♪ preroll music ♪
Angel: The next talk will start now
and will be 'Unpatchable -
living with a vulnerable implanted device'
by Dr. Marie Moe and Eireann Leverett.
Give them a warm round of applause please.
*applause*
*heart monitor beep sounds start*
So, we are here today
to talk to you about a subject
that is really close to my heart.
I have a medical implant.
A pacemaker, that is generating
every single beat of my heart.
But how can I trust my own heart,
when it's being controlled by a machine,
running a proprietary code,
and there is no transparency?
So I'm a patient,
but I'm also a security researcher.
I'm a hacker, because I like
to figure out how things work.
That's why I started a project
on breaking my own heart,
together with Eireann
and a couple of friends.
Because I really want to know
what protocols are running
in this machine inside my body.
Is the crypto correctly implemented?
Does it even have crypto?
So I'm here to inspire you today.
I want more people to hack to save lives.
Because we are all becoming
more and more dependent on machines.
Maybe some of you in the audience
also have medical implants,
maybe you know someone
that's also depending on medical implants
Imagine that this is your heartbeat
and it's being controlled by a device.
A device, that might fail.
Due to software bugs,
due to hardware failures.
*additional background sound: real heartbeat*
Wouldn't you also like to know
if it has security vulnerabilities?
If it can be trusted?
*sounds stop* *beeeeep*
E: Something to think about, right?
M: Yeah.
E: Marie is an incredibly brave women.
When she asked me to give this talk
it made me nervous, right?
It's such a personal story.
Such a journey as well.
And she's gonna talk to you
about a lot of things, right?
Not just hacking medical devices
from a safety point of view
but also some of the privacy concerns,
some of the transparency concerns,
some of the consent concerns.
So, there's a lot to get trough
in the next hour.
But I think you're gonna enjoy it
quite a lot.
M: So, let me tell you
the story about my heart.
So, 4 years ago
I got my medical implant.
It was a kind of emergency situation
because my heart was starting to beat
really slow,
so i needed to have the pacemaker.
I had no choice.
After I got the implant,
since I was a security researcher,
of course I started to
look up information about how it worked.
And I googled for information.
I found a technical manual
of my pacemaker
and I started to read it.
And i was quite surprised
when I learned that
my pacemaker has 2 wireless interfaces.
There is one interface, that is really
close field communication,
near field communication
that is being used when I'm at checkups
at the hospital,
where the technician,
the pacemaker technician or doctor
uses a programming device
and places it
really close to my pacemaker.
And it's possible to use that
communication to adjust the settings.
But it also has another
wireless interface,
that I was not aware of,
that I was not informed of as a patient.
It has a possibility for remote monitoring
or telemetry,
where you can have an access point in your house
that will communicate
with the pacemaker
at a couple of meters distance.
And it can collect logs from the pacemaker
and send them to a server
at the vendor.
And there is a web interface
where the doctor can log in
and retrieve my information.
And I have no access the data
that is being collected
by my device.
E: So imagine for a moment
that you are buying a new phone
or buying a new laptop.
You would do your homework, right?
You would understand what interfaces where there.
But in Marie's case she's just
given a device, and then later she gets
to go and read the manual, right?
So she's the epitome of a informed consumer
in this space
and we want a lot more informed consumers
in this space,
which is why we are giving this talk.
Now, I don't know about you,
but I'm used to hacking
industrial systems.
I haven't done as much medical research
in the past.
So, when I first started this project
I knew literally nothing
about Marie's heart.
Or even my own.
And she had to teach me how the heart works
and how her pacemaker works.
So, would you mind explaining
some details to the audience that will be relevant
through the rest of the presentation?
M: Actually I think we're going to show you
a video of how the heart works.
So, it's a little bit of biology introduction here
before we start with the technical details.
So, this.. play the video.
Video: A normal heart beat rate
and rhythm is called 'Normal Sinus Rhythm'.
