,
2192240	2195540	you can choose for employment, but you can also just do some research. You know, I
2195540	2200380	went to research on medical devices. I buy them off eBay. You can do a lot of that. You can go
2200380	2205720	on offer up and buy some crazy medical devices. As long as you're, you know, doing responsible
2205720	2211180	research, knowing that it's a very big deal, and there's a lot of consequences that you need to
2211180	2216320	take into consideration, we need a lot of your talent out there to help us be more secure. So
2216940	2222660	please, please join. You can also, Biohacking Village is one of the DEF CON villages.
2222800	2227400	We really encourage you to check it out. All right, listen, I don't think we should make
2227400	2232680	all doctors aware of cybersecurity, make them experts. It's just not, it's not for purview.
2232680	2238260	And honestly, I've been too busy driving Ferraris. Just kidding, I don't have a Ferrari.
2238980	2245220	Only cardiologists have Ferraris. But what we need is, we need more nurses, we need more doctors
2245220	2250860	in this space, because when you change the conversation from, this is just patient data
2250860	2255060	that we want to secure, hey, we just want to get a violation or a purported breach,
2255060	2261320	to the NICU, the head NICU nurse saying, hey, listen, if this medical device doesn't work,
2261320	2266000	it's not available, or if the integrity of the data coming from this has been compromised,
2266000	2273660	this little 30-week-old baby premature in this incubator is going to suffer. That's the type
2273660	2277060	of conversation we need to have by partnering with clinicians. And you know what, it's going
2277060	2281340	to require some patience on our side as hackers. They don't speak our language, just like you
2281340	2286300	often don't speak theirs. Coming together in these interdisciplinary teams, working together,
2286300	2292800	going to be able to make people change their minds about what security means in healthcare,
2292800	2299120	not just HIPAA, not just privacy, but also patient safety. Next slide.
2309100	2314260	All right, I'm going to finish up after this little bit. So, and open up for some questions,
2314260	2318540	if anyone has it. So, you know, how many out there are familiar with last mile problem?
2318580	2323320	Just throw something out. Many industries have last mile problems. Yeah, so I'm not going to
2323320	2327720	I'm pretty sure if I tried to describe it in detail, I'm going to butcher it. So just forgive
2327720	2334280	me as I do butcher this. But in many industries, it's not necessarily... there are certain parts
2334280	2339420	of delivering things to consumers, for example, that are hard. And they might not be what you
2339420	2346500	think. So, for example, when you're shipping goods that are manufactured in a different country,
2346500	2353840	you know, you can make the particular product, and you can put it in a container ship,
2353840	2358220	and you can actually go across an entire ocean and it goes. So you can imagine all the logistics
2358220	2362460	involved in that. But guess what? All these companies that are doing that actually don't
2362460	2367360	dread all that stuff. They dread the last mile, which is how do you get it from the distribution
2367360	2373900	center into someone's home? It's a classic problem with ISPs. There's so many variations
2373900	2379000	and addresses and buildings that are built differently, et cetera, that the last mile
2379000	2385420	ends up being the hardest part. Well, healthcare has the last... healthcare security has the last
2385420	2388480	mile problem. And I'm going to talk to you about it right now. Next slide.
2390540	2391820	Oh, can you...
2405950	2415690	So, let's imagine we have an awesome hacker. She's donating her expertise. She buys a device
2415690	2422130	off of eBay. And she finds a vulnerability in it. She finds a nasty vulnerability that
2422130	2427750	potentially kills somebody in a medical device that she buys off of eBay. Who does she go and
2427750	2427970	talk to? Who does she go and talk to? Who does she go and talk to? Who does she go and talk to?
2427970	2433930	Well, she probably will engage in responsible coordinated disclosure. I know that there's
2433930	2440310	the language of that or what we used to describe as controversial. And in any regards, she's
2440310	2445610	elected to do responsible coordinated disclosure. She goes to the medical device manufacturer.
2445930	2449030	So, what is the medical device manufacturer going to do? Next slide.
2459610	2466250	Here we go. Medical device manufacturer is obligated to respond to that, right? They've
2466250	2470610	been plenty of documented examples of medical device manufacturers that screwed this up,
2470610	2475170	you know, threatened to sue researchers or ignored them. But that hasn't panned out very
2475170	2480150	well for them. And the FDA has come down pretty hard on those companies. So, as a consequence,
2480290	2485370	a lot of them are changing and they're actually engaging attackers. What does the medical device
2485370	2489910	manufacturer have to do? Well, they're obligated to report that to the regulator, which in this
2489910	2494870	case on medical devices ends up being the FDA. Well, the FDA is like, damn, this vulnerability
2494870	2498230	is nasty. We don't want any patients to get hurt. So, they're going to issue what's called a safety
2498230	2505350	communication. They have to, and a lot of this is really hard, they can get out there and tell
2505350	2512010	patients and doctors and hospitals that they have to worry about this device. And let's imagine that
2512010	2516990	goes off without a hitch, which has never happened before. You know, it's never an easy thing to do,
2516990	2521650	but let's imagine they do a great job and everyone that has that device is made aware of that.
