Hey, everyone. Welcome to my talk, Pandemic in Plain Text.
My name is Troy, aka waveguide on Twitter.
I'm an RF engineer in the aerospace industry. I was formerly a security engineer in the access,
control, and lock industry for a number of years. I also host the channel over at
hackerwarehouse.tv. And I just wanted to give a special thanks to IoT Village
and to DEF CON Safe Mode for hosting this talk, and to my friend Voxel for this really cool setup
and background. So let's get started, Pandemic in Plain Text.
All right. The purpose of this talk, and I want to be really clear, is to stop the use of insecure
communications at hospitals by shining light on the use of insecure wireless communications that
are accidentally leaking your health data and violating your privacy laws. I'm not here to
bash hospitals. I'm not here to bash the medical industry. I just want to bring to light that there
is this leak happening, and it's been happening for 20 years. And right now, in the middle of this
pandemic, I think it's really important that we pay attention to this and that we fix this problem.
And just to note that none of your health care providers are really doing this intentionally.
This appears to be accidentally that they're leaking your information, and they just don't
know it. And if you don't want to watch the rest of this talk, the TLDR is, hey, your COVID test
results are being literally broadcast from mountains. Yeah, so the story behind this is,
if you go back to November or December, a lot of us were looking at Twitter and watching this
pandemic come across China. And we were really asking ourselves these questions, like, is this
real? Is this going to come over here? Then it kind of came across the ocean, and we got to ask these
questions about, you know, do we have enough beds, and PPE, and any cries for help, and are there
shortages? And I just started having all these questions, and I really was looking for data on
this stuff. And like most of the people, it's kind of hard to sift through all the incoming data that
we get through the news. And I just really wanted the hard data. And, you know, I wanted to know,
is it affecting my community? And if I could see the data, then I would be able to answer
these questions. And I remembered that I think I knew an answer to these questions using RF and
wireless. And that was through something called PogSag, which is pagers. I remember a couple of
years ago, we did a talk on HackerWarehouseTV. Not really a talk, but we did a show about how to
decode pager messages that are freely being broadcast in the air. And when we did that,
we saw a lot of things that were medical-related. And I thought, well, maybe it's a good time to
revisit that and see what we can find and see if any of these questions could be answered with data
over the PogSag network. All right. Well, just a little legal disclaimer for this talk.
I'm not a lawyer, but I think the following is true. Possessing a software-defined radio. Yeah,
that's totally legal. Ham radio operators do that across the globe. Receiving 900 MHz signals on
those SDRs. Yeah, of course that's legal. Listening to audio on those signals, just like voice or
tones. Yep, nothing special there. Decoding the audio of those signals. Well, that depends. Are
they encrypted? In this particular case for this talk, no. Not even a little bit. This is all plain
text tones and we're just decoding them. That is legal. Decrypting secure messages or anything
that's encrypted. That is not legal. And in this particular case, nothing was decrypted.
Distributing or sharing patient information. Obviously, that is not legal. Don't distribute
any personal information or any sensitive information that you may receive over these
plain text broadcasts. But for the hospitals that are broadcasting the patient information
from a mountaintop antenna, apparently that's perfectly legal. I don't know. Maybe that's
just a HIPAA violation. Again, I'm not a lawyer. But let's continue. Alright, is this a new
vulnerability? The answer, unfortunately, is no. I'm not, unfortunately, dropping zero days here.
This has been around for quite some time. I think it was DEFCON 5 this was brought up.
Back in 2016, there was also the Holy Pager artwork, I believe it was in Chicago, where it
would intercept all POGSAG pager messages and it would form them randomly to one of three
pagers on display. And then it would print out a continuous roll of receipt paper,
making a big pile of personal information that they automatically redacted. So that was pretty
cool. Then back in 2018, this was brought up again. It was kind of localized to five or six
hospitals. Did some digging into that case and it seemed that the response was that intercepting or
decoding these tones was a sophisticated attack. And I think you'll see at the end of this talk
that that is not the case at all. Alright, where to begin? In order to do this, you have to get
some gear. And back in 1997, I would have agreed that it's a sophisticated attack, but not today.
Back then, you'd have to get a scanner. You'd have to modify it with something from Loft Heavy
Industries, like this POGSAG decoder from back in the day. I think that thing was $60. Then you
would go over to this Doctor Who's radio phone site, which I used to frequent quite often when I
was a teenager. And then you would have to stuff all that back into the scanner. And then you could
decode these tones. And so yes, back in 1997, that was a sophisticated attack. However, in 2020,
you just have to buy a $20 SDR. And you can get those from Hacker Warehouse, you can get them
off Amazon, off eBay. It's really just too easy now. You really just plug in the SDR, download
software, and then you tune to the signal. It's almost as easy as getting in your car and tuning
in a frequency on your radio. You pick one of these frequencies here. These have been around
for 20 years. The pager networks really haven't changed. And you tune into them, and you're going
to hear some tones. Now the frequency used for this talk was 929.596. I localized the signal.