The heart's pumping action
is driven by electrical stimulation
within the heart muscle.
the heart's electrical system
allows it to beat in an
organized, synchronized pattern.
Every normal heart beat
has 4 steps.
Step 1:
As blood flows into the heart
an electrical impulse
from an upper area of the right atrium
also known as the sinus node
causes the atria to contract.
When the atria contract
they squeeze the blood
into the ventricles.
Step 3:
There is a very short pause
only about a fraction of a second.
and Step 4:
The ventricles contract
pumping the blood to the body.
A heart normally beats
between 60-100 times/min.
Electrical signals in your heart
can become blocked or irregular,
causing a disruption
in your hearts normal rhythm.
When the heart's rhythm is too fast,
too slow or out of order,
an arrhythmia,
also called a rhythm disorder occurs.
When your heart beats out of rhythm,
it may not deliver enough blood
to your body.
Rhythm disorders can be caused
by a number of factors
including disease, heredity,
medications or other factors.
E: So for those of you who are already aware of that,
apologies.
But I needed to learn that.
I needed to learn the basics
before we even got started, right?
So...
M: So this is a diagram of the
electrical system of the heart.
So, as you see, this is the sinus node
that is generating the pulse.
And in my case
I had a problem with the signal
being generated by the sinus node
not reaching the lower heart chamber.
It's something called an AV block or a heart block
So, occasionally this will cause
an arrhythmia that makes the heart pause.
If you don't have a heart beat
for, like ... 8-10 seconds,
you lose your consciousness.
And that was, what happened to me.
I just suddenly found myself
lying on the floor
and I didn't remember how I got there.
And it turned out that it was my heart
that had taken a break.
So that's how I discovered
that I had this issue.
So, this is where the signal is blocked
on the way down to the lower heart chamber
But there's a backup function
in the heart that can make
a so called backup pulse.
And I had that backup pulse
when I went to the emergency room.
So I had a pulse around 30-40 beats/min.
And that's generated by some cells
in the lower heart chamber.
So, after I got the pacemaker
my heart started to become
a little bit more lazy.
So it is not certain,
that I will have this backup pulse
anymore if the pacemaker stops working.
So currently
my heart is 100% running on the pacemaker.
So, let's also look at how the pacemaker works.
I have another video of that.
So, this is my little friend
that is running my heart.
Video: A pacemaker is a miniaturized computer
that is used to treat a slow heart beat.
It is about the size
of a couple of stacked silver dollars
and weights approximately 17-25 grams.
It is usually surgically placed
or implanted just under the skin
in the chest area.
The device sends a tiny electrical pulse
down a thin coated wire,
called a lead, into your heart.
This stimulates the heart to beat.
This impulses are very tiny
and most people do not feel them.
While the device helps your heart
maintain its rhythm,
it also stores information
about your heart that can be
retrieved by your doctor
to program the device.
E: Remember that!
M: Yeah... Did you see
the ones and zeros at the end
of the video?
That's what we want to know more about.
Because this information
that is being collected by the pacemaker,
how it works,
how the code looks like,
it's all closed source,
it's all proprietary information.
And that's why we need more
security researchers,
we need more 3rd party testing,
to be sure that we can trust this code.
E: And you can imagine that
we're doing some of this research as well.
But I'm not gonna break Marie's heart on stage,
I'm not gonna drop 0-day
on some medical devices,
so if you came for that,
it's not worth staying.
The rest of the presentation
will be about some of the things we found
and how this works and
how you might approach this research.
And some of the people who did this research before,
because there's plenty of others,
and we like to give a shout-out
to those who've done great research in advance.
But essentially this point is
very relevant.
That the internet of medical things
is already here.
And Marie is wired into it.
She's a bit younger than the average
pacemaker patient, but, you know,
she was thrust into this situation
where she had to think about things
in a very different way.
Like, you did a Masters, breaking crypto,
and also a PHD in Information Security.
