WEBVTT 00:05.880 --> 00:08.080 All right, hey, I'm Kwadi. 00:08.240 --> 00:13.900 I'm a weird guy, but I have a foot in two different worlds. 00:13.940 --> 00:19.820 My day job is I'm an ER doc, so I practice in the emergency department. 00:19.820 --> 00:25.980 I also do a lot of research in the security space, so where medicine and security collide. 00:27.060 --> 00:28.120 Enough of that. 00:28.120 --> 00:29.980 Follow me on Twitter if you want. 00:31.280 --> 00:33.300 Next slide, please. 00:39.700 --> 00:52.500 All right, so, you know, this has been my life until things in my neck of the woods kicked up for COVID. 00:52.500 --> 00:55.580 So, you know, we talked about how toilet paper is worth gold. 00:55.860 --> 00:58.900 There was this crazy-ass Netflix show. 00:59.300 --> 01:09.640 But things have changed, you know, and the pandemic started off about tigers and toilet paper, but it's quickly gotten out of hand, and I promise this will become relevant in a little bit. 01:09.640 --> 01:10.660 Next slide. 01:15.900 --> 01:23.580 You know, one of the biggest disappointments in my life in COVID so far has been my inability to eat burritos like I used to before. 01:23.580 --> 01:27.600 I'm sure many of you out there are experiencing a similar problem. 01:27.880 --> 01:30.660 I haven't figured out what the problem is. 01:30.660 --> 01:38.120 I will say coming from San Diego, DCA 58619, we have the best burritos in America. 01:38.120 --> 01:39.740 And so this is a big bummer. 01:39.740 --> 01:40.640 Next slide. 01:50.350 --> 01:51.650 This is my day job. 01:51.650 --> 01:59.430 So this isn't a shot from my ED, my emergency department, but it's pretty much any of the emergency departments across the country right now. 01:59.650 --> 02:04.850 And this has a lot to do with the problems of air crowding. 02:07.470 --> 02:21.310 And we splashed COVID in on that, and now we have basically a greatly diminished ability to take care of patients, and generally a crazy shift every time I go into work, and we're just seeing patients left and right. 02:21.310 --> 02:22.210 Next slide. 02:27.400 --> 02:31.280 So we built these tents, and this is how crazy it was. 02:31.280 --> 02:40.520 So we were so worried about patients overflowing out into the parking lot, et cetera, that we built these emergency tents. 02:40.520 --> 02:55.320 And all these hospitals across the country started as quickly as possible deploying any connected technology they could to extend the capabilities of a hospital into parking lots. 02:55.880 --> 03:01.880 And generally speaking, across the country, this was the right thing to do. 03:01.880 --> 03:09.180 We were so worried about running out of ventilators, et cetera, that there's a mad rush to plug everything in onto the internet. 03:09.360 --> 03:10.440 Next slide. 03:17.140 --> 03:23.360 Just give me a favor out in the crowd, like throw out some hearts or something, if you've been seeing your doctor by Zoom. 03:24.100 --> 03:26.480 Oh yeah, we got some people out there. 03:26.480 --> 03:27.700 Isn't that the weirdest thing? 03:27.700 --> 03:28.280 I don't know. 03:28.280 --> 03:32.680 I'm also kind of curious how many people out there really would prefer this. 03:32.680 --> 03:43.960 But all of a sudden, we went from this world where in emergency medicine, where we take care of heart attacks and gunshot wounds and appendicitis, and sometimes even like just toenails, you know, hangnails. 03:44.340 --> 03:47.880 All of a sudden, we had this capability to do telemedicine. 03:47.880 --> 03:51.520 We were worried about what happens if our faculty gets sick? 03:51.520 --> 03:56.500 What happens if all these ER docs and nurses get COVID and they can't come into work? 03:56.500 --> 03:58.700 But the patients are just going to keep coming. 03:58.700 --> 04:02.560 So we thought to ourselves, you know, we don't normally do telemedicine in emergency medicine. 04:02.560 --> 04:06.740 That's for like primary care doc or your crazy dermatologist or whatever. 04:06.740 --> 04:08.300 But in emergency medicine for the first time, 04:11.700 --> 04:19.460 from our homes when we get COVID, because otherwise those are going to be lost resources and patients aren't going to see doctors. 04:19.460 --> 04:24.820 So it'd be better to see them over an iPad than not see a doctor at all. 04:24.900 --> 04:25.920 Next slide. 04:32.980 --> 04:35.660 And so all of this is kind of my day job. 04:35.660 --> 04:38.860 But for the longest time I've been a hacker, just like you guys out there. 04:38.860 --> 04:40.960 This is me playing OpenCTF. 04:41.280 --> 04:44.340 Shoot, I must have been like DEF CON 14 or 15. 04:44.340 --> 04:45.980 No, I was probably like 16. 04:46.680 --> 05:06.400 And so when you grow up a hacker, and all of a sudden you find yourself in healthcare, and you can't help but think about how easy it would be to socially engineer people in your space, or how insecure some of these systems are, or that you're using medical technology with legacy operating systems, 05:06.400 --> 05:09.640 machines that have been unpatched for over a decade. 05:09.900 --> 05:29.500 These types of things are realities in a lot of places in the world, is that the race to digitize medicine in the race to increase electronic health records and a variety of other things, what we had at the end of the day was hyper connectivity without the commensurate attention to security. 05:30.100 --> 05:37.580 And it's not one of those things that people pay a lot of attention to, but primarily because it's expensive. 05:38.080 --> 05:42.120 There's a lot of other things going on in the space like COVID, for example. 05:42.260 --> 05:51.080 And then also when you buy a medical device, there's a decent chance that that medical device is going to be in production for years and years and years, right? 05:51.080 --> 06:03.700 So if you're at a bank or another company, you might have a much quicker hardware and software lifecycle, as opposed to something like an MRI machine that costs over a million dollars for a hospital . 06:03.700 --> 06:09.820 And when they buy one, they literally have to knock down walls in their hospital to put it in. 06:09.820 --> 06:12.960 And that device is going to be in production for 10 years. 06:12.960 --> 06:20.480 Well, if it took five years to develop it, what operating system do you think it's using its very first day it's on market? 06:20.480 --> 06:23.240 It's going to be the operating system from five years ago. 06:23.240 --> 06:37.120 And so what we have been seeing, unfortunately, a lot of time is these legacy machines are, sorry, our medical devices are obsolete and using basically legacy operating systems while they're still brand new. 06:37.140 --> 06:38.200 Next slide. 