start	end	text
1070	4870	Hey, everyone. Welcome to my talk, Pandemic in Plain Text.
4870	8570	My name is Troy, aka waveguide on Twitter.
8870	14410	I'm an RF engineer in the aerospace industry. I was formerly a security engineer in the access,
14410	18630	control, and lock industry for a number of years. I also host the channel over at
18630	22990	hackerwarehouse.tv. And I just wanted to give a special thanks to IoT Village
22990	28690	and to DEF CON Safe Mode for hosting this talk, and to my friend Voxel for this really cool setup
28690	33050	and background. So let's get started, Pandemic in Plain Text.
33890	39210	All right. The purpose of this talk, and I want to be really clear, is to stop the use of insecure
39210	44310	communications at hospitals by shining light on the use of insecure wireless communications that
44310	49710	are accidentally leaking your health data and violating your privacy laws. I'm not here to
49710	55810	bash hospitals. I'm not here to bash the medical industry. I just want to bring to light that there
55810	61050	is this leak happening, and it's been happening for 20 years. And right now, in the middle of this
61050	66390	pandemic, I think it's really important that we pay attention to this and that we fix this problem.
66990	71490	And just to note that none of your health care providers are really doing this intentionally.
71910	76090	This appears to be accidentally that they're leaking your information, and they just don't
76090	80850	know it. And if you don't want to watch the rest of this talk, the TLDR is, hey, your COVID test
80850	86810	results are being literally broadcast from mountains. Yeah, so the story behind this is,
86810	92110	if you go back to November or December, a lot of us were looking at Twitter and watching this
92110	98070	pandemic come across China. And we were really asking ourselves these questions, like, is this
98070	104890	real? Is this going to come over here? Then it kind of came across the ocean, and we got to ask these
104890	110010	questions about, you know, do we have enough beds, and PPE, and any cries for help, and are there
110010	115810	shortages? And I just started having all these questions, and I really was looking for data on
115810	123110	this stuff. And like most of the people, it's kind of hard to sift through all the incoming data that
123110	128410	we get through the news. And I just really wanted the hard data. And, you know, I wanted to know,
128410	135970	is it affecting my community? And if I could see the data, then I would be able to answer
135970	142650	these questions. And I remembered that I think I knew an answer to these questions using RF and
142650	148910	wireless. And that was through something called PogSag, which is pagers. I remember a couple of
148910	155110	years ago, we did a talk on HackerWarehouseTV. Not really a talk, but we did a show about how to
156050	161230	decode pager messages that are freely being broadcast in the air. And when we did that,
161230	166750	we saw a lot of things that were medical-related. And I thought, well, maybe it's a good time to
166750	173170	revisit that and see what we can find and see if any of these questions could be answered with data
173830	181840	over the PogSag network. All right. Well, just a little legal disclaimer for this talk.
181980	188300	I'm not a lawyer, but I think the following is true. Possessing a software-defined radio. Yeah,
188300	195260	that's totally legal. Ham radio operators do that across the globe. Receiving 900 MHz signals on
195260	201760	those SDRs. Yeah, of course that's legal. Listening to audio on those signals, just like voice or
201760	208220	tones. Yep, nothing special there. Decoding the audio of those signals. Well, that depends. Are
208220	213500	they encrypted? In this particular case for this talk, no. Not even a little bit. This is all plain
213500	220440	text tones and we're just decoding them. That is legal. Decrypting secure messages or anything
220440	226900	that's encrypted. That is not legal. And in this particular case, nothing was decrypted.
227640	234140	Distributing or sharing patient information. Obviously, that is not legal. Don't distribute
234140	239000	any personal information or any sensitive information that you may receive over these
239000	246580	plain text broadcasts. But for the hospitals that are broadcasting the patient information
246580	251840	from a mountaintop antenna, apparently that's perfectly legal. I don't know. Maybe that's
251840	258320	just a HIPAA violation. Again, I'm not a lawyer. But let's continue. Alright, is this a new
258320	263560	vulnerability? The answer, unfortunately, is no. I'm not, unfortunately, dropping zero days here.
263560	268960	This has been around for quite some time. I think it was DEFCON 5 this was brought up.