Did you imagine, that things you learned
about SSH and network security
might one day apply to your heart and your own body?
M: No, I never figured out that
my research would eventually end up inside my own body.
That's something I never thought about.
And also, there's a lot of
people that don't think about
how the medical devices actually work.
So, when I asked this question
to health care professionals
they look at me like I'm crazy,
they don't ... they have never thought about this before.
That there's actually code inside my body
and someone has programmed it,
someone has written this code.
And, did they think about, that this
would actually control someone's life,
and be my own personal critical infrastructure?
E: Yeah, personal infrastructure, right?
On a physical level.
And also, I think, it's...
You know, the point that you made is important to reiterate,
that you go and see your doctor
and you ask these questions about
whether anyone can hack into my heart
and they probably look at you and go like
'Don't you worry your pretty little head about that', right?
But Marie used to head up
the Norwegian computer emergency response team
for a couple of years
and knows a lot of hackers
and knows what she's talking about, right?
So, when she asked her doctor these questions,
they're very legitimate questions.
And the doctors probably don't know anything about code,
but they need to move towards a place
where they can answer those questions with some
honesty and certainty and treat them with the dignity
that they deserve.
Should we show them a little bit more
about the total ecosystem of devices
that we are talking about, at least in this particular talk?
M: Yeah.
E: So, this was all new to me.
I mean I've moved around in networks and done some
penetration testing and some stuff in the past,
but I didn't know much about implantable medical devices.
So, we've got a couple of them there.
The ICD, which is the in-cardio-defibrillator,
that's some of the work that you saw from Barnaby Jack
which we will mention later,
was on those particular devices,
We've got the pacemakers and of course other devices
could be in this diagram as well.
Like, we could be talking about insulin pumps
or other things in the future.
The device itself speaks to box number 2,
which we will tell you a little bit more about in a moment,
using a protocol, commonly referred to as 'MICS'.
A number of different devices use this
Medical Implant Communication Service.
And Marie shocked me yesterday
when she found a couple devices
that potentially use Bluetooth. *sighing* *laughter*
So, would you like to tell them a little bit more about the access point,
and I'll join in?
M: Yeah, so, the access point is the device
that you can typically have on your bed stand
and that will, depending on your configuration,
contact your pacemaker as regular intervals,
e.g. once during the night.
It will start a communication with the pacemaker,
couple of meters distance,
and will start collecting logs.
And this logs will then be sent,
it can be via SMS or other means,
to a server.
So, there's a lot of my personal information
that can end up different places in this diagram.
So, of course it's in my own device,
it will be then communicated via this access point
and also then
via the cellular network.
And then it will also be stored in the telemetry server.
Potentially when I go for the checkups
my personal information will also end up in my
doctor workstation
or in the electronic patient records.
And there's a lot of things that can go wrong there.
E: Yeah, you can see, it's using
famously secure methods of communication
that have never been backdoored or compromised by anyone ever before,
even here at this conference, probably even this time around.
So these are some things that are concerning.
The data also travels often to other countries
and so there are questions about the jurisdiction
in terms of privacy laws in terms of some of this data.
And some of you can go and look deeper into that as well.
The telemetry store thing I think is important,
some of this is a telemetry store, such as the server at the vendor.
So the vendor owns some machines somewhere
that collect data from Marie's heart.
So you can imagine she goes to see her doctor and the doctor is like:
'Hey, Marie, last weekend, did you, ... run a half marathon or something?'
And she hasn't told him, right?
Like, he just can look at the data and see,
that her heart rate was up for a couple hours.
That's true though, right? You did actually run a half marathon.
M: Yeah, I did run a half marathon. *laughing*
E: So, the telemetry store is one part,
but there's also the doctors work station
which contains a lot of this medical data.
So, from privacy perspective that's part of the attack surface.
But there's also the programmers, right?
There's the device's programmers.