06:46.480 --> 06:47.920 I do some research. 06:47.920 --> 06:50.080 So I actually have to publish and do a bunch of stuff. 06:50.080 --> 06:57.340 So one piece of research we did that turned into a DEF CON Talk at 20 was we looked at the 911 system. 06:57.340 --> 07:04.880 So I studied a lot of out-of-hospital cardiac arrest, so basically what happens if your heart stops right before we do shocks and CPR. 07:05.040 --> 07:07.680 And I listened to thousands of 911 calls. 07:07.680 --> 07:11.940 And after I listened to so many of them, there were some failures I noticed. 07:11.940 --> 07:13.680 And one of them were technical failures. 07:13.680 --> 07:25.060 So for example, someone would pop up on their phone, try to get some location service to identify where they were, because a dispatcher on the 911 call would be asking for their location, and they would say, you know, I'm here. 07:25.060 --> 07:29.960 But in actuality, they were half a mile away because of bad location technology. 07:29.960 --> 07:40.720 Or if they were using cell phone triangulation, for example, to identify where a patient in distress was, we can tell based on, you know, there's a whole bunch of reasons why that technology could fail. 07:41.380 --> 07:53.940 And one of the things I realized was, like, what is the security and technical underpinnings of a 911 system, you know, a system that so many patients rely on every single day in the most dire circumstances to make sure that they live. 07:53.940 --> 07:56.900 And so we did some research over a year that talks up on YouTube. 07:56.900 --> 07:59.080 I think it's Defcon 20 or 22. 07:59.180 --> 08:00.240 I can't remember. 08:00.320 --> 08:06.480 But the talk just goes through basically how insecure and antiquated our 911 infrastructure is. 08:06.480 --> 08:14.120 If you're an old phone freaker, you're going to get a kick out of the top, because of just how old the technology is that they were using back then. 08:14.120 --> 08:21.860 And then we did some stuff a couple years ago looking at how secure are your laboratory information systems? 08:21.860 --> 08:28.140 You know, when you get your labs back from a doctor, you go to your doctor, they order a bunch of blood work or an x-ray. 08:28.380 --> 08:34.260 And how secure, how confident are you in the integrity of that data? 08:34.260 --> 08:49.360 So we looked at these things called laboratory information systems, and we were able to basically show it's relatively easy to perform some very trivial man-in-the-middle attacks or person-in-the-middle attacks, and change laboratory values in patients in the hospital. 08:49.360 --> 08:50.280 So what does that mean? 08:50.280 --> 08:54.780 You go into the hospital, you really just ate a bad burrito, and that's why your stomach's hurting. 08:54.840 --> 09:01.720 I changed your blood work to make it look like you have diabetic ketoacidosis, you know, an emergency condition. 09:01.820 --> 09:06.540 The doctor looks at your labs, and she said, oh, wow, it looks like you're really sick, when in actuality, you're not. 09:06.540 --> 09:10.000 We changed the values, and they give you a treatment you don't need. 09:10.000 --> 09:12.260 And in that case, it would be something like insulin. 09:12.500 --> 09:15.700 If you give someone insulin when they don't need it, they can die. 09:15.700 --> 09:24.800 And so we were able to show you can change all sorts of things, primarily because of this use of an old, antiquated protocol called HL7, or Health Data 7. 09:25.080 --> 09:31.860 We can talk more about that later, and I'll post in the Discord some links to that stuff if you're interested. 09:31.860 --> 09:32.700 Next slide. 09:38.410 --> 09:40.930 All right, I run the Do No Harm panel at DEF CON every year. 09:40.930 --> 09:42.750 Please come check us out. 09:42.750 --> 09:45.150 I run another conference, too, called the CyberMed. 09:45.150 --> 09:48.690 I know, I'm not drinking right now, and I said cyber like 15 times. 09:48.690 --> 09:49.330 I'm sorry. 09:49.330 --> 09:50.210 Forgive me. 09:50.490 --> 09:51.590 Next slide. 09:57.650 --> 09:59.790 All right, so this is what we're going to talk about today. 09:59.790 --> 10:00.530 Wait, what? 10:00.530 --> 10:04.570 I'm here at DEF CON Groups Allspace VR. 10:04.570 --> 10:06.650 Why the hell are we talking about this old-ass picture? 10:06.650 --> 10:09.370 I don't see any badge life in here. 10:09.370 --> 10:13.850 I don't see any alcohol and debauchery of Hacker Jeopardy. 10:14.470 --> 10:19.570 This is the most important thing to me, and this is my favorite painting. 10:19.730 --> 10:23.350 It's called The Doctor, and it was painted in the late 1800s. 10:23.350 --> 10:27.750 And the reason it's my favorite painting is it reminds me why I go to work every day. 10:27.770 --> 10:29.450 Now, quickly, let's just take a look. 10:29.450 --> 10:32.190 The top right, we get a mom and a dad. 10:32.530 --> 10:34.230 At least, that's what I think they are. 10:34.230 --> 10:38.890 And mother has her face down on the table, and dad laid on mine, and she's weeping. 10:39.090 --> 10:40.610 Dad looks concerned. 10:41.270 --> 10:52.210 The left side of the painting, we see the title of this painting, which is The Doctor, looking concerned over a child, the focal point of the entire painting, and that's the patient. 10:52.210 --> 10:54.250 I have been that doctor before. 10:54.250 --> 10:59.690 I know what that doctor is thinking, and I've tried every treatment under the sun. 10:59.690 --> 11:01.210 I've tried every medicine I know. 11:01.210 --> 11:06.050 I've tried every ounce of training I know, and I don't know if this patient is going to make it through. 11:06.050 --> 11:07.010 Next slide. 11:15.380 --> 11:17.220 This is health care today. 11:17.220 --> 11:19.760 So, that was the health care of the late 1800s. 11:19.760 --> 11:22.060 This is the health care of today. 11:22.060 --> 11:23.640 It has something very similar. 11:23.640 --> 11:28.940 It has the patient in the middle, but I want to draw your attention to everything around the patient. 11:28.940 --> 11:30.980 You see all those blinking boxes? 11:31.440 --> 11:33.820 You see all those wires and cables? 11:34.000 --> 11:40.900 Imagine what the wireless is around the station at that exact moment. 11:41.120 --> 11:43.100 This is modern health care. 11:43.200 --> 11:53.540 You cannot engage in health care in most hospitals in the United States without facing this reality that everything's connected. 11:53.660 --> 11:55.700 A lot of it is insecure. 11:55.740 --> 11:58.540 We're doing our best, but we have a long way to go. 11:58.540 --> 11:59.500 Next slide. 12:08.840 --> 12:12.340 So, we screwed this up in medicine a long time. 12:12.340 --> 12:14.000 So, these are two publications. 