1
00:00:01,070 --> 00:00:02,170
Hey, everyone.

2
00:00:02,250 --> 00:00:04,870
Welcome to my talk, Pandemic in Plain Text.

3
00:00:04,870 --> 00:00:08,570
My name is Troy, aka waveguide on Twitter.

4
00:00:08,870 --> 00:00:11,590
I'm an RF engineer in the aerospace industry.

5
00:00:11,590 --> 00:00:17,090
I was formerly a security engineer in the access, control, and lock industry for a number of years.

6
00:00:17,190 --> 00:00:20,510
I also host the channel over at hackerwarehouse.tv.

7
00:00:20,570 --> 00:00:30,050
And I just wanted to give a special thanks to IoT Village and to DEF CON Safe Mode for hosting this talk, and to my friend Voxel for this really cool setup and background.

8
00:00:30,110 --> 00:00:33,050
So let's get started, Pandemic in Plain Text.

9
00:00:33,890 --> 00:00:34,650
All right.

10
00:00:34,650 --> 00:00:48,170
The purpose of this talk, and I want to be really clear, is to stop the use of insecure communications at hospitals by shining light on the use of insecure wireless communications that are accidentally leaking your health data and violating your privacy laws.

11
00:00:48,710 --> 00:00:50,530
I'm not here to bash hospitals.

12
00:00:50,530 --> 00:00:53,070
I'm not here to bash the medical industry.

13
00:00:53,070 --> 00:00:58,870
I just want to bring to light that there is this leak happening, and it's been happening for 20 years.

14
00:00:59,130 --> 00:01:06,390
And right now, in the middle of this pandemic, I think it's really important that we pay attention to this and that we fix this problem.

15
00:01:06,990 --> 00:01:11,490
And just to note that none of your health care providers are really doing this intentionally.

16
00:01:11,910 --> 00:01:16,710
This appears to be accidentally that they're leaking your information, and they just don't know it.

17
00:01:16,710 --> 00:01:23,590
And if you don't want to watch the rest of this talk, the TLDR is, hey, your COVID test results are being literally broadcast from mountains.

18
00:01:24,430 --> 00:01:33,970
Yeah, so the story behind this is, if you go back to November or December, a lot of us were looking at Twitter and watching this pandemic come across China.

19
00:01:34,190 --> 00:01:38,470
And we were really asking ourselves these questions, like, is this real?

20
00:01:38,470 --> 00:01:40,190
Is this going to come over here?

21
00:01:40,270 --> 00:01:50,790
Then it kind of came across the ocean, and we got to ask these questions about, you know, do we have enough beds, and PPE, and any cries for help, and are there shortages?

22
00:01:51,530 --> 00:01:56,710
And I just started having all these questions, and I really was looking for data on this stuff.

23
00:01:56,710 --> 00:02:04,510
And like most of the people, it's kind of hard to sift through all the incoming data that we get through the news.

24
00:02:04,510 --> 00:02:06,730
And I just really wanted the hard data.

25
00:02:06,750 --> 00:02:09,930
And, you know, I wanted to know, is it affecting my community?

26
00:02:10,010 --> 00:02:17,010
And if I could see the data, then I would be able to answer these questions.

27
00:02:17,010 --> 00:02:23,430
And I remembered that I think I knew an answer to these questions using RF and wireless.

28
00:02:23,430 --> 00:02:27,750
And that was through something called PogSag, which is pagers.

29
00:02:27,990 --> 00:02:32,970
I remember a couple of years ago, we did a talk on HackerWarehouseTV.

30
00:02:32,970 --> 00:02:40,030
Not really a talk, but we did a show about how to decode pager messages that are freely being broadcast in the air.

31
00:02:40,030 --> 00:02:45,230
And when we did that, we saw a lot of things that were medical-related.

32
00:02:45,230 --> 00:02:55,950
And I thought, well, maybe it's a good time to revisit that and see what we can find and see if any of these questions could be answered with data over the PogSag network.

33
00:02:58,540 --> 00:02:59,220
All right.

34
00:02:59,220 --> 00:03:01,840
Well, just a little legal disclaimer for this talk.

35
00:03:01,980 --> 00:03:05,420
I'm not a lawyer, but I think the following is true.

36
00:03:05,880 --> 00:03:07,980
Possessing a software-defined radio.

37
00:03:07,980 --> 00:03:09,540
Yeah, that's totally legal.