268980	275260	Back in 2016, there was also the Holy Pager artwork, I believe it was in Chicago, where it
275260	281700	would intercept all POGSAG pager messages and it would form them randomly to one of three
281700	286720	pagers on display. And then it would print out a continuous roll of receipt paper,
286720	292340	making a big pile of personal information that they automatically redacted. So that was pretty
292340	297940	cool. Then back in 2018, this was brought up again. It was kind of localized to five or six
297940	306340	hospitals. Did some digging into that case and it seemed that the response was that intercepting or
306340	312280	decoding these tones was a sophisticated attack. And I think you'll see at the end of this talk
312280	319260	that that is not the case at all. Alright, where to begin? In order to do this, you have to get
319260	326080	some gear. And back in 1997, I would have agreed that it's a sophisticated attack, but not today.
326180	331500	Back then, you'd have to get a scanner. You'd have to modify it with something from Loft Heavy
331500	337260	Industries, like this POGSAG decoder from back in the day. I think that thing was $60. Then you
337260	341860	would go over to this Doctor Who's radio phone site, which I used to frequent quite often when I
341860	349920	was a teenager. And then you would have to stuff all that back into the scanner. And then you could
349920	358380	decode these tones. And so yes, back in 1997, that was a sophisticated attack. However, in 2020,
358780	363900	you just have to buy a $20 SDR. And you can get those from Hacker Warehouse, you can get them
363900	371520	off Amazon, off eBay. It's really just too easy now. You really just plug in the SDR, download
371520	377980	software, and then you tune to the signal. It's almost as easy as getting in your car and tuning
377980	385160	in a frequency on your radio. You pick one of these frequencies here. These have been around
385160	391680	for 20 years. The pager networks really haven't changed. And you tune into them, and you're going
391680	401500	to hear some tones. Now the frequency used for this talk was 929.596. I localized the signal.
401500	407140	It's coming from Santiago Peak, the antenna farm up there. And it has a lot of coverage. I was
407140	415900	picking up hospitals from about a 70 mile radius. So a lot of stuff from Riverside, Pomona, down
415900	423640	San Diego area, Irvine, not so much from LA County. But everything you see there in the circle
423640	429660	was definitely within range of this tower. And the way the towers work is they relay off of
429660	435120	one another. So a lot of times if you're not close to this tower, you'll be close to another tower.
435240	440720	And you can find a signal that way. These signals are very strong. They're probably when you
440720	446560	plug in the software, and you tune to a station, they are the strongest stations around.
446620	452460	Okay, so as far as the signal goes, it sounds a little something like this.
456340	463220	Now this is provided by M.A.Z.U.R. They said they got it from Matt Damon. That's true.
463220	470040	But it sounds like kind of like an old modem tone, right? So that's what you're listening for.
470040	475260	So when you tune to that 929 frequency, you're going to hear a whole lot of that.
475800	483100	Okay, so the audio tone you just heard basically is a little more advanced than like a DTMF tones
483100	490600	on a keypad. So like whenever you press one on your telephone, you get a combination of this 1209
490600	499200	hertz and this 697 hertz. And that's how the system knows that's a one. Similarly, frequency
499200	505200	shift keying, whenever you lock onto that 929 megahertz signal, those audio shifts you hear
505200	511300	are creating ones and zeros in the bit stream. And that's kind of in a nutshell how FSK works.
511760	518600	Remember, I'm watering this down for kind of all audiences. But the point is, the tones will
518600	526640	create frequency shift keying, which then creates data. And a Windows program like PDW will decode
526640	533120	that data. And it'll just put it across your screen like this. And so this is actually what
533120	539900	you just heard decoded. It's the standard DEF CON, drink all the booze, hack all the things
539900	548480	mantra. So that's how this works. It's really not encrypted. It's all plain text. It's just a
548480	553960	little bit more advanced than DTMF tones on a telephone. And you'll tune into the tones and
553960	560100	get the data on your screen. It's really that simple. So now that you know how it works and
560100	566440	how to decode a dual core song, let's shift back to kind of the hospital research. So I did a little
566440	572600	digging here. There was this research about use of technology for patient care related communications.
572780	579780	The gist of that paper was that 80% of hospitals still use pagers. And in that paper, they actually
579780	585240	believe that pagers are more secure than cell phones. And you can check out this link and read
585240	591240	more about that. But the quote that stood out to me was this one. They send only numeric messages
591240	597960	or basic text messages, says Dr. So-and-so. This way, no confidential information can get in the
597960	602920	wrong hands. That's could happen with the cell phone. And I think that is the heart of this
602920	610920	problem. Pagers are actually thought of as a very good tool and a secure tool to use in hospitals
611760	621440	when, in fact, they're not. So if we kind of know that, then it kind of makes sense why
622220	629700	all of HIPAA compliance is being put into the network and securing the network within the
629700	635760	hospital. And the pager usage is not really thought of as an open door. It's thought of
635760	642380	more secure than that network. And what I found was that the pager usage actually isn't. So
642380	648100	if we go back to that quote of they send only numeric messages, basic text messages,
648100	655480	and no confidential information can get in the wrong hands, it's actually quite different. So
656300	665920	here we go. This is a basic pager message from a hospital. It's leaking your personal information,
665920	673040	and it even includes COVID results. This is one dissected, so I'll walk through this.