12:14.000 --> 12:16.000 One was called Two Heirs Human. 12:16.000 --> 12:19.680 This is about the millennial time, and the other one was Crossing the Quality Chasm. 12:19.680 --> 12:23.320 And we talked about basically, let's look at data in medicine. 12:23.320 --> 12:25.480 Does this medicine work compared to this one? 12:25.480 --> 12:27.700 Does this treatment work compared to this one? 12:27.700 --> 12:41.620 We want doctors to use evidence-based medicine, but we also want to recognize that a lot of the time, medicines, health care, doctors, nurses, the infrastructure, all of that actually hurts patients sometimes because we make mistakes. 12:41.620 --> 12:44.040 We give someone medicine that they're allergic to. 12:44.300 --> 12:50.540 Can you guys draw some hearts if the slides are down? 12:53.110 --> 12:54.890 Yeah, it looks like they're down. 12:55.110 --> 12:56.750 ATX, can we reload those? 13:26.360 --> 13:28.480 I'll just kind of keep going a little bit. 13:28.480 --> 13:38.740 So, basically, there have been plenty of examples of where in medicine we've actually hurt patients when we went to help them. 13:38.920 --> 13:45.780 One of the examples is in about the 20s or 30s, you were almost guaranteed to die if you were a premature infant. 13:45.840 --> 13:49.260 The reason was that premature infants have very immature lungs. 13:49.260 --> 13:50.620 They can't breathe. 13:50.620 --> 13:54.360 And it takes a long time while they're in the womb for those lungs to mature. 13:54.940 --> 14:08.000 And for the first time ever, when we had better plastics, and primarily when we had the power to concentrate and store oxygen, we were able for the first time to allow premature babies to live. 14:08.020 --> 14:12.320 So, we had these little incubators, and we were able to keep babies warm. 14:12.320 --> 14:15.260 We were able to give them oxygen because their lungs weren't very good. 14:16.000 --> 14:24.560 Please tell me, I want in the audience, I want you to throw up a applause if you think you should give the patient 100% oxygen. 14:24.560 --> 14:28.880 Let's pump as much oxygen as possible into that little incubator. 14:28.880 --> 14:33.340 Or if you think we should do 50% oxygen, throw up some hearts. 14:33.340 --> 14:34.700 So, hearts for 50%. 14:34.700 --> 14:37.600 Okay, we got 50%. 14:37.600 --> 14:39.520 Does anyone want to do 100% oxygen? 14:39.520 --> 14:41.040 Those lungs are pretty immature. 14:41.260 --> 14:42.580 Throw up some applause. 14:43.160 --> 14:43.840 No? 14:43.840 --> 14:46.680 So, basically, we answer the question, right? 14:46.680 --> 14:47.960 Babies were living for the first time. 14:47.960 --> 14:50.860 I'm going to pick what concentration of oxygen we're going to put in their incubator. 14:50.860 --> 14:51.940 And we went with 100. 14:52.880 --> 14:55.040 And then these babies were living. 14:56.180 --> 14:58.960 A big percentage of them were actually turning out blind. 14:59.440 --> 15:04.940 This is the cited reason why Stevie Wonder is blind, because he had retinopathy of prematurity. 15:05.160 --> 15:08.160 It actually was the oxygen that was causing the blindness. 15:08.160 --> 15:12.160 We didn't know if it was premature babies are more likely to be blind and now they're living. 15:12.280 --> 15:19.520 Or it actually ended up after we studied tens of thousands of patients that the oxygen was what was causing these patients to go blind. 15:19.520 --> 15:23.380 And so we went from going 100% oxygen to 50% oxygen. 15:23.380 --> 15:27.880 This is one example of how treatment we use actually hurts the patient. 15:27.880 --> 15:30.280 Another one is thalidomide. 15:30.280 --> 15:36.140 There was a nausea medication marketed mostly in Germany in the 40s for nausea. 15:36.140 --> 15:37.500 It was a drug called thalidomide. 15:37.500 --> 15:42.060 Well, for a lot of reasons, a lot of them, you know, inexcusable. 15:42.060 --> 15:44.000 It was never tested in pregnant persons. 15:44.000 --> 15:45.220 So what does that mean? 15:45.280 --> 15:49.720 But pregnant persons get nausea and they vomit all the time. 15:49.720 --> 15:52.100 So they wanted to use this drug called thalidomide. 15:52.100 --> 15:56.620 They gave it to pregnant persons and basically caused a lot of death. 15:56.620 --> 16:00.160 As a consequence of poor research practices. 16:00.820 --> 16:01.700 All right, cool. 16:01.800 --> 16:02.120 We're back. 16:02.120 --> 16:05.360 This guy is like ghosting out his iPad. 16:05.360 --> 16:09.760 Please go down like three or four slides. 16:15.500 --> 16:17.300 All right, other way. 16:19.160 --> 16:20.700 Keep going, keep going. 16:24.480 --> 16:25.880 No, you're going the wrong way. 16:26.640 --> 16:30.620 No, you're going the wrong way. 16:30.920 --> 16:32.180 Yeah, yeah, there you go. 16:32.180 --> 16:32.940 The other way. 16:33.000 --> 16:34.540 Keep going, keep going. 16:41.020 --> 16:42.720 Keep going, keep going. 16:58.260 --> 17:00.140 Okay, here's thalidomide. 17:00.140 --> 17:00.660 Great. 17:00.720 --> 17:06.100 So this is, okay, now we have this potential new failure. 17:06.100 --> 17:16.640 Now I'm going to start off rapidly by asking myself, wait a minute, you're telling me that the cybers and these malicious cybercriminals, are they hurting patients? 17:17.800 --> 17:18.760 No. 17:20.120 --> 17:25.000 If we make it to the end of this talk, I'll give you a little, a few slides on why I think that's the case. 17:25.000 --> 17:32.100 But what do we know about how security of medical devices and critical hospital infrastructure can affect patients? 17:32.100 --> 17:39.880 All right, this is a slide about a paper I published over 10 years ago by Kevin Foote's group. 17:39.880 --> 17:49.720 This was before Barnaby Jack, and they basically talked about how easy it was to wirelessly attack and implant. 17:49.760 --> 17:59.380 These are devices that can implant into a person's body and wires come from this implant and go into their heart. 17:59.380 --> 18:04.120 There was some concern that they were able to induce shock. 18:04.120 --> 18:10.380 So you were watching TV, then you watch any of those shows about the emergency department, you know, and they shock someone back to life. 18:10.380 --> 18:12.100 Well, these devices can shock. 18:12.180 --> 18:17.260 And if you get shocked and you don't need to, and it happens to shock you at the wrong time, you can actually. 18:18.200 --> 18:19.200 Next slide. 18:35.600 --> 18:44.200 These are some great research done by Jay Radcliffe, who basically reverse-engineered his own insulin pump. 18:44.220 --> 18:51.480 He's a hacker himself, and was able to show how easy it would be to deliver a potentially deadly dose of insulin. 