38
00:03:09,540 --> 00:03:13,000
Ham radio operators do that across the globe.

39
00:03:13,000 --> 00:03:17,300
Receiving 900 MHz signals on those SDRs.

40
00:03:17,300 --> 00:03:19,100
Yeah, of course that's legal.

41
00:03:19,100 --> 00:03:22,680
Listening to audio on those signals, just like voice or tones.

42
00:03:22,680 --> 00:03:24,300
Yep, nothing special there.

43
00:03:24,320 --> 00:03:26,580
Decoding the audio of those signals.

44
00:03:26,600 --> 00:03:28,020
Well, that depends.

45
00:03:28,020 --> 00:03:29,240
Are they encrypted?

46
00:03:29,280 --> 00:03:31,820
In this particular case for this talk, no.

47
00:03:31,820 --> 00:03:32,780
Not even a little bit.

48
00:03:32,780 --> 00:03:36,660
This is all plain text tones and we're just decoding them.

49
00:03:36,740 --> 00:03:38,260
That is legal.

50
00:03:38,260 --> 00:03:41,860
Decrypting secure messages or anything that's encrypted.

51
00:03:41,860 --> 00:03:43,780
That is not legal.

52
00:03:43,780 --> 00:03:46,900
And in this particular case, nothing was decrypted.

53
00:03:47,640 --> 00:03:50,980
Distributing or sharing patient information.

54
00:03:50,980 --> 00:03:53,500
Obviously, that is not legal.

55
00:03:53,500 --> 00:04:01,260
Don't distribute any personal information or any sensitive information that you may receive over these plain text broadcasts.

56
00:04:01,260 --> 00:04:10,740
But for the hospitals that are broadcasting the patient information from a mountaintop antenna, apparently that's perfectly legal.

57
00:04:10,740 --> 00:04:11,480
I don't know.

58
00:04:11,480 --> 00:04:13,020
Maybe that's just a HIPAA violation.

59
00:04:13,020 --> 00:04:14,840
Again, I'm not a lawyer.

60
00:04:14,840 --> 00:04:16,380
But let's continue.

61
00:04:17,380 --> 00:04:19,240
Alright, is this a new vulnerability?

62
00:04:19,240 --> 00:04:21,340
The answer, unfortunately, is no.

63
00:04:21,340 --> 00:04:23,560
I'm not, unfortunately, dropping zero days here.

64
00:04:23,560 --> 00:04:25,900
This has been around for quite some time.

65
00:04:26,040 --> 00:04:28,960
I think it was DEFCON 5 this was brought up.

66
00:04:28,980 --> 00:04:43,060
Back in 2016, there was also the Holy Pager artwork, I believe it was in Chicago, where it would intercept all POGSAG pager messages and it would form them randomly to one of three pagers on display.

67
00:04:43,200 --> 00:04:51,280
And then it would print out a continuous roll of receipt paper, making a big pile of personal information that they automatically redacted.

68
00:04:51,280 --> 00:04:53,040
So that was pretty cool.

69
00:04:53,200 --> 00:04:56,320
Then back in 2018, this was brought up again.

70
00:04:56,320 --> 00:04:58,940
It was kind of localized to five or six hospitals.

71
00:04:59,000 --> 00:05:09,780
Did some digging into that case and it seemed that the response was that intercepting or decoding these tones was a sophisticated attack.

72
00:05:09,780 --> 00:05:14,940
And I think you'll see at the end of this talk that that is not the case at all.

73
00:05:15,640 --> 00:05:17,160
Alright, where to begin?

74
00:05:17,660 --> 00:05:19,920
In order to do this, you have to get some gear.

75
00:05:19,920 --> 00:05:26,080
And back in 1997, I would have agreed that it's a sophisticated attack, but not today.

76
00:05:26,180 --> 00:05:28,540
Back then, you'd have to get a scanner.

77
00:05:28,660 --> 00:05:35,160
You'd have to modify it with something from Loft Heavy Industries, like this POGSAG decoder from back in the day.

78
00:05:35,160 --> 00:05:36,700
I think that thing was $60.

79
00:05:36,740 --> 00:05:44,500
Then you would go over to this Doctor Who's radio phone site, which I used to frequent quite often when I was a teenager.

80
00:05:44,580 --> 00:05:48,940
And then you would have to stuff all that back into the scanner.

