WEBVTT 00:00.000 --> 00:04.600 We're at the DEF CON 30 Biohacking Village CTF, which is going on. 00:04.600 --> 00:10.520 And unlike any other CTF, you're not breaking into networks or web servers or anything like that. 00:10.620 --> 00:12.300 You're doing biohacking. 00:12.300 --> 00:14.840 Can you tell me a little bit more about the CTF? 00:14.840 --> 00:21.140 So the CTF is really built for both sides of our village. 00:21.140 --> 00:24.620 So that would be the healthcare part and the cybersecurity part. 00:24.620 --> 00:26.640 And we really want them to get together. 00:26.640 --> 00:29.780 So we level the knowledge and then we build it. 00:30.340 --> 00:36.940 We're not exactly breaking into things, but we are doing anything from non-technical challenges. 00:36.940 --> 00:47.160 So that could be learning about misinformation and disinformation in healthcare, which then affects your decision making about your health and others. 00:47.160 --> 00:53.080 But we then have mobile challenges because there are COVID apps. 00:53.080 --> 00:57.260 We are talking about reverse engineering of a hospital. 00:57.260 --> 01:00.100 The whole theme is called Hospital Heist. 01:00.100 --> 01:07.200 So a hospital gets attacked and we bring people to look at what's happening in the hospital and trying to find what's happening. 01:07.200 --> 01:11.220 And it goes all the way through reverse engineering. 01:11.220 --> 01:17.380 But also we have our open source pulse oximeter that people engage with. 01:17.380 --> 01:19.800 We have our own little dark web. 01:19.800 --> 01:26.840 So we teach people how it looks like in healthcare and whatever is being stolen and sold on a dark web. 01:26.840 --> 01:30.500 All the way through to hacking through infusion pumps. 01:30.500 --> 01:31.520 Oh, wow. 01:31.520 --> 01:35.460 Now you said something about learning about disinformation in healthcare. 01:35.460 --> 01:39.120 Can you give me an example of something that you would learn about here about that? 01:39.120 --> 01:40.300 Well, pretty much. 01:40.300 --> 01:43.880 I think the biggest example would be COVID. 01:43.880 --> 01:47.000 So there was lots of misinformation and disinformation. 01:47.000 --> 01:58.500 So we are trying to teach people how to have better knowledge and understanding of not only the terms that we are using, but also how does it look like and how to deal with it. 01:58.500 --> 02:11.320 So how if you're someone that you know comes with something that you already know that is a misinformation, disinformation, how to talk to them, how to change their mind, because it's often very, very difficult. 02:11.320 --> 02:12.660 So it's one of those. 02:12.660 --> 02:14.340 But people are also sharing with us. 02:14.660 --> 02:22.360 We're trying to have a two-way conversation about what would they do if something like this happens to them. 02:22.360 --> 02:27.320 I think our CTF is also really focused on the learning. 02:27.320 --> 02:36.080 So we have our Discord where we have a support team that always helps people to put them on the right path and talk to them. 02:36.080 --> 02:44.240 And because we really don't, it's not one of those that where we drop people into it and you do something and we leave you to it. 02:44.240 --> 02:49.380 Here we really talk to people all the way through solving all these challenges. 02:49.380 --> 02:52.280 Man, it's a lot of information. 02:52.280 --> 02:58.160 And what's interesting about this is, it sounds like a core of the CTF is better communication skills. 02:58.240 --> 03:04.980 Being able to talk with people, being able to empathize with them, knowing what their struggle is, and then trying to work through that communication. 03:04.980 --> 03:16.180 And I think oftentimes other CTFs would worry about the technical aspects of hacking and not really what might amount to the more important side of things. 03:16.180 --> 03:20.420 Would you agree that communication is almost more important than the technical things? 03:20.420 --> 03:23.520 I would say it is. 03:23.520 --> 03:34.860 I definitely come from a background in social engineering, so I think the human element in it, especially in healthcare, is very, very important. 03:34.860 --> 03:43.720 But for us, you're right in a way that we are running the CTF also for physicians and nurses. 03:43.720 --> 03:47.940 Here, the communication about the technical aspects is really, really important. 03:47.940 --> 03:50.760 So it's definitely at the core of what we are doing. 03:50.760 --> 04:00.520 But the technical side of it, it's there too, because at the end of the day, we are trying to teach people that a hospital environment is very complex. 04:00.820 --> 04:06.120 And it's anything we're talking about, ICS, industrial control systems, it's HVAC. 04:06.120 --> 04:08.100 Or we are talking about mobile challenges. 04:08.100 --> 04:12.640 We have POS payment systems in there. 04:12.640 --> 04:17.920 So it's very, very... it's almost anything that you can think of, you find it in a hospital. 04:17.920 --> 04:26.260 So that's what we are trying to teach people, to show them walking away afterwards, to have this sort of understanding. 04:26.260 --> 04:31.560 I know disaster recovery is significantly different within a hospital versus a corporation. 04:31.560 --> 04:45.160 In a corporation, you go, okay, these are the... here's the critical aspects, where like these... within a hospital, things like AC all of a sudden becomes lives, where in a corporation, not so much. 04:45.660 --> 04:47.760 Unless it's maybe in the server room. 04:47.760 --> 04:53.580 And anyway, point being, it's very clear, different identifying risks at a hospital. 04:53.580 --> 05:02.860 I imagine a lot of that technology too isn't built with, here is what the ideal hospital is, but hospitals start small and they grow and grow and grow. 05:02.860 --> 05:08.160 And then there's other... there's different practices in hospitals, which complicate the networks even more. 05:08.800 --> 05:22.240 This whole... this is the first time I've been in this village and what's crazy about it is that there's not just one village with... or there's biohacking, but there's biohacking labs, there's biohacking talks and the biohacking capture the flag. 05:22.240 --> 05:26.420 This has been fascinating hearing that this is a communication. 05:26.420 --> 05:27.120 It's a learning one. 05:27.120 --> 05:29.860 I love hearing about these learning challenges. 05:30.020 --> 05:33.240 So Sharka, thank you so much for your time. 05:33.240 --> 05:34.220 Thanks for sharing. 05:34.220 --> 05:35.980 I know you have to get back to Discord. 05:35.980 --> 05:39.480 Thanks for watching and as always, hack on!