673040	678980	You have the pager number, followed by the message time it was sent, the message date,
679490	687480	which is a type of POGSAC-related protocol, alpha, which kind of defines the type of flex.
687480	692540	There's different types. It includes this automated system name, which I'll touch on in a
692540	700620	bit. It has the hospital name. It then goes into requested, which this is a bed request,
701180	709500	last name, first name, age, gender, isolation protocol. That kind of tells the PPE. There's
709500	714860	droplet, which is like a face mask. Sometimes it says full PPE. Sometimes it says face,
715500	720500	different things there. The origin unit. Sometimes it says doctor's name. Sometimes
720500	726500	it says a unit. In this case, it was the emergency department or usually that's emergency something.
726500	733280	Sometimes it's a full doctor's name. And then in the comments right there, it says COVID positive
733280	741620	or COVID negative. So that is a basic pager message that is not supposed to have any of
741620	747060	your personal information in it. Because of COVID, they have gotten quite bloated
747060	753720	with personal information. It didn't used to be this big. And that is the point of this discussion
753720	760040	is this is what a simple text message looks like now. And it has too much personal information in
760040	768540	it. And it has a lot of privacy violations in it as well. So once I saw that, I mean, what did I do?
769620	776740	I decided just to let that decoder run. So I ran it for 52 days, mid-March through August 1st,
776740	782320	2020. Looking at COVID-related results, they would come across the screen.
782320	788440	It resulted in 52 files, only 28 megabytes worth of data.
791060	795340	And remember what I was looking for in the beginning? I was trying to figure out, hey,
795340	800260	is this pandemic real? I didn't know anybody that had it. I didn't know if it was in our hospitals.
800260	806240	So I really just wanted to trust the data and see for myself. I was really concerned about this
806240	810820	whole, do we have enough beds, PPE and shortages? I wondered if there was data that would support
810820	815920	that or give me a number. I wanted to know if it's affecting my community. And I wanted to know,
816520	823960	is anybody out there doing this right and sending these messages securely? And so I got answers to
823960	829280	all of these really. This is what a basic pager text message looks like. And here's some of the
829280	834660	information we got. So hospital bed requests, they include COVID results. You can see over here,
834660	839520	COVID positive, COVID positive. It came from a couple of different systems. This one came from
839520	847980	an XT system. This one over here is this RTM system at now. So you can see here, I've redacted
848740	854400	all the information. So I'm not distributing personal information here. This is a generic
854400	861360	Patricia. She's an 84-year-old female. She has COVID positive. And this one is a 45-year-old
861360	868680	male, Lazaro. He has been diagnosed with COVID-19. Additional comments they even put in here.
868720	874680	This is what COVID is known as, is acute hypoxic respiratory failure. You see this pretty readily
874680	880480	come across the stream. You see EMS fire runs, which give you a little more data on
881460	887740	things that are happening then and now. Outside the hospital, this particular instance,
887740	893580	someone was brought in because they smoked weed and drank some shots, but they asked them about
893580	897480	COVID and they were negative on the COVID questions. So that comes across the stream.
897480	902900	You get a lot of nurse to doctor communications going on over the pages. You got ICU admissions.
903320	908740	You can find out details there. They're broadcasting this person was intubated on three
908740	914820	pressers. They even questions on, they want to discuss options with hydroxychloroquine and
914820	922360	ribavirin. And they have phone numbers there. There's a lot of questions going back and forth.
922760	927580	And you also see these nurse to doctor communications regarding ventilator data.
927620	932780	So basically everything they talk about on the news is being broadcast through these
932780	938220	pager messages in plain text. There's a lot of this coming across the stream. Over 52 days,
938220	943840	there were 17,286 tones decoded that turned into these types of text messages.