81
00:05:48,940 --> 00:05:51,360
And then you could decode these tones.

82
00:05:51,460 --> 00:05:55,760
And so yes, back in 1997, that was a sophisticated attack.

83
00:05:55,760 --> 00:06:01,600
However, in 2020, you just have to buy a $20 SDR.

84
00:06:01,600 --> 00:06:05,440
And you can get those from Hacker Warehouse, you can get them off Amazon, off eBay.

85
00:06:05,440 --> 00:06:07,780
It's really just too easy now.

86
00:06:07,780 --> 00:06:15,060
You really just plug in the SDR, download software, and then you tune to the signal.

87
00:06:15,060 --> 00:06:20,760
It's almost as easy as getting in your car and tuning in a frequency on your radio.

88
00:06:21,320 --> 00:06:24,260
You pick one of these frequencies here.

89
00:06:24,260 --> 00:06:26,700
These have been around for 20 years.

90
00:06:26,700 --> 00:06:28,940
The pager networks really haven't changed.

91
00:06:29,600 --> 00:06:33,360
And you tune into them, and you're going to hear some tones.

92
00:06:33,360 --> 00:06:38,240
Now the frequency used for this talk was 929.596.

93
00:06:38,840 --> 00:06:41,500
I localized the signal.

94
00:06:41,500 --> 00:06:45,220
It's coming from Santiago Peak, the antenna farm up there.

95
00:06:45,220 --> 00:06:46,860
And it has a lot of coverage.

96
00:06:46,860 --> 00:06:52,160
I was picking up hospitals from about a 70 mile radius.

97
00:06:52,160 --> 00:07:00,520
So a lot of stuff from Riverside, Pomona, down San Diego area, Irvine, not so much from LA County.

98
00:07:00,540 --> 00:07:07,200
But everything you see there in the circle was definitely within range of this tower.

99
00:07:07,460 --> 00:07:10,560
And the way the towers work is they relay off of one another.

100
00:07:10,560 --> 00:07:15,120
So a lot of times if you're not close to this tower, you'll be close to another tower.

101
00:07:15,240 --> 00:07:17,380
And you can find a signal that way.

102
00:07:17,380 --> 00:07:19,720
These signals are very strong.

103
00:07:19,720 --> 00:07:26,560
They're probably when you plug in the software, and you tune to a station, they are the strongest stations around.

104
00:07:26,620 --> 00:07:32,460
Okay, so as far as the signal goes, it sounds a little something like this.

105
00:07:36,340 --> 00:07:39,100
Now this is provided by M.A.Z.U.R.

106
00:07:39,540 --> 00:07:41,900
They said they got it from Matt Damon.

107
00:07:41,900 --> 00:07:43,220
That's true.

108
00:07:43,220 --> 00:07:47,720
But it sounds like kind of like an old modem tone, right?

109
00:07:47,780 --> 00:07:50,040
So that's what you're listening for.

110
00:07:50,040 --> 00:07:55,260
So when you tune to that 929 frequency, you're going to hear a whole lot of that.

111
00:07:55,800 --> 00:08:04,460
Okay, so the audio tone you just heard basically is a little more advanced than like a DTMF tones on a keypad.

112
00:08:04,460 --> 00:08:13,800
So like whenever you press one on your telephone, you get a combination of this 1209 hertz and this 697 hertz.

113
00:08:13,820 --> 00:08:16,740
And that's how the system knows that's a one.

114
00:08:17,140 --> 00:08:28,280
Similarly, frequency shift keying, whenever you lock onto that 929 megahertz signal, those audio shifts you hear are creating ones and zeros in the bit stream.

115
00:08:28,480 --> 00:08:31,300
And that's kind of in a nutshell how FSK works.

116
00:08:31,760 --> 00:08:35,060
Remember, I'm watering this down for kind of all audiences.

117
00:08:35,360 --> 00:08:42,500
But the point is, the tones will create frequency shift keying, which then creates data.

118
00:08:42,500 --> 00:08:47,760
And a Windows program like PDW will decode that data.

119
00:08:47,760 --> 00:08:50,960
And it'll just put it across your screen like this.

120
00:08:50,960 --> 00:08:54,580
And so this is actually what you just heard decoded.

121
00:08:54,580 --> 00:09:01,200
It's the standard DEF CON, drink all the booze, hack all the things mantra.