So that's an interesting point, that I hope a lot of you are interested in
already, that there is a programmer
for these devices.
M: So, we actually went shopping on eBay
and we found some of these devices.
E: You can buy them on eBay?
M: Yeah. E: *laughing*
M: So, I found a programmer
that can program my device, on eBay
and I bought it.
And I also found a couple of these access points.
So, that's what we're now starting to look at.
E: We just wanna to give you an overview of this system,
and it's fairly similar across the different device vendors,
and we're not going to talk about individual vendors.
But if you're gonna go and do this kind of research
you can see that some of the research you've already done in the past
applies to different parts of this process.
M: And talking about patient privacy,
when we got the programmer from ebay
it actually contained patient information.
So, that's the really bad thing.
E: So, I found this very odd.
I had a similar reaction to yourselves because
I usually do industrial system stuff.
One of my friends picked up some PLCs recently and
they had data from the nuclear plant, that the PLCs had been used in.
So, decommissioning is a problem in industrial systems
but it turns out also in medical devices, right?
I guess that's a useful point to make as well,
about the costs of doing this kind of research.
It is possible to get some devices, some implants
from people who have sadly passed on,
but that comes with a very high cost of biomedical decontamination.
So that raises the cost of doing this research
on the implants themselves, not necessarily on the rest
of the devices.
M: Yeah, so, also want to say, that in this research
I had not have not tinkered with my own device.
So, that would not be a good thing ...
E: You're not gonna let me, like, SSH into your heart and just ...
M: Um.. No. E: ... just delete some stuff.. No?
M: No. E: I wouldn't do it anyway,
but it's an interesting point, right?
So, like, there are a lot of safety percussions
that we and the rest of the team have to take
when we are doing this research.
And one of them is not pairing Marie's pacemaker
with any of the devices that are under test.
Do you wanna say a bit more about connectivity and vulnerability?
M: Yeah, so...
I was worried when I discovered that
I had this possible connectivity to the medical internet of things.
In my case this is switched off in the configurations
but it's there.
It's possible to turn it on, it's possible for me to be
hooked up to the, this internet of medical things.
And for some patients this is really benefit.
So you always have to make a risk-based decision
on whether or not to make use of this
connectivity.
But I think it's really important that you make an informed decision
about that and that the patient
is informed and has given his or her consent
to have this feature.
The battery lifetime of my pacemaker is around 10 years.
So in 6 years time
I will have to have a replacement surgery
and I'm going to be a really difficult patient *laughing*
*laughter*
So, ... *applause*
E: Right on.
M: I really want to know
how the devices work by then and
I want to make an informed decision on whether or not
to have this connectivity.
But of course for lot of patients the benefit of having this
outweighs the risk.
Because people that had other heart problems than me
they have to go for more frequent checkups.
I only have to go once a year.
So, for patients that need to go frequently for checkups,
it's really good for them to have the possibility
of having telemetry and having connectivity to
have remote patient monitoring.
E: Yeah, imagine you have mobility problems or
you even just live far
from a major city.
And making the journey to the hospital is quite arduous,
then this kind of remote telemetry allows your doctor
to keep track of what's going on.
And that's very important, we don't wanna, like...
have a big scary testosterone filled talk where we, like,
hack some pacemakers.
We wanna talk about how there's a dual use thing
going on here.
And that there is a lot of value in having this devices
but we also want them to be safe and secure and preserve our privacy
and a lot of other things.
So, these are some of the issues.
Of course the last one, the remote assassination scenario,
that' s everyone favorite one to fantasize about
or talk about, or make movies about, but
we think there's a lot of other issues in here
that are more interesting,
some quality issues even, right,
that we'll talk about in a little bit.
Battery exhaustion,
again something many people don't think about. But...
I'm very interested in cyber-physical exploitation
and so some of this elements were interesting to me
that you might use the device in a way that wasn't expected.