18:51.480 --> 18:57.200 So if you don't know that, if you get insulin and you're diabetic and it's at the right level, great, you live. 18:57.200 --> 19:00.780 But if you don't need insulin and they give it to you, it can actually kill you. 19:00.800 --> 19:01.860 Next slide. 19:08.280 --> 19:11.000 Some more pacemaker research. 19:11.020 --> 19:15.700 And before Barnaby died, he was going to give a talk about hacking pacemakers. 19:15.700 --> 19:17.240 Rest in peace, Barnaby. 19:17.320 --> 19:18.180 Next slide. 19:23.420 --> 19:28.760 Not just medical devices, this is critical hospital infrastructure. 19:28.760 --> 19:34.120 If you're interested in this, this is a hospital for about three or four days. 19:34.120 --> 19:35.480 A really interesting story. 19:35.480 --> 19:38.680 I recommend you read kind of what happened with that. 19:38.940 --> 19:39.720 Next slide. 19:40.260 --> 19:46.540 Devastating to, you know, hospital operations, essentially put a hospital offline for three days while in hospital. 19:48.260 --> 19:55.680 We had some infusion pump stuff, though, you know, it's not always the obvious stuff like an insulin pump or a pacemaker. 19:55.680 --> 19:59.480 There's a lot of connected medical technology that is vulnerable. 19:59.480 --> 20:01.040 This are infusion pumps. 20:01.040 --> 20:03.660 So you go to the hospital and you get an IV. 20:03.980 --> 20:08.460 This is a, you know, bag of medicine and a tube that goes into an IV into your arm. 20:08.940 --> 20:15.100 Sometimes it's just, you know, saline, essentially water with some salts to help hydrate you. 20:15.100 --> 20:18.180 But sometimes we deliver medications through your IV. 20:18.500 --> 20:21.300 And sometimes we have to give you those medications over hours. 20:21.300 --> 20:23.420 And so we have to control the rate of medication. 20:23.420 --> 20:25.260 If you get a little medication, it doesn't help. 20:25.260 --> 20:28.100 If you get too much medication, it can kill you. 20:28.100 --> 20:31.320 How do we control the rate of medicine going into a patient? 20:31.320 --> 20:33.660 We use these things called infusion pumps. 20:33.660 --> 20:44.840 They're basically mechanical pumps attached to embedded systems that can be able to look at software, drug libraries, and control the way of medications. 20:44.840 --> 20:50.380 Well, you know, I don't know, 10 years, 15 years ago, they were like, you know what the next great generation of these is going to be? 20:50.380 --> 21:05.940 Let's put them on Wi-Fi so we can connect them to the network for, what ended up happening was, and this is the most widely publicized example of this, there are some significantly scary vulnerabilities associated with infusion pumps, where they could give you way too much medicine, 21:05.940 --> 21:07.140 way too little medication. 21:07.740 --> 21:11.780 Primarily vulnerabilities involving really poor or little authentication practices. 21:11.780 --> 21:13.440 Next slide, please. 21:20.980 --> 21:21.740 Okay. 21:21.860 --> 21:26.120 Well, if you're into this, this is such a weird story. 21:26.120 --> 21:32.240 So some security researchers, instead of finding, they found some vulnerabilities in the pacemaker. 21:32.340 --> 21:39.860 Instead of going to the manufacturer and engaging in, you know, disclosure, coordinated disclosure, they went to like a hedge, like a pseudo hedge fund. 21:39.860 --> 21:45.000 And they said, listen, we're going to release all this research about how these pacemakers are FUBAR. 21:45.000 --> 21:47.260 We want to short the stock with you. 21:47.280 --> 21:50.900 And that was how they made a lot of money, at least temporarily. 21:51.060 --> 21:53.920 The stock bounced back and this thing's getting litigated as hell. 21:53.920 --> 21:59.240 But long story short, it's a really interesting kind of change in the research landscape. 21:59.720 --> 22:00.780 Next slide. 22:10.250 --> 22:13.670 I mean, sure, throw some hearts out, throw some applause out, whatever it is. 22:13.670 --> 22:18.110 Let me know if you're out there, if you heard about all the ransomware attacks in hospitals. 22:19.450 --> 22:19.970 Cool. 22:19.970 --> 22:20.170 All right. 22:20.170 --> 22:22.130 Now, do it if you're responsible for one. 22:23.370 --> 22:25.610 Ah, I almost got you there. 22:28.250 --> 22:30.370 Listen, ransomware is in hospitals. 22:30.370 --> 22:39.950 And when COVID started, there was, I remember, I guess in the news headlines, I was like, a bunch of ransomware crews were going to come together and say, we're not going to get hospitals during COVID. 22:40.030 --> 22:41.570 A couple of big ones. 22:41.630 --> 22:45.830 And science, you know, of course, ransomware is a plague. 22:45.830 --> 22:47.030 It's always going around. 22:47.030 --> 22:49.370 There's been a couple hospitals recently. 22:49.610 --> 22:54.050 But largely speaking, it's been sort of research infrastructure. 22:54.050 --> 23:03.890 So there's some news stories recently of state actors going after COVID research or ransom workers going after academic research establishments. 23:04.450 --> 23:11.250 But of course, we can have a conversation about healthcare and hacking without talking about Walmart pride. 23:11.250 --> 23:12.690 It's so crazy. 23:12.690 --> 23:18.010 When this happened, I remember thinking to myself, like, whoa, I don't know if we're ever going to have anything like this again. 23:18.090 --> 23:25.410 It took out over 30% of the United Kingdom's National Health Service's entire infrastructure. 23:25.410 --> 23:26.250 What does that mean? 23:26.250 --> 23:32.490 Imagine if malware hit the US and took out one out of every three hospitals across the country. 23:32.590 --> 23:35.270 Think about how disruptive that would be to clinical care. 23:35.270 --> 23:42.350 Think about the patients that are going to be having strokes and heart attacks and are having life threatening infections. 23:42.350 --> 23:45.470 Imagine how impactful that could have been. 23:46.170 --> 23:50.830 And so that's really changed a lot of things and catalyzed a lot of positive actions. 23:50.830 --> 23:54.230 We're looking at the security of these devices in a better light. 23:54.230 --> 23:58.710 The FDA has done a bunch of great work talking about how we can make these devices more secure. 23:58.770 --> 24:06.330 When they come to market, they're not plagued with a lot of the problems that we've been dealing with for the last 15 years. 24:06.330 --> 24:07.210 Next slide. 24:27.050 --> 24:28.310 All right. 24:28.310 --> 24:29.850 And then check this out. 24:29.890 --> 24:45.010 What's crazy is the FDA actually recalled a medical device, not because the pump was prone to break or because the wiring that goes into it was likely to fray and cause electrocutions, which we do for all sorts of other medical devices on a regular interval. 