122
00:09:01,360 --> 00:09:04,160
So that's how this works.

123
00:09:04,460 --> 00:09:06,160
It's really not encrypted.

124
00:09:06,160 --> 00:09:07,400
It's all plain text.

125
00:09:07,400 --> 00:09:11,260
It's just a little bit more advanced than DTMF tones on a telephone.

126
00:09:11,400 --> 00:09:15,340
And you'll tune into the tones and get the data on your screen.

127
00:09:15,340 --> 00:09:16,600
It's really that simple.

128
00:09:18,080 --> 00:09:25,420
So now that you know how it works and how to decode a dual core song, let's shift back to kind of the hospital research.

129
00:09:25,420 --> 00:09:27,280
So I did a little digging here.

130
00:09:27,280 --> 00:09:32,600
There was this research about use of technology for patient care related communications.

131
00:09:32,780 --> 00:09:36,960
The gist of that paper was that 80% of hospitals still use pagers.

132
00:09:37,160 --> 00:09:43,120
And in that paper, they actually believe that pagers are more secure than cell phones.

133
00:09:43,320 --> 00:09:46,080
And you can check out this link and read more about that.

134
00:09:46,080 --> 00:09:49,620
But the quote that stood out to me was this one.

135
00:09:49,620 --> 00:09:53,880
They send only numeric messages or basic text messages, says Dr.

136
00:09:53,880 --> 00:09:54,780
So-and-so.

137
00:09:55,020 --> 00:09:58,940
This way, no confidential information can get in the wrong hands.

138
00:09:58,940 --> 00:10:00,660
That's could happen with the cell phone.

139
00:10:00,900 --> 00:10:04,180
And I think that is the heart of this problem.

140
00:10:04,180 --> 00:10:14,640
Pagers are actually thought of as a very good tool and a secure tool to use in hospitals when, in fact, they're not.

141
00:10:14,640 --> 00:10:30,680
So if we kind of know that, then it kind of makes sense why all of HIPAA compliance is being put into the network and securing the network within the hospital.

142
00:10:30,740 --> 00:10:35,320
And the pager usage is not really thought of as an open door.

143
00:10:35,320 --> 00:10:38,060
It's thought of more secure than that network.

144
00:10:38,120 --> 00:10:42,240
And what I found was that the pager usage actually isn't.

145
00:10:42,240 --> 00:10:55,280
So if we go back to that quote of they send only numeric messages, basic text messages, and no confidential information can get in the wrong hands, it's actually quite different.

146
00:10:55,280 --> 00:10:57,740
So here we go.

147
00:10:59,960 --> 00:11:03,980
This is a basic pager message from a hospital.

148
00:11:03,980 --> 00:11:10,000
It's leaking your personal information, and it even includes COVID results.

149
00:11:10,280 --> 00:11:13,040
This is one dissected, so I'll walk through this.

150
00:11:13,040 --> 00:11:27,480
You have the pager number, followed by the message time it was sent, the message date, which is a type of POGSAC-related protocol, alpha, which kind of defines the type of flex.

151
00:11:27,480 --> 00:11:28,860
There's different types.

152
00:11:29,060 --> 00:11:32,980
It includes this automated system name, which I'll touch on in a bit .

153
00:11:33,020 --> 00:11:35,100
It has the hospital name.

154
00:11:35,220 --> 00:11:47,640
It then goes into requested, which this is a bed request, last name, first name, age, gender, isolation protocol.

155
00:11:47,640 --> 00:11:49,300
That kind of tells the PPE.

156
00:11:49,300 --> 00:11:51,620
There's droplet, which is like a face mask.

157
00:11:51,620 --> 00:11:53,260
Sometimes it says full PPE.

158
00:11:53,260 --> 00:11:57,040
Sometimes it says face, different things there.

159
00:11:57,080 --> 00:11:58,660
The origin unit.

160
00:11:58,660 --> 00:12:00,340
Sometimes it says doctor's name.

161
00:12:00,340 --> 00:12:01,480
Sometimes it says a unit.

162
00:12:01,480 --> 00:12:06,500
In this case, it was the emergency department or usually that's emergency something.

163
00:12:06,500 --> 00:12:08,600
Sometimes it's a full doctor's name.

164
00:12:08,600 --> 00:12:16,240
And then in the comments right there, it says COVID positive or COVID negative.

