1
00:00:00,000 --> 00:00:05,360
Hey everyone, Shannon Morse here with DEF CON 30 and I am joined by Nina in the Biohacking Village.

2
00:00:05,360 --> 00:00:07,180
Really excited to be up here.

3
00:00:07,180 --> 00:00:13,840
I've heard a lot about this village over the course of the last couple of days and there's a lot going on.

4
00:00:13,840 --> 00:00:18,440
I've seen a line out your door the entire time I've been up here in the Flamingo.

5
00:00:18,620 --> 00:00:24,220
So you have three different rooms going on at the same time for the entire weekend, correct?

6
00:00:24,480 --> 00:00:26,940
What do each of those rooms stand for?

7
00:00:27,640 --> 00:00:30,920
So in Lachlan 1, we're in the Flamingo Hotel.

8
00:00:30,980 --> 00:00:33,640
In Lachlan 1, we have the Speaker Lab, Catalyst Lab.

9
00:00:33,640 --> 00:00:39,360
So mornings, our four speakers come in, talk about the emerging threats and technologies, things that they've been working on.

10
00:00:39,360 --> 00:00:44,540
Then in the afternoon, it's Catalyst Lab for more hands-on learning, building, breaking, and programming.

11
00:00:44,840 --> 00:00:47,480
In Lachlan 2, this is the Medical Device Lab.

12
00:00:47,480 --> 00:00:49,780
The medical device manufacturers bring their hardware.

13
00:00:50,140 --> 00:00:52,840
They open up the software to the community.

14
00:00:53,000 --> 00:00:57,820
Yesterday, I think there were between four and five different CVEs that were found.

15
00:00:58,180 --> 00:01:03,420
In the next room in Lachlan 3, we have the Capture the Flag hospital under siege.

16
00:01:03,520 --> 00:01:11,440
That is for attacks that are currently happening in hospitals and figuring out how to mitigate them, how to go through that.

17
00:01:11,440 --> 00:01:23,860
So I've done a lot of news articles about hospitals under siege, quite technically, about different kinds of attacks that we are seeing against, like, heart monitors and all sorts of different things.

18
00:01:23,860 --> 00:01:27,020
Can you kind of walk me through, like, what the CTF is like?

19
00:01:27,580 --> 00:01:28,140
Yeah.

20
00:01:28,140 --> 00:01:40,920
So the way I explain it to people is that if you've never experienced anything that has to do with medical before, it's that we take you through what is a keyboard, because initially some folks may just not understand absolutely anything.

21
00:01:40,920 --> 00:01:43,880
So what is a keyboard all the way up to into what is a darknet?

22
00:01:43,880 --> 00:01:49,220
Because sometimes the information is stolen, put on the darknet, patient information, and you can become that person.

23
00:01:49,220 --> 00:01:49,800
Absolutely.

24
00:01:49,800 --> 00:02:00,240
So just going through all of that, there's different monitors involved in there, infusion pumps, cardiac, just different ways to think about how medical and technology work.

25
00:02:00,300 --> 00:02:03,040
Do you have different teams that are joining up together?

26
00:02:03,040 --> 00:02:03,560
There's different teams.

27
00:02:03,560 --> 00:02:04,820
You can do it as an individual.

28
00:02:04,820 --> 00:02:05,300
Oh, wow.

29
00:02:05,400 --> 00:02:08,780
And if I'm, like, a brand new newbie, could I go in there and, like, join?

30
00:02:08,780 --> 00:02:09,060
You can totally go in there.

31
00:02:09,060 --> 00:02:10,280
Oh, that's so great.

32
00:02:10,880 --> 00:02:12,980
Do you have prizes that you're giving out for this?

33
00:02:12,980 --> 00:02:21,340
We do have prizes, and because there was just way too much stuff, and recognizing that some people are just bringing book bags to the conference, we're going to ship those out to them in public in cases.

34
00:02:21,460 --> 00:02:24,520
One of my co-workers did that, and I was very surprised.

35
00:02:24,520 --> 00:02:25,460
I was like, I can't do that.

36
00:02:25,460 --> 00:02:27,060
I have, like, three suitcases.

37
00:02:27,420 --> 00:02:28,820
I brought three suitcases, too.

38
00:02:28,940 --> 00:02:30,680
I'm not going to have enough time for this.