944820	951980	Of those, 1,852 were bed requests with that HIPAA information included that should not have been
951980	959940	there. There were 2,077 diagnoses. Of those diagnoses, 1,219 were COVID related. That
959940	966260	includes negatives and positives or even questions, COVID questions. I just put these on here for
966260	972420	comparison. There were only 78 fracture related, surprisingly only 67 cancer related and 300 chest
972420	979560	pain. So you see an uptick in chest pains with COVID. And so that was one of the filters also
979560	988300	in the data. Average age of patients with the virus was about 72 within that tower. But like
988300	994260	I said, there's towers across the United States everywhere that are broadcasting this. So it'll
994260	999960	vary from place to place. Also, I did get an answer to that final question. Is anyone doing
999960	1007060	it secure? And I found that a few, I think it was 11% of the messages actually were sent securely.
1007860	1010760	Obviously, there's a lot of attack vectors with this kind of information.
1011020	1015720	From embarrassment, identity theft, to billing scams, disrupting supply chains,
1015720	1019980	misrouting patients. That would be if you were spoofing communications. We are not doing that
1019980	1025060	here. We're just receiving these things out of the thin air. But there's a lot of like drug
1025060	1030080	interaction text messages where it says, hey, should they take this? Text me yes or no. And
1030080	1035260	that seems dangerous, especially over unencrypted communications, which leads just to life safety
1035260	1039880	in general. And that's why this practice of using pages in hospitals just really needs to stop.
1040220	1046380	So how does this happen? It appears that no one's doing this intentionally. It's part of a system.
1046840	1052900	That XT system is, there's a lot of these different patient management systems that
1052900	1059380	hospitals use. This one looked like it came from TeleTracking XT, which they talk about IVRs,
1059380	1067000	which are systems that help hospitals manage patients. And even in here, in the TeleTracking
1067000	1071380	website, they talk about, you know, details are sent to the employee's pager. Keep in mind,
1071380	1074900	that's not their fault. This is just their software. You can implement these pager
1076560	1083460	communication systems properly with encryption, like we saw back here. See, this one was secure.
1083680	1088580	But it's really up to the hospital and their service providers. It may not even be the
1088580	1093600	hospital's fault. They may contract it out to a telecommunication service provider,
1093600	1097680	and they're just using the wrong type of pager network rather than the secure one.
1097980	1103480	So also found, though, that these systems are tracking this exact same data, and they're
1103480	1110680	providing it back to the hospital kind of on an enterprise level. So that the heart of the data
1110680	1116920	is the pager data, and then you can create these dashboards. And so they're actually doing what I
1116920	1121240	was trying to do, but they're doing it within the hospital. And you can see it's very valuable
1121240	1127360	information for the hospitals, but it just needs to stay within the hospital, right?
1128120	1133440	So what answers did I get? Yes, this is real. It's happening. I saw EMS run confirmations,
1133440	1140300	symptoms match. We can see most bed requests seem like bed levels were okay. Didn't see a lot of
1140300	1146560	messages where people were worried about that, but that was just my area. I'm sure that's a
1146560	1151680	problem other places. I was able to see in my community that the older population was more
1151680	1155760	affected. And I also was able to answer the question of, is there a lot of security here?
1155760	1161320	And it was not. Only 11% of the messages were actually secured and encrypted, and in no way did
1161320	1166080	I try to decrypt them at all. That would have just been too hard when you have thousands of
1166080	1170840	thousands of them that are not encrypted. So where do we go from here? Healthcare providers need to
1170840	1176260	do this stuff. And I've been in the industry, so these are the questions that some of these
1176260	1182160	roles need to ask. I won't go through all these, but CIO, you need to allocate budget. IT needs to
1182160	1188440	ask some questions. Auditors, start auditing these pager networks, please. Lawyers, start asking
1188440	1192980	questions. Reporters, spread this information in this talk, so we can have these conversations
1192980	1198700	about healthcare system. And patients, you can ask your providers about their pager system security,
1198700	1205180	if you see your doctor wearing one. Hospitals just need to listen to the security community.
1205180	1209920	Please don't say this is a sophisticated attack, because it's not at all. It's super easy.
1210020	1215040	We just need to upgrade the security in these systems. And for the healthcare providers,
1215040	1220980	they just need to keep up the good fight. Let IT deal with this, and keep doing what you're doing,
1220980	1226200	because we're all thankful for everything that you do. All right. Thank you. I think my time is
1226200	1230040	up. Thanks again, everybody, for listening. If you want to hit me up on Twitter, you can reach
1230040	1237500	me at waveguide. That's at W-A-V-E-G-U-Y-D. Or on the Discord link right here. I'll be doing Q&A
1237500	1242040	right now. So talk to you soon, and hopefully see you next year. Thanks.