24:45.010 --> 24:53.850 The first time ever, we actually had a recall because of a nasty vulnerability that could, in this article, as mentioned, lead to death. 24:53.850 --> 24:53.850 So we're going to have to do something about that. 24:53.850 --> 24:56.090 Potential patient safety concerns. 24:56.090 --> 25:00.270 And so for the first time ever, we had the FDA saying, hey, we can't tolerate this. 25:00.270 --> 25:02.030 We're going to actually recall the device. 25:02.030 --> 25:03.690 And then you got there and be like, wait a minute. 25:03.690 --> 25:04.530 Is that the first? 25:04.550 --> 25:06.410 Why isn't this happening all the time? 25:06.410 --> 25:09.370 It's a really big deal to recall a device. 25:10.130 --> 25:13.790 Patients might not trust devices after you recall them. 25:13.790 --> 25:22.270 So if you're a diabetic and you've been told that some hacker can kill you by hacking your insulin pump, you may not add an insulin pump next. 25:22.270 --> 25:25.130 If it's been recalled, you might not trust the technology. 25:25.590 --> 25:37.630 And sometimes these patients will actually suffer from their lack of trust in other devices that might be more secure, just because they don't know the difference between security in one insulin pump versus the other. 25:37.690 --> 25:40.110 So a recall is a really big deal. 25:40.830 --> 25:45.190 It took a lot of guts for the FDA to do this, and I really want to applaud them for that. 25:45.190 --> 25:46.090 Next slide. 25:53.280 --> 25:58.540 So I hope you can see, like, I think of this picture that we're pretty fragile. 25:58.540 --> 26:04.160 There's thousands and thousands of devices on our hospital network. 26:04.160 --> 26:08.440 Hundreds of workstations, depending on how big the organization is. 26:08.440 --> 26:14.080 And in 2017, the National Health and Human Services issued this report. 26:14.100 --> 26:15.500 They had this big task force. 26:15.500 --> 26:29.460 They got a bunch of famous people on this group, including some hackers, and they basically came out to the end of this report basically saying, you know, how scary the vulnerabilities of the healthcare system were. 26:29.460 --> 26:42.760 And one of the things they pointed out was they thought a majority of hospitals, again, sorry, this is like US-focused a little bit, but they thought a majority of hospitals in the United States lacked even a single full-time security professional on staff. 26:42.980 --> 26:45.690 There are some parts or some classrooms. 26:45.690 --> 26:46.830 You think that's crazy? 26:46.830 --> 26:52.690 You think that your hospital system doesn't have a full-time security professional on staff? 26:52.690 --> 26:54.570 Yeah, throw somebody up if you think that's wild. 26:54.830 --> 26:56.650 Yeah, that's insane. 26:56.690 --> 26:58.750 You know, that wouldn't be tolerated at a bank. 26:58.750 --> 27:01.770 It wouldn't be tolerated at a lot of other institutions, likely. 27:02.470 --> 27:05.550 And yet those are patients' lives that are at risk, right? 27:05.550 --> 27:13.050 These are institutions taking care of kids, potentially, and yet they're not going to have the expertise that they need. 27:13.050 --> 27:15.570 It's hard, you know, they can't often pay the salaries. 27:16.830 --> 27:28.870 It's really frustrating for a lot of hackers to work for healthcare because they don't get the freedom to fix a lot of the issues they find, and it's all absolutely valid. 27:29.110 --> 27:36.690 But if you're looking to make a difference, and you're looking to make a career change, and you want to put your skills to good use, I'd really encourage you to check out working for a healthcare organization. 27:36.690 --> 27:49.590 It's a challenging environment, and you have to deal with a lot of these issues, but you're also going to have a little trial by fire, because I think we're also seeing pretty well-documented and publicized campaigns of state hackers going after healthcare. 27:49.790 --> 27:50.810 Next slide. 27:56.530 --> 27:58.670 All right, I'm going to let you guys read this later. 27:58.770 --> 28:03.190 Basically, this says software is what powers modern healthcare. 28:03.190 --> 28:08.870 There's so much of it now, and if we don't pay attention to it, we don't secure it, it's going to be a problem. 28:08.870 --> 28:18.670 If hackers don't step up to help secure patients, the devices that they use, it's not just going to be random death, but medical death that we're dealing with. 28:18.670 --> 28:20.850 It's going to be a much bigger number of consequences. 28:20.850 --> 28:22.030 Next slide. 28:28.560 --> 28:29.840 Next slide. 28:31.540 --> 28:34.880 So I already kind of told you, I can't tell you a story. 28:35.060 --> 28:41.520 I can't show you a news clipping of someone who died because their pacemaker was hacked. 28:41.920 --> 28:47.220 But I'll just tell you, and this slide doesn't translate well, because we cut it into images. 28:47.640 --> 28:49.860 But let's imagine you have a diffusion pump. 28:49.860 --> 28:52.340 It's running embedded Windows. 28:52.400 --> 28:53.420 It gets infected. 28:53.420 --> 28:56.200 It's on the network, on the Wi-Fi, it's exposed. 28:56.300 --> 29:00.660 It gets owned by some crypto mining malware. 29:00.920 --> 29:03.120 And as a consequence of this, the pump... 29:13.820 --> 29:26.060 I told you, I think that this is likely far more relevant than we think, but we lack the sophistication to actually measure it, to go out there and find evidence of it, because we're not even looking. 29:26.200 --> 29:28.400 So this pump's malfunctioning. 29:28.400 --> 29:31.960 Who in a hospital is going to even recognize this malfunction? 29:31.960 --> 29:39.920 Well, the best person is probably going to be the nurse, the person putting medications into the pump, actually interfacing with the pump. 29:40.000 --> 29:43.720 So nurses are overworked, amazing clinicians. 29:43.720 --> 29:46.500 I can't do my job as a doctor without them. 29:46.500 --> 29:50.620 I will say a lot of nurses would not recognize this, because I've asked them. 29:50.620 --> 29:52.040 It's not any fault of their own. 29:52.040 --> 29:52.800 It's that they're busy. 29:52.800 --> 29:54.860 They have four other patients in the ICU. 29:55.100 --> 29:56.280 COVID's happening. 29:56.340 --> 30:02.640 They're not necessarily looking at that device to make sure that the right number of drips are coming out of their IV bag. 30:02.960 --> 30:13.680 They trust the technology, and that's what I've heard over and over again from nurses in the field, is that they are trained to trust these pumps. 