165
00:12:17,040 --> 00:12:23,460
So that is a basic pager message that is not supposed to have any of your personal information in it.

166
00:12:23,620 --> 00:12:29,120
Because of COVID, they have gotten quite bloated with personal information.

167
00:12:29,120 --> 00:12:31,240
It didn't used to be this big.

168
00:12:31,440 --> 00:12:36,920
And that is the point of this discussion is this is what a simple text message looks like now.

169
00:12:37,220 --> 00:12:40,460
And it has too much personal information in it.

170
00:12:40,460 --> 00:12:44,200
And it has a lot of privacy violations in it as well.

171
00:12:44,960 --> 00:12:48,540
So once I saw that, I mean, what did I do?

172
00:12:49,620 --> 00:12:53,000
I decided just to let that decoder run.

173
00:12:53,000 --> 00:12:57,400
So I ran it for 52 days, mid-March through August 1st, 2020.

174
00:12:58,160 --> 00:13:02,320
Looking at COVID-related results, they would come across the screen.

175
00:13:02,320 --> 00:13:08,440
It resulted in 52 files, only 28 megabytes worth of data.

176
00:13:11,060 --> 00:13:13,740
And remember what I was looking for in the beginning?

177
00:13:13,760 --> 00:13:16,980
I was trying to figure out, hey, is this pandemic real?

178
00:13:16,980 --> 00:13:18,460
I didn't know anybody that had it.

179
00:13:18,460 --> 00:13:20,260
I didn't know if it was in our hospitals.

180
00:13:20,260 --> 00:13:24,000
So I really just wanted to trust the data and see for myself.

181
00:13:24,200 --> 00:13:28,840
I was really concerned about this whole, do we have enough beds, PPE and shortages?

182
00:13:28,840 --> 00:13:32,380
I wondered if there was data that would support that or give me a number.

183
00:13:32,580 --> 00:13:34,920
I wanted to know if it's affecting my community.

184
00:13:34,940 --> 00:13:41,940
And I wanted to know, is anybody out there doing this right and sending these messages securely?

185
00:13:42,060 --> 00:13:45,080
And so I got answers to all of these really.

186
00:13:45,220 --> 00:13:48,640
This is what a basic pager text message looks like.

187
00:13:48,640 --> 00:13:50,200
And here's some of the information we got.

188
00:13:50,240 --> 00:13:54,040
So hospital bed requests, they include COVID results.

189
00:13:54,040 --> 00:13:56,820
You can see over here, COVID positive, COVID positive.

190
00:13:56,920 --> 00:13:58,880
It came from a couple of different systems.

191
00:13:58,880 --> 00:14:00,920
This one came from an XT system.

192
00:14:00,920 --> 00:14:04,720
This one over here is this RTM system at now.

193
00:14:05,760 --> 00:14:09,600
So you can see here, I've redacted all the information.

194
00:14:09,600 --> 00:14:13,160
So I'm not distributing personal information here.

195
00:14:13,160 --> 00:14:15,280
This is a generic Patricia.

196
00:14:15,280 --> 00:14:17,060
She's an 84-year-old female.

197
00:14:17,060 --> 00:14:19,080
She has COVID positive.

198
00:14:19,080 --> 00:14:22,800
And this one is a 45-year-old male, Lazaro.

199
00:14:23,080 --> 00:14:26,020
He has been diagnosed with COVID-19.

200
00:14:26,160 --> 00:14:28,680
Additional comments they even put in here.

201
00:14:28,720 --> 00:14:33,660
This is what COVID is known as, is acute hypoxic respiratory failure.

202
00:14:33,660 --> 00:14:36,500
You see this pretty readily come across the stream.

203
00:14:36,560 --> 00:14:44,000
You see EMS fire runs, which give you a little more data on things that are happening then and now.

204
00:14:44,360 --> 00:14:55,900
Outside the hospital, this particular instance, someone was brought in because they smoked weed and drank some shots, but they asked them about COVID and they were negative on the COVID questions.

205
00:14:55,900 --> 00:14:57,480
So that comes across the stream.

206
00:14:57,480 --> 00:15:00,940
You get a lot of nurse to doctor communications going on over the pages.

207
00:15:00,940 --> 00:15:02,900
You got ICU admissions.

208
00:15:03,320 --> 00:15:05,900
You can find out details there.

209
00:15:05,900 --> 00:15:09,840
They're broadcasting this person was intubated on three pressers.