It's coming from Santiago Peak, the antenna farm up there. And it has a lot of coverage. I was
picking up hospitals from about a 70 mile radius. So a lot of stuff from Riverside, Pomona, down
San Diego area, Irvine, not so much from LA County. But everything you see there in the circle
was definitely within range of this tower. And the way the towers work is they relay off of
one another. So a lot of times if you're not close to this tower, you'll be close to another tower.
And you can find a signal that way. These signals are very strong. They're probably when you
plug in the software, and you tune to a station, they are the strongest stations around.
Okay, so as far as the signal goes, it sounds a little something like this.
Now this is provided by M.A.Z.U.R. They said they got it from Matt Damon. That's true.
But it sounds like kind of like an old modem tone, right? So that's what you're listening for.
So when you tune to that 929 frequency, you're going to hear a whole lot of that.
Okay, so the audio tone you just heard basically is a little more advanced than like a DTMF tones
on a keypad. So like whenever you press one on your telephone, you get a combination of this 1209
hertz and this 697 hertz. And that's how the system knows that's a one. Similarly, frequency
shift keying, whenever you lock onto that 929 megahertz signal, those audio shifts you hear
are creating ones and zeros in the bit stream. And that's kind of in a nutshell how FSK works.
Remember, I'm watering this down for kind of all audiences. But the point is, the tones will
create frequency shift keying, which then creates data. And a Windows program like PDW will decode
that data. And it'll just put it across your screen like this. And so this is actually what
you just heard decoded. It's the standard DEF CON, drink all the booze, hack all the things
mantra. So that's how this works. It's really not encrypted. It's all plain text. It's just a
little bit more advanced than DTMF tones on a telephone. And you'll tune into the tones and
get the data on your screen. It's really that simple. So now that you know how it works and
how to decode a dual core song, let's shift back to kind of the hospital research. So I did a little
digging here. There was this research about use of technology for patient care related communications.
The gist of that paper was that 80% of hospitals still use pagers. And in that paper, they actually
believe that pagers are more secure than cell phones. And you can check out this link and read
more about that. But the quote that stood out to me was this one. They send only numeric messages
or basic text messages, says Dr. So-and-so. This way, no confidential information can get in the
wrong hands. That's could happen with the cell phone. And I think that is the heart of this
problem. Pagers are actually thought of as a very good tool and a secure tool to use in hospitals
when, in fact, they're not. So if we kind of know that, then it kind of makes sense why
all of HIPAA compliance is being put into the network and securing the network within the
hospital. And the pager usage is not really thought of as an open door. It's thought of
more secure than that network. And what I found was that the pager usage actually isn't. So
if we go back to that quote of they send only numeric messages, basic text messages,
and no confidential information can get in the wrong hands, it's actually quite different. So
here we go. This is a basic pager message from a hospital. It's leaking your personal information,
and it even includes COVID results. This is one dissected, so I'll walk through this.
You have the pager number, followed by the message time it was sent, the message date,
which is a type of POGSAC-related protocol, alpha, which kind of defines the type of flex.
There's different types. It includes this automated system name, which I'll touch on in a
bit. It has the hospital name. It then goes into requested, which this is a bed request,
last name, first name, age, gender, isolation protocol. That kind of tells the PPE. There's
droplet, which is like a face mask. Sometimes it says full PPE. Sometimes it says face,
different things there. The origin unit. Sometimes it says doctor's name. Sometimes
it says a unit. In this case, it was the emergency department or usually that's emergency something.
Sometimes it's a full doctor's name. And then in the comments right there, it says COVID positive
or COVID negative. So that is a basic pager message that is not supposed to have any of
your personal information in it. Because of COVID, they have gotten quite bloated
with personal information. It didn't used to be this big. And that is the point of this discussion
is this is what a simple text message looks like now. And it has too much personal information in
it. And it has a lot of privacy violations in it as well. So once I saw that, I mean, what did I do?
I decided just to let that decoder run. So I ran it for 52 days, mid-March through August 1st,
2020. Looking at COVID-related results, they would come across the screen.
It resulted in 52 files, only 28 megabytes worth of data.
And remember what I was looking for in the beginning? I was trying to figure out, hey,
is this pandemic real? I didn't know anybody that had it. I didn't know if it was in our hospitals.
So I really just wanted to trust the data and see for myself. I was really concerned about this
whole, do we have enough beds, PPE and shortages? I wondered if there was data that would support
that or give me a number. I wanted to know if it's affecting my community. And I wanted to know,
is anybody out there doing this right and sending these messages securely? And so I got answers to
all of these really. This is what a basic pager text message looks like. And here's some of the
information we got. So hospital bed requests, they include COVID results. You can see over here,
COVID positive, COVID positive. It came from a couple of different systems. This one came from
an XT system. This one over here is this RTM system at now. So you can see here, I've redacted
all the information. So I'm not distributing personal information here. This is a generic
Patricia. She's an 84-year-old female. She has COVID positive. And this one is a 45-year-old
male, Lazaro. He has been diagnosed with COVID-19. Additional comments they even put in here.