M: So personally I'm not afraid of being remotely assassinated.
E: I've actually never known you to be afraid of anything
M: *laughing*
I'm more worried about software bugs in my device,
the things that can malfunction,
E: Is that just theoretical?
M: No, actually software bugs
have killed people.
So, think about that!
People that are not here,
they don't have their voice and they can't really
give there story.
But there are stories about persons depending on medical devices
dying because their device malfunctioned.
E: There's even some great research
from academics about how the user interface design
of medical devices can have an impact on patients safety
and how designing UX
much more clearly and concisely
specifically for the medical profession
might improve the care of patients.
Do you wanna say more about this slide or should we
go on to the previous work, should we... go ahead!
M: Yeah, I think it's really important also to...
the issue of trusting the vendors.
So, as a patient I'm expected to just, you know,
trust, that my device is working correctly,
every security vulnerability has been corrected by the vendor
and it's safe.
But I want to have more third party testing,
I want to have more security research on medical implants.
And as a lot things, like ... history has shown
we can't always trust that the vendors do the right thing.
E: I think this is a good opportunity for us to ask
a very fun question, which is:
Any fans of DMCA in the room?
*laughter*
No? No fans? Alright.
Well, you then you'll really enjoy this.
Marie has some very exciting news about DMCA exemptions.
M: Yeah, so... October, this year
there was a ruling of an DMCA exemption for
security research on medical devices
also for automotive security research.
So, this means, that
as researchers you can
actually do reverse engineering of medical implants
without infringing copyright laws.
It will take effect I think October next year.
E: Yeah. M: That is really a big
step forward in my opinion.
And I hope that this will encourage more research.
And I also want to mention that there are
fellow activist patients like myself
that was behind that proposal of having this exemptions.
So, Jay Radcliff who hacked his own insulin pump,
Karen Sandler, who is a free and open software advocat.
And Hugo Campos, who has an ICD implant, he is very ...
he wants to have access to his own data
for quantified self reasons.
So this patients, they actually
made this happen, that you're allowed to do
security research on medical devices.
I think that's really great.
*applause*
E: Do you wanna say something about Scott Erven's presentation
that you saw at DEF CON?
M: Yeah, that was a really interesting presentation about
how medical devices have really poor security.
And they have, like, hard coded credentials,
and you can find them using Shodan on the internet.
This were not pacemakers, but other types of
different medical devices.
There are, like, hospital networks that are completely open
and you can access the medical equipment
using default passwords that you can find in the manuals.
And the vendors claim that
no, these are not hard coded, these are default,
but then the manuals say: Do not change this password...
E: Because they want to integrate with other stuff, right? So...
I've heard that excuse from SCADA, so I wasn't having it.
M: They also put up some medical device honeypots
to see if there were targeted hacking attempts
but they only picked up regular malware on them, which is also ...
E: Only! M: ... of course of a concern *laughing*
E: Anything else, about prior art, Kevin?
M: I guess we should mention that the academic research
on hacking pacemakers, which was started by
a group led by Kevin Fu
and they had this first paper in 2008
that they also followed up with more academic research
and they showed that it's possible to hack a pacemaker.
They showed that... this was possible on a, like
a couple of centimeters distance only,
so, like, the attack scenario would be, if you have a
device similar to the programmers device
and you attack me with it you can *laughing*
turn off my pacemaker.
That's not really scary,
but then we have the research by Barnaby Jack
where this range of the attack is extended to several meters
so you have someone with an antenna in a room
scanning for pacemakers
and starting to program them.
E: We have a saying at Cambridge about that.
Some of the other people at the university have been doing attacks
a lot longer than I have, and one of the things they say is:
'Attacks only get worse, they never get better.'
So, the range might be short one year, then a couple of years later it's worse.
M: The worst case scenario I think would be remotely,
via the internet being able to hack pacemakers.
but there's no research so far indicating that that's possible.
E: And