210
00:15:10,000 --> 00:15:16,160
They even questions on, they want to discuss options with hydroxychloroquine and ribavirin.

211
00:15:17,120 --> 00:15:19,140
And they have phone numbers there.

212
00:15:19,780 --> 00:15:22,360
There's a lot of questions going back and forth.

213
00:15:22,760 --> 00:15:27,580
And you also see these nurse to doctor communications regarding ventilator data.

214
00:15:27,620 --> 00:15:34,740
So basically everything they talk about on the news is being broadcast through these pager messages in plain text.

215
00:15:34,780 --> 00:15:36,680
There's a lot of this coming across the stream.

216
00:15:36,740 --> 00:15:43,840
Over 52 days, there were 17,286 tones decoded that turned into these types of text messages.

217
00:15:44,820 --> 00:15:52,680
Of those, 1,852 were bed requests with that HIPAA information included that should not have been there.

218
00:15:52,680 --> 00:15:55,720
There were 2,077 diagnoses.

219
00:15:55,740 --> 00:15:59,480
Of those diagnoses, 1,219 were COVID related.

220
00:15:59,480 --> 00:16:04,680
That includes negatives and positives or even questions, COVID questions.

221
00:16:04,680 --> 00:16:06,900
I just put these on here for comparison.

222
00:16:06,900 --> 00:16:12,920
There were only 78 fracture related, surprisingly only 67 cancer related and 300 chest pain.

223
00:16:12,920 --> 00:16:17,940
So you see an uptick in chest pains with COVID.

224
00:16:18,040 --> 00:16:20,660
And so that was one of the filters also in the data.

225
00:16:21,020 --> 00:16:27,840
Average age of patients with the virus was about 72 within that tower.

226
00:16:27,940 --> 00:16:32,620
But like I said, there's towers across the United States everywhere that are broadcasting this.

227
00:16:32,740 --> 00:16:36,780
So it'll vary from place to place.

228
00:16:36,900 --> 00:16:39,160
Also, I did get an answer to that final question.

229
00:16:39,160 --> 00:16:40,920
Is anyone doing it secure?

230
00:16:40,920 --> 00:16:47,060
And I found that a few, I think it was 11% of the messages actually were sent securely.

231
00:16:47,860 --> 00:16:50,760
Obviously, there's a lot of attack vectors with this kind of information.

232
00:16:51,020 --> 00:16:56,560
From embarrassment, identity theft, to billing scams, disrupting supply chains, misrouting patients.

233
00:16:56,560 --> 00:16:58,860
That would be if you were spoofing communications.

234
00:16:58,860 --> 00:17:00,200
We are not doing that here.

235
00:17:00,200 --> 00:17:03,400
We're just receiving these things out of the thin air.

236
00:17:03,600 --> 00:17:08,600
But there's a lot of like drug interaction text messages where it says, hey, should they take this?

237
00:17:08,600 --> 00:17:09,880
Text me yes or no.

238
00:17:09,960 --> 00:17:15,840
And that seems dangerous, especially over unencrypted communications, which leads just to life safety in general.

239
00:17:15,840 --> 00:17:19,880
And that's why this practice of using pages in hospitals just really needs to stop.

240
00:17:20,220 --> 00:17:21,720
So how does this happen?

241
00:17:21,720 --> 00:17:24,960
It appears that no one's doing this intentionally.

242
00:17:24,960 --> 00:17:26,380
It's part of a system.

243
00:17:26,840 --> 00:17:33,600
That XT system is, there's a lot of these different patient management systems that hospitals use.

244
00:17:33,600 --> 00:17:44,200
This one looked like it came from TeleTracking XT, which they talk about IVRs, which are systems that help hospitals manage patients.

245
00:17:44,200 --> 00:17:50,620
And even in here, in the TeleTracking website, they talk about, you know, details are sent to the employee's pager.

246
00:17:50,840 --> 00:17:52,120
Keep in mind, that's not their fault.

247
00:17:52,120 --> 00:17:53,400
This is just their software.

248
00:17:53,400 --> 00:18:01,640
You can implement these pager communication systems properly with encryption, like we saw back here.

249
00:18:01,800 --> 00:18:03,460
See, this one was secure.

250
00:18:03,680 --> 00:18:07,860
But it's really up to the hospital and their service providers.