39
00:02:30,940 --> 00:02:34,300
Now let's discuss the second room, kind of go into some more detail about it.

40
00:02:34,300 --> 00:02:38,660
I did see a few different hospital devices set up.

41
00:02:38,660 --> 00:02:43,040
Are people able to actually go over there and physically touch them, kind of mess around with them?

42
00:02:43,040 --> 00:02:44,200
It's so much more.

43
00:02:44,200 --> 00:02:46,080
It's not just that they get to touch and feel it.

44
00:02:46,080 --> 00:02:51,620
The manufacturers are with their devices, so they can go in and ask, what are the actual technical parts of this?

45
00:02:51,620 --> 00:02:53,840
What are the diagnostic reasons for these things?

46
00:02:53,860 --> 00:02:55,420
What else does it work within the hospital?

47
00:02:55,420 --> 00:02:56,740
How does it work in the hospital?

48
00:02:56,880 --> 00:02:57,980
Is it patient-facing?

49
00:02:57,980 --> 00:02:59,440
Is it only physician-facing?

50
00:02:59,440 --> 00:03:00,120
What does it look like?

51
00:03:00,120 --> 00:03:00,980
How does it feel?

52
00:03:01,120 --> 00:03:05,020
And you mentioned that some CVEs have already been introduced from this weekend.

53
00:03:05,020 --> 00:03:07,380
Have those already been published online?

54
00:03:07,380 --> 00:03:08,680
Can people look them up?

55
00:03:08,680 --> 00:03:12,040
So they were discussed with the manufacturers.

56
00:03:12,040 --> 00:03:17,600
So they still get, I think it's 30 to 90 days to have those conversations, and then eventually they'll put out their disclosures.

57
00:03:17,600 --> 00:03:20,860
Get those public disclosures out there, make sure that everything is patched.

58
00:03:20,860 --> 00:03:21,320
Perfect.

59
00:03:21,320 --> 00:03:22,340
That's so exciting.

60
00:03:22,340 --> 00:03:27,360
I'm really excited to hear that we are seeing some security coming out of this village.

61
00:03:27,360 --> 00:03:32,860
We're seeing some updates, and that's going to be protecting consumers worldwide, most likely.

62
00:03:33,460 --> 00:03:36,840
And my final slide was CVEs save lives.

63
00:03:36,880 --> 00:03:44,900
Because there's so much fear, especially in this community, because everything has been a lot of click and dagger.

64
00:03:44,900 --> 00:03:46,420
It's the white coat moments.

65
00:03:46,420 --> 00:03:49,440
I can't talk to you, but I should be talking to you.

66
00:03:49,460 --> 00:03:54,360
And now it's bringing in the community face-to-face with the manufacturers so that it eliminates the fear.

67
00:03:54,360 --> 00:03:55,980
I can see you, I can talk to you, I can hear you.

68
00:03:56,220 --> 00:04:08,840
It's really enlightening for me as somebody who comes into DEF CON, does not necessarily work as an information security analyst or expert, but I educate other people about this.

69
00:04:08,840 --> 00:04:19,580
And I love seeing manufacturers come into DEF CON and really talk to hackers, really talk to information security experts, and be able to break down and find all these vulnerabilities.

70
00:04:19,580 --> 00:04:22,020
So props to you for... It's a super hard challenge.

71
00:04:22,020 --> 00:04:23,420
Absolutely, yeah.

72
00:04:23,700 --> 00:04:31,900
Even if it's just, not just, but even if it's normal security stuff, there's so much fear behind it, but there's patience behind this.

73
00:04:31,900 --> 00:04:34,660
Every time there's any device.

74
00:04:34,760 --> 00:04:36,640
So there's so much more that goes into this.

75
00:04:36,640 --> 00:04:41,200
I'm just trying to make sure that everybody understands that there's a human attached to every part of this infrastructure.

76
00:04:41,200 --> 00:04:41,580
100%.

77
00:04:41,580 --> 00:04:43,120
Yeah, I totally agree.

78
00:04:43,160 --> 00:04:46,060
Now that last room, the Catalyst room, I think?

79
00:04:46,060 --> 00:04:46,940
Catalyst and Speaker.

80
00:04:46,980 --> 00:04:48,640
That's so cool.