30:13.700 --> 30:19.600 In fact, the pumps they're taught are more safe than human beings doing it. 30:19.600 --> 30:31.220 Human beings controlling the rate of medication going into a patient by titrating some little dial is far more prone to mistakes, either underdosing a patient, than infusion pumps. 30:31.220 --> 30:32.400 So they're taught to trust it. 30:32.500 --> 30:38.200 Let's say you just have a crazy day, and the nurse picks up on this malfunctioning device. 30:38.500 --> 30:39.960 What are they going to do? 30:40.280 --> 30:42.680 Well, they're going to call bioengineering. 30:42.860 --> 30:44.340 This is a part of the hospital. 30:44.340 --> 30:48.120 These are people that take care of medical devices, and they're going to come and replace it. 30:48.120 --> 30:48.420 Guess what? 30:48.420 --> 31:00.040 They're going to replace it with the exact same vulnerable model that's likely unpatched, and it's going to be pretty quickly infected with the exact same crypto mining malware. 31:00.280 --> 31:04.880 But that aside, they're going to take that infected device, I imagine, in the basement. 31:04.880 --> 31:06.420 You know, this is kind of a joke I say. 31:06.420 --> 31:09.040 I think all bioengineers live in the basement. 31:09.040 --> 31:12.240 Not trolls, but that's just in my mind where this device is going. 31:12.880 --> 31:15.840 They're going to do some very basic troubleshooting on it. 31:16.500 --> 31:22.180 Throw up a heart or a hand or something, whatever, if you think that they're going to do forensics on this device. 31:23.560 --> 31:26.040 Oh yeah, you get the pessimists just like me. 31:26.060 --> 31:27.400 Yeah, of course they're not going to. 31:27.400 --> 31:29.160 They're not security experts. 31:29.160 --> 31:31.440 They know about clinical devices. 31:31.520 --> 31:32.560 They know about that. 31:32.560 --> 31:33.940 They don't know about security. 31:34.140 --> 31:37.060 If the hospital is lucky to have any security folks, guess what? 31:37.060 --> 31:43.020 They live over in IT, and they're in some closet, usually off campus, where all the cool people hang out like us. 31:43.540 --> 31:48.180 But they aren't going to even know that the device is likely infected. 31:48.180 --> 31:53.300 Well, if they can't fix it, you know, if they flash it and it's still acting up, who are they going to send it to? 31:53.300 --> 31:55.500 It's a device manufacturer. 31:55.660 --> 31:57.100 Ask a bunch of device manufacturers. 31:57.100 --> 32:03.820 When you get a malfunctioning medical device back in from a hospital, do you even consider the possibility that it's infected with malware? 32:04.140 --> 32:05.880 And guess what? 32:05.920 --> 32:10.280 Raise your hand if you think even one of them said they do forensics on malfunctioning medical devices. 32:10.280 --> 32:12.620 No, they don't. 32:12.640 --> 32:14.360 They lack that expertise too. 32:14.360 --> 32:19.480 As a consequence, they're just not going to look for it. 32:19.540 --> 32:28.980 The problem we're not even looking for, and it's perfectly designed for us to not have anyone even ask the question, let alone the skill set, for us to find. 32:31.880 --> 32:37.660 I think the next slide, I think that was a move along signal. 32:37.900 --> 32:40.740 What we don't want to do is have a crisis of confidence. 32:40.740 --> 32:45.760 You know, we don't want patients to not trust medical technology or to trust healthcare. 32:45.760 --> 32:46.860 And that's a big problem. 32:46.860 --> 32:50.000 You can go back to that slide of the angry old guy. 32:50.980 --> 33:04.240 Eric touched upon this, which is it's important for us to be trusting some of these systems because we don't want people having heart attacks and strokes saying, I don't want to go to that hospital. 33:04.300 --> 33:09.680 You know, I heard they had a breach of patient records last week, and I don't want to be hacked. 33:09.760 --> 33:12.720 And well, they're having a heart attack, right? 33:12.720 --> 33:31.780 If we don't do a good job, if hackers don't come and help healthcare do a better job, teach them what they're doing wrong for this infrastructure, we face this very real possibility that either the infrastructure is not just not even going to work at all in the case of anonymously dossing Boston Children's, 33:31.780 --> 33:42.900 or it might work and it might actually be somewhat robust and secure, but patients still don't trust because they're reading these news headlines in the press. 33:43.660 --> 33:45.840 So let me go forward a few slides. 33:48.890 --> 33:52.870 Right at the half hour mark, press something up if you want me to stop. 33:53.510 --> 33:55.390 Keep going, yeah, keep going. 33:58.270 --> 34:00.030 I'm gonna fix this. 34:00.030 --> 34:01.470 Oh god, here we go. 34:02.110 --> 34:09.470 So there are so many policy elements to this that I think are probably gonna bore a lot of hackers out there watching this stream. 34:09.470 --> 34:12.290 Thank you for tolerating this. 34:12.330 --> 34:27.470 We won't get into the policy aspects of it, but listen, if we are going to be buying millions of dollars of new devices for a hospital, better do a good job recognizing what risk we are going to be accepting on our networks, right? 34:27.470 --> 34:31.550 And that involves a lot of work up front. 34:33.290 --> 34:49.950 Vulnerability assessments, you know, there's a thing called the MTSQ form that basically goes through what are all the security controls available on this particular device, how secure out of the box is it, and what do you need to do on the hospital side to make sure when that gets deployed, 34:49.950 --> 35:00.950 are you doing so in a way that's most safe for the patients without causing unnecessary and laborious efforts that won't help the patients. 35:00.950 --> 35:01.810 Next slide. 35:07.500 --> 35:10.860 By the way, most of that stuff in there was connected. 35:11.880 --> 35:18.120 All right, listen, we're here at DEF CON, and I'm so amped to be virtually looking at all of you in this room. 35:18.120 --> 35:29.040 And I will say, although COVID has been a little bit of a relief to be here with my hacker family, presenting something that I'm passionate about. 35:29.080 --> 35:32.780 But listen, we, as mentioned previously, hackers need to step up. 35:32.780 --> 35:45.300 We need people to help us in healthcare, basically do the medical device research to help us with best practices, to help secure our networks. 35:45.300 --> 36:00.360 There's been some actually some great collaborations between hackers and healthcare in these coalitions where various hackers have pledged to essentially help defend hospitals if they should be under attack, which I think was a very noble thing. 36:00.360 --> 36:02.280 You know, hackers really stepped up during COVID. 