2521650	2535810	Next slide. So, the medical manufacturer and the regulator are like, oh man, it's even so
2535810	2542030	concerning that we've got to issue a patch. Well, patching systems, you know, it's not controversial
2542030	2548130	from a hacker perspective in most cases, but one of these edge cases where it is controversial,
2548130	2554050	one of them is medical devices. But what if you poorly test your patch and actually cause some
2554050	2558350	type of clinical harm because you're patching something and you didn't do a good job testing
2558350	2564290	patch and actually the medical device malfunctions and hurts someone? Or there are all sorts of
2564290	2568490	different things, like how are you going to actually patch something that's in a human being?
2568530	2572810	You know, there are tens of thousands of, you know, tens of thousands of patients all across
2572810	2576770	the globe that have implantable medical devices. You're going to call them all into the doctor's
2576770	2582030	office and get their systems patched? Yeah, you get there and say yes, but it's a much harder thing
2582030	2589430	to do than to say, let's imagine they are so on the ball and this medical infrastructure has
2589430	2594050	patched this vulnerability and they've done it in record time and the patch is fantastic.
2594490	2599770	They have to roll that out. And this is where the last mile problem is. How do we get
2599770	2607690	from patching a medical device and get it to the actual patient? Because in this slide,
2607690	2613690	last part is the clinicians, right? The doctors and nurses have to call those patients in and
2613690	2620030	they got to put this magnetic interface onto their chest and they have to update the software.
2620150	2627030	Next slide. Well, guess what? I think many of you out there know that's just not going to happen.
2627130	2630910	It should happen, but it's not going to happen or it's not going to happen in any significant
2630910	2636890	percentages because this last mile problem is really hard. We have a registry of patients that
2636890	2642550	have these implantables, but guess what? Half the phone numbers aren't up to date or it was
2642550	2646650	implanted, you know, eight years ago and they moved and we have no idea how to send them a letter
2646650	2650990	or these doctors say, this is stupid. I'm not going to actually do this. It's such a pain in
2650990	2655810	the butt patch or I don't think this is really an issue. And as you can see, we have this last
2655810	2660890	mile problem. We can do all this great work and everything can go off perfectly. But if we don't
2660890	2666550	get patients and doctors together and tell them why this is important and have them understand it
2666550	2674010	and advocate for security, it's just not going to happen. All right, next slide. So I'm at 42.
2674490	2680530	You guys are probably thinking to yourself, you know, we can just go to the end of the question
2680530	2685110	slide. You're probably thinking to yourself, man, why did I get myself into this crazy ass talk? I
2685110	2689590	was looking in here for overflows. Why are we talking about this crazy healthcare stuff? But
2689590	2693590	I want to say I want to thank you for this opportunity. Thank you, Defcon Groups. Thank
2693590	2698670	you DCA 58619 for letting me talk about this stuff that's near and dear to my heart. And this
2698670	2703110	isn't the end of the conversation. I'm on Twitter, hit me up somewhere. If you're interested in this
2703110	2708290	space, there's a lot we can do together to help. And you know, how often do you get a chance to
2708290	2715410	use your skills for more than just privacy and security to really potentially save a life? That's
2715530	2720170	a big, big deal. I want to say thank you for what you do. I miss my family. And if next year's plague
2720170	2737640	is gone, I want to buy you all a beer in Vegas. Questions? I have a question. Yeah. What are some
2737640	2742660	of the groups that are valuable for people to reach out to you to help solve this problem?
2743560	2746880	Yeah, great question. So for those who didn't hear the question, it was what groups are...
2748120	2752920	you can go all the way to the end to the question slide. The very last slide, please. The question
2752920	2758120	was, what groups should I get involved with if I'm interested in this? There's the Biohacking
2758120	2762120	Village group, which has an ongoing presence throughout the year. There's a group called
2762120	2765940	Eye on the Calvary. I don't know how many of you out there are familiar with this, but they are
2765940	2772340	really a great organization that gets a lot of attention and is able to persuade a lot of
2772340	2778840	regulators like the FDA and other industries. There's a lot of power and a lot of awesome work
2778840	2783160	being done with Eye on the Calvary, things like Bo Wood and Josh Corman, and there's a lot in that
2783160	2787180	space. If you want to get involved in that, they have Slack that they'll invite you to.
2787220	2793040	They don't just do medical, so if you're into hacking cars or airplanes, all sorts of things,
2793040	2801800	but you want to also use your powers for good. Go to the next slide. Definitely check out that
2801800	2816250	organization. All right. Another question? All right. Cool. Hit me up on Discord if you
2816250	2820490	have any more. Again, this is a true, true honor. Take care, everyone. Thank you.