81
00:04:48,640 --> 00:04:54,740
I love that there's futuristic designs and explanations going into this room.

82
00:04:54,740 --> 00:04:57,100
I'm assuming that you have a lot of speakers coming in.

83
00:04:57,100 --> 00:04:57,720
Yes.

84
00:04:57,720 --> 00:05:03,920
And actually, because I'm very bitty, every talk contradicts the first one.

85
00:05:04,860 --> 00:05:08,700
So there's sort of a battle of thought between what happened and what didn't happen.

86
00:05:08,700 --> 00:05:09,420
Oh, cool.

87
00:05:09,420 --> 00:05:17,680
So by the end of it, so tomorrow, one of our last speakers is how art and technology and science come together.

88
00:05:17,680 --> 00:05:21,000
So he created a brain, a 3D printed brain.

89
00:05:21,000 --> 00:05:22,320
Oh, I saw that.

90
00:05:23,160 --> 00:05:24,020
So cool.

91
00:05:24,020 --> 00:05:29,500
And inside, it lights up based on the sounds and where it shows up.

92
00:05:29,500 --> 00:05:30,220
Oh, my gosh.

93
00:05:30,220 --> 00:05:33,060
So if you clap in the front, it'll show you where the sound is.

94
00:05:33,060 --> 00:05:33,880
It's beautiful.

95
00:05:33,880 --> 00:05:34,460
Yeah.

96
00:05:34,760 --> 00:05:38,100
We'll definitely show y'all out there what it looks like because it's gorgeous.

97
00:05:38,100 --> 00:05:38,980
I love it.

98
00:05:38,980 --> 00:05:40,760
I want to put one of those in my living room.

99
00:05:41,180 --> 00:05:43,000
He might be selling it if you're looking into it.

100
00:05:43,240 --> 00:05:46,920
I think he's actually giving it to the Consulate of Mexico.

101
00:05:47,080 --> 00:05:48,680
Oh, that's so cool.

102
00:05:49,120 --> 00:05:55,160
Well, is there anything that we didn't touch base on with the Biohacking Village that you would like to share with our audience out there?

103
00:05:55,940 --> 00:05:59,240
I start all of my talks with who's in the audience.

104
00:05:59,260 --> 00:06:00,880
So are you an engineer?

105
00:06:00,960 --> 00:06:02,400
Are you a CISO?

106
00:06:02,400 --> 00:06:03,460
Are you doing security?

107
00:06:03,460 --> 00:06:04,160
Blah, blah, blah.

108
00:06:04,160 --> 00:06:05,760
And everybody raises their hand for whatever they are.

109
00:06:05,760 --> 00:06:08,180
And my last question is, are you a patient?

110
00:06:08,180 --> 00:06:10,040
And only one or two people will raise their hand.

111
00:06:10,040 --> 00:06:11,520
And that's not necessarily true.

112
00:06:11,520 --> 00:06:12,600
The answer is that we are all patients.

113
00:06:12,600 --> 00:06:13,280
We're all patients.

114
00:06:13,280 --> 00:06:15,020
We all have some medical records somewhere.

115
00:06:15,020 --> 00:06:15,540
Yeah.

116
00:06:15,540 --> 00:06:18,460
And we are all inherently invested in this.

117
00:06:18,460 --> 00:06:23,820
And the other part is, medical devices are not the only thing in the ecosystem for health care.

118
00:06:23,820 --> 00:06:24,700
There's so much more.

119
00:06:24,700 --> 00:06:28,420
And just coming in here, you will learn about the whole ecosystem.

120
00:06:28,600 --> 00:06:29,880
I love it so much.

121
00:06:29,880 --> 00:06:33,800
Is there anywhere online that people can go to learn more about what your village is doing?

122
00:06:33,800 --> 00:06:37,640
Yeah, so villageb, V-I-L-L-H-E-B.io.

123
00:06:37,660 --> 00:06:38,160
Perfect.

124
00:06:38,160 --> 00:06:39,200
Thank you so much, Nina.

125
00:06:39,200 --> 00:06:41,680
I'm so happy that we were able to talk today.

126
00:06:41,680 --> 00:06:42,880
I actually learned a ton.

127
00:06:43,200 --> 00:06:45,520
And I can't wait to check out more of your village.