251
00:18:07,860 --> 00:18:09,460
It may not even be the hospital's fault.

252
00:18:09,460 --> 00:18:17,680
They may contract it out to a telecommunication service provider, and they're just using the wrong type of pager network rather than the secure one.

253
00:18:17,980 --> 00:18:27,380
So also found, though, that these systems are tracking this exact same data, and they're providing it back to the hospital kind of on an enterprise level.

254
00:18:27,660 --> 00:18:34,420
So that the heart of the data is the pager data, and then you can create these dashboards.

255
00:18:34,420 --> 00:18:39,620
And so they're actually doing what I was trying to do, but they're doing it within the hospital.

256
00:18:39,620 --> 00:18:47,360
And you can see it's very valuable information for the hospitals, but it just needs to stay within the hospital, right?

257
00:18:48,120 --> 00:18:49,840
So what answers did I get?

258
00:18:49,880 --> 00:18:50,820
Yes, this is real.

259
00:18:50,820 --> 00:18:51,820
It's happening.

260
00:18:51,820 --> 00:18:54,940
I saw EMS run confirmations, symptoms match.

261
00:18:55,740 --> 00:18:59,800
We can see most bed requests seem like bed levels were okay.

262
00:18:59,800 --> 00:19:05,480
Didn't see a lot of messages where people were worried about that, but that was just my area.

263
00:19:05,480 --> 00:19:07,560
I'm sure that's a problem other places.

264
00:19:07,600 --> 00:19:12,080
I was able to see in my community that the older population was more affected .

265
00:19:12,080 --> 00:19:15,560
And I also was able to answer the question of, is there a lot of security here?

266
00:19:15,560 --> 00:19:16,440
And it was not.

267
00:19:16,440 --> 00:19:23,400
Only 11% of the messages were actually secured and encrypted, and in no way did I try to decrypt them at all.

268
00:19:23,760 --> 00:19:28,040
That would have just been too hard when you have thousands of thousands of them that are not encrypted.

269
00:19:28,580 --> 00:19:29,640
So where do we go from here?

270
00:19:29,640 --> 00:19:31,680
Healthcare providers need to do this stuff.

271
00:19:31,680 --> 00:19:37,500
And I've been in the industry, so these are the questions that some of these roles need to ask.

272
00:19:37,500 --> 00:19:41,360
I won't go through all these, but CIO, you need to allocate budget.

273
00:19:41,460 --> 00:19:43,380
IT needs to ask some questions.

274
00:19:43,620 --> 00:19:46,220
Auditors, start auditing these pager networks, please.

275
00:19:47,160 --> 00:19:49,240
Lawyers, start asking questions.

276
00:19:49,640 --> 00:19:54,240
Reporters, spread this information in this talk, so we can have these conversations about healthcare system.

277
00:19:54,420 --> 00:20:01,780
And patients, you can ask your providers about their pager system security, if you see your doctor wearing one.

278
00:20:02,620 --> 00:20:05,180
Hospitals just need to listen to the security community.

279
00:20:05,180 --> 00:20:08,560
Please don't say this is a sophisticated attack, because it's not at all.

280
00:20:08,560 --> 00:20:09,920
It's super easy.

281
00:20:10,020 --> 00:20:12,740
We just need to upgrade the security in these systems.

282
00:20:12,900 --> 00:20:17,320
And for the healthcare providers, they just need to keep up the good fight.

283
00:20:17,320 --> 00:20:24,220
Let IT deal with this, and keep doing what you're doing, because we're all thankful for everything that you do.

284
00:20:24,540 --> 00:20:24,980
All right.

285
00:20:24,980 --> 00:20:25,360
Thank you.

286
00:20:25,360 --> 00:20:26,860
I think my time is up.

287
00:20:26,860 --> 00:20:28,280
Thanks again, everybody, for listening.

288
00:20:28,280 --> 00:20:31,020
If you want to hit me up on Twitter, you can reach me at waveguide.

289
00:20:31,020 --> 00:20:33,980
That's at W-A-V-E-G-U-Y-D.

290
00:20:34,340 --> 00:20:36,280
Or on the Discord link right here.

291
00:20:36,280 --> 00:20:38,620
I'll be doing Q&A right now.

292
00:20:38,660 --> 00:20:41,460
So talk to you soon, and hopefully see you next year.

293
00:20:41,460 --> 00:20:42,040
Thanks.