This is what COVID is known as, is acute hypoxic respiratory failure. You see this pretty readily
come across the stream. You see EMS fire runs, which give you a little more data on
things that are happening then and now. Outside the hospital, this particular instance,
someone was brought in because they smoked weed and drank some shots, but they asked them about
COVID and they were negative on the COVID questions. So that comes across the stream.
You get a lot of nurse to doctor communications going on over the pages. You got ICU admissions.
You can find out details there. They're broadcasting this person was intubated on three
pressers. They even questions on, they want to discuss options with hydroxychloroquine and
ribavirin. And they have phone numbers there. There's a lot of questions going back and forth.
And you also see these nurse to doctor communications regarding ventilator data.
So basically everything they talk about on the news is being broadcast through these
pager messages in plain text. There's a lot of this coming across the stream. Over 52 days,
there were 17,286 tones decoded that turned into these types of text messages.
Of those, 1,852 were bed requests with that HIPAA information included that should not have been
there. There were 2,077 diagnoses. Of those diagnoses, 1,219 were COVID related. That
includes negatives and positives or even questions, COVID questions. I just put these on here for
comparison. There were only 78 fracture related, surprisingly only 67 cancer related and 300 chest
pain. So you see an uptick in chest pains with COVID. And so that was one of the filters also
in the data. Average age of patients with the virus was about 72 within that tower. But like
I said, there's towers across the United States everywhere that are broadcasting this. So it'll
vary from place to place. Also, I did get an answer to that final question. Is anyone doing
it secure? And I found that a few, I think it was 11% of the messages actually were sent securely.
Obviously, there's a lot of attack vectors with this kind of information.
From embarrassment, identity theft, to billing scams, disrupting supply chains,
misrouting patients. That would be if you were spoofing communications. We are not doing that
here. We're just receiving these things out of the thin air. But there's a lot of like drug
interaction text messages where it says, hey, should they take this? Text me yes or no. And
that seems dangerous, especially over unencrypted communications, which leads just to life safety
in general. And that's why this practice of using pages in hospitals just really needs to stop.
So how does this happen? It appears that no one's doing this intentionally. It's part of a system.
That XT system is, there's a lot of these different patient management systems that
hospitals use. This one looked like it came from TeleTracking XT, which they talk about IVRs,
which are systems that help hospitals manage patients. And even in here, in the TeleTracking
website, they talk about, you know, details are sent to the employee's pager. Keep in mind,
that's not their fault. This is just their software. You can implement these pager
communication systems properly with encryption, like we saw back here. See, this one was secure.
But it's really up to the hospital and their service providers. It may not even be the
hospital's fault. They may contract it out to a telecommunication service provider,
and they're just using the wrong type of pager network rather than the secure one.
So also found, though, that these systems are tracking this exact same data, and they're
providing it back to the hospital kind of on an enterprise level. So that the heart of the data
is the pager data, and then you can create these dashboards. And so they're actually doing what I
was trying to do, but they're doing it within the hospital. And you can see it's very valuable
information for the hospitals, but it just needs to stay within the hospital, right?
So what answers did I get? Yes, this is real. It's happening. I saw EMS run confirmations,
symptoms match. We can see most bed requests seem like bed levels were okay. Didn't see a lot of
messages where people were worried about that, but that was just my area. I'm sure that's a
problem other places. I was able to see in my community that the older population was more
affected. And I also was able to answer the question of, is there a lot of security here?
And it was not. Only 11% of the messages were actually secured and encrypted, and in no way did
I try to decrypt them at all. That would have just been too hard when you have thousands of
thousands of them that are not encrypted. So where do we go from here? Healthcare providers need to
do this stuff. And I've been in the industry, so these are the questions that some of these
roles need to ask. I won't go through all these, but CIO, you need to allocate budget. IT needs to
ask some questions. Auditors, start auditing these pager networks, please. Lawyers, start asking
questions. Reporters, spread this information in this talk, so we can have these conversations
about healthcare system. And patients, you can ask your providers about their pager system security,
if you see your doctor wearing one. Hospitals just need to listen to the security community.
Please don't say this is a sophisticated attack, because it's not at all. It's super easy.
We just need to upgrade the security in these systems. And for the healthcare providers,
they just need to keep up the good fight. Let IT deal with this, and keep doing what you're doing,
because we're all thankful for everything that you do. All right. Thank you. I think my time is
up. Thanks again, everybody, for listening. If you want to hit me up on Twitter, you can reach
me at waveguide. That's at W-A-V-E-G-U-Y-D. Or on the Discord link right here. I'll be doing Q&A
right now. So talk to you soon, and hopefully see you next year. Thanks.