36:02.280 --> 36:17.060 It's been, you know, volunteering to help defend hospitals against adversaries and cyber criminals, or also printing PPE, being there to help with some of the different disinformation that's really going out over social media. 36:17.200 --> 36:20.820 And as a consequence, I think this is hopefully something that persists. 36:20.820 --> 36:27.660 I hope that COVID, as awful as it is, will help catalyze hackers and healthcare coming together. 36:27.880 --> 36:35.300 If you're looking for more continued engagement with something like this, and as I mentioned, you can choose for employment, but you can also just do some research. 36:35.300 --> 36:37.420 You know, I went to research on medical devices. 36:37.420 --> 36:38.580 I buy them off eBay. 36:38.780 --> 36:40.100 You can do a lot of that. 36:40.100 --> 36:42.980 You can go on offer up and buy some crazy medical devices. 36:43.600 --> 36:56.320 As long as you're, you know, doing responsible research, knowing that it's a very big deal, and there's a lot of consequences that you need to take into consideration, we need a lot of your talent out there to help us be more secure. 36:56.320 --> 36:58.200 So please, please join. 36:58.200 --> 37:02.660 You can also, Biohacking Village is one of the DEF CON villages. 37:02.800 --> 37:04.540 We really encourage you to check it out. 37:05.200 --> 37:10.920 All right, listen, I don't think we should make all doctors aware of cybersecurity, make them experts. 37:10.920 --> 37:12.680 It's just not, it's not for purview. 37:12.680 --> 37:16.480 And honestly, I've been too busy driving Ferraris. 37:16.560 --> 37:18.260 Just kidding, I don't have a Ferrari. 37:18.980 --> 37:21.760 Only cardiologists have Ferraris. 37:22.120 --> 37:38.660 But what we need is, we need more nurses, we need more doctors in this space, because when you change the conversation from, this is just patient data that we want to secure, hey, we just want to get a violation or a purported breach, to the NICU, the head NICU nurse saying, 37:38.660 --> 37:52.500 hey, listen, if this medical device doesn't work, it's not available, or if the integrity of the data coming from this has been compromised, this little 30-week-old baby premature in this incubator is going to suffer. 37:52.780 --> 37:56.440 That's the type of conversation we need to have by partnering with clinicians. 37:56.440 --> 37:59.600 And you know what, it's going to require some patience on our side as hackers. 37:59.600 --> 38:02.860 They don't speak our language, just like you often don't speak theirs. 38:02.860 --> 38:18.040 Coming together in these interdisciplinary teams, working together, going to be able to make people change their minds about what security means in healthcare, not just HIPAA, not just privacy, but also patient safety. 38:18.040 --> 38:19.120 Next slide. 38:29.100 --> 38:31.620 All right, I'm going to finish up after this little bit. 38:31.620 --> 38:34.960 So, and open up for some questions, if anyone has it. 38:34.960 --> 38:38.540 So, you know, how many out there are familiar with last mile problem? 38:38.580 --> 38:39.340 Just throw something out. 38:39.420 --> 38:42.200 Many industries have last mile problems. 38:42.200 --> 38:47.140 Yeah, so I'm not going to I'm pretty sure if I tried to describe it in detail, I'm going to butcher it. 38:47.140 --> 38:49.660 So just forgive me as I do butcher this. 38:49.660 --> 38:58.300 But in many industries, it's not necessarily... there are certain parts of delivering things to consumers, for example, that are hard. 38:58.300 --> 38:59.920 And they might not be what you think. 38:59.920 --> 39:16.820 So, for example, when you're shipping goods that are manufactured in a different country, you know, you can make the particular product, and you can put it in a container ship, and you can actually go across an entire ocean and it goes. 39:16.820 --> 39:19.260 So you can imagine all the logistics involved in that. 39:19.260 --> 39:19.980 But guess what? 39:19.980 --> 39:24.160 All these companies that are doing that actually don't dread all that stuff. 39:24.160 --> 39:29.840 They dread the last mile, which is how do you get it from the distribution center into someone's home? 39:29.840 --> 39:32.660 It's a classic problem with ISPs. 39:32.920 --> 39:41.120 There's so many variations and addresses and buildings that are built differently, et cetera, that the last mile ends up being the hardest part. 39:41.200 --> 39:46.440 Well, healthcare has the last... healthcare security has the last mile problem. 39:46.440 --> 39:47.680 And I'm going to talk to you about it right now. 39:47.680 --> 39:48.480 Next slide. 39:50.540 --> 39:51.820 Oh, can you... 40:05.950 --> 40:12.630 So, let's imagine we have an awesome hacker. 40:12.670 --> 40:14.970 She's donating her expertise. 40:14.970 --> 40:16.950 She buys a device off of eBay. 40:17.270 --> 40:20.390 And she finds a vulnerability in it. 40:20.390 --> 40:26.270 She finds a nasty vulnerability that potentially kills somebody in a medical device that she buys off of eBay. 40:26.670 --> 40:27.970 Who does she go and talk to? 40:27.970 --> 40:27.970 Who does she go and talk to? 40:27.970 --> 40:27.970 Who does she go and talk to? 40:27.970 --> 40:27.970 Who does she go and talk to? 40:27.970 --> 40:32.930 Well, she probably will engage in responsible coordinated disclosure. 40:32.970 --> 40:37.750 I know that there's the language of that or what we used to describe as controversial. 40:37.750 --> 40:43.530 And in any regards, she's elected to do responsible coordinated disclosure. 40:43.530 --> 40:45.610 She goes to the medical device manufacturer. 40:45.930 --> 40:48.170 So, what is the medical device manufacturer going to do? 40:48.170 --> 40:49.030 Next slide. 40:59.610 --> 41:00.890 Here we go. 41:00.890 --> 41:05.610 Medical device manufacturer is obligated to respond to that, right? 41:05.670 --> 41:13.730 They've been plenty of documented examples of medical device manufacturers that screwed this up, you know, threatened to sue researchers or ignored them. 41:13.730 --> 41:15.910 But that hasn't panned out very well for them. 41:15.910 --> 41:18.910 And the FDA has come down pretty hard on those companies. 41:19.050 --> 41:23.690 So, as a consequence, a lot of them are changing and they're actually engaging attackers. 41:24.270 --> 41:26.530 What does the medical device manufacturer have to do? 41:26.530 --> 41:32.430 Well, they're obligated to report that to the regulator, which in this case on medical devices ends up being the FDA. 41:33.110 --> 41:35.730 Well, the FDA is like, damn, this vulnerability is nasty. 41:35.730 --> 41:37.030 We don't want any patients to get hurt. 41:37.030 --> 41:39.330 So, they're going to issue what's called a safety communication. 41:39.550 --> 41:51.210 They have to, and a lot of this is really hard, they can get out there and tell patients and doctors and hospitals that they have to worry about this device. 41:51.210 --> 41:54.470 And let's imagine that goes off without a hitch, which has never happened before. 41:54.470 --> 42:01.650 You know, it's never an easy thing to do, but let's imagine they do a great job and everyone that has that device is made aware of that. 42:01.650 --> 42:02.730 Next slide. 42:11.230 --> 42:17.830 So, the medical manufacturer and the regulator are like, oh man, it's even so concerning that we've got to issue a patch. 42:17.830 --> 42:29.890 Well, patching systems, you know, it's not controversial from a hacker perspective in most cases, but one of these edge cases where it is controversial, one of them is medical devices. 42:30.050 --> 42:42.490 But what if you poorly test your patch and actually cause some type of clinical harm because you're patching something and you didn't do a good job testing patch and actually the medical device malfunctions and hurts someone? 42:42.890 --> 42:48.490 Or there are all sorts of different things, like how are you going to actually patch something that's in a human being? 42:48.530 --> 42:55.250 You know, there are tens of thousands of, you know, tens of thousands of patients all across the globe that have implantable medical devices. 42:55.250 --> 42:59.310 You're going to call them all into the doctor's office and get their systems patched? 42:59.310 --> 43:14.050 Yeah, you get there and say yes, but it's a much harder thing to do than to say, let's imagine they are so on the ball and this medical infrastructure has patched this vulnerability and they've done it in record time and the patch is fantastic. 43:14.490 --> 43:16.710 They have to roll that out. 43:17.150 --> 43:19.010 And this is where the last mile problem is. 43:19.010 --> 43:25.950 How do we get from patching a medical device and get it to the actual patient? 43:26.030 --> 43:30.430 Because in this slide, last part is the clinicians, right? 43:30.430 --> 43:40.030 The doctors and nurses have to call those patients in and they got to put this magnetic interface onto their chest and they have to update the software. 43:40.150 --> 43:40.990 Next slide. 43:42.170 --> 43:43.350 Well, guess what? 43:43.990 --> 43:47.030 I think many of you out there know that's just not going to happen. 43:47.130 --> 43:55.010 It should happen, but it's not going to happen or it's not going to happen in any significant percentages because this last mile problem is really hard. 43:55.010 --> 44:00.250 We have a registry of patients that have these implantables, but guess what? 44:00.250 --> 44:09.010 Half the phone numbers aren't up to date or it was implanted, you know, eight years ago and they moved and we have no idea how to send them a letter or these doctors say, this is stupid. 44:09.010 --> 44:10.230 I'm not going to actually do this. 44:10.230 --> 44:14.150 It's such a pain in the butt patch or I don't think this is really an issue. 44:14.330 --> 44:16.330 And as you can see, we have this last mile problem. 44:16.330 --> 44:20.170 We can do all this great work and everything can go off perfectly. 44:20.250 --> 44:29.570 But if we don't get patients and doctors together and tell them why this is important and have them understand it and advocate for security, it's just not going to happen. 44:30.510 --> 44:31.690 All right, next slide. 44:32.290 --> 44:34.010 So I'm at 42. 44:34.490 --> 44:41.330 You guys are probably thinking to yourself, you know, we can just go to the end of the question slide. 44:41.890 --> 44:45.030 You're probably thinking to yourself, man, why did I get myself into this crazy ass talk? 44:45.030 --> 44:47.130 I was looking in here for overflows. 44:47.730 --> 44:49.490 Why are we talking about this crazy healthcare stuff? 44:49.490 --> 44:51.690 But I want to say I want to thank you for this opportunity. 44:51.690 --> 44:53.390 Thank you, Defcon Groups. 44:53.390 --> 44:58.510 Thank you DCA 58619 for letting me talk about this stuff that's near and dear to my heart. 44:58.510 --> 45:00.090 And this isn't the end of the conversation. 45:00.230 --> 45:02.070 I'm on Twitter, hit me up somewhere. 45:02.070 --> 45:06.470 If you're interested in this space, there's a lot we can do together to help. 45:06.470 --> 45:15.250 And you know, how often do you get a chance to use your skills for more than just privacy and security to really potentially save a life? 45:15.250 --> 45:16.290 That's a big, big deal. 45:16.290 --> 45:17.990 I want to say thank you for what you do. 45:18.110 --> 45:19.170 I miss my family. 45:19.170 --> 45:23.950 And if next year's plague is gone, I want to buy you all a beer in Vegas. 45:24.610 --> 45:25.410 Questions? 45:33.300 --> 45:34.580 I have a question. 45:35.520 --> 45:36.040 Yeah. 45:36.040 --> 45:42.660 What are some of the groups that are valuable for people to reach out to you to help solve this problem? 45:43.560 --> 45:44.360 Yeah, great question. 45:44.360 --> 45:46.880 So for those who didn't hear the question, it was what groups are... 45:48.120 --> 45:51.080 you can go all the way to the end to the question slide. 45:51.260 --> 45:52.460 The very last slide, please. 45:52.460 --> 45:56.920 The question was, what groups should I get involved with if I'm interested in this? 45:56.920 --> 46:01.340 There's the Biohacking Village group, which has an ongoing presence throughout the year. 46:01.340 --> 46:02.960 There's a group called Eye on the Calvary. 46:02.960 --> 46:15.260 I don't know how many of you out there are familiar with this, but they are really a great organization that gets a lot of attention and is able to persuade a lot of regulators like the FDA and other industries. 46:15.260 --> 46:23.760 There's a lot of power and a lot of awesome work being done with Eye on the Calvary, things like Bo Wood and Josh Corman, and there's a lot in that space. 46:23.760 --> 46:27.180 If you want to get involved in that, they have Slack that they'll invite you to. 46:27.220 --> 46:36.380 They don't just do medical, so if you're into hacking cars or airplanes, all sorts of things, but you want to also use your powers for good. 46:38.280 --> 46:39.600 Go to the next slide. 46:40.920 --> 46:42.980 Definitely check out that organization. 46:44.000 --> 46:44.880 All right. 46:44.880 --> 46:45.840 Another question? 46:52.730 --> 46:53.890 All right. 46:54.390 --> 46:54.830 Cool. 46:54.830 --> 46:56.990 Hit me up on Discord if you have any more. 46:56.990 --> 46:58.850 Again, this is a true, true honor. 46:58.990 --> 46:59.850 Take care, everyone. 46:59.850 --> 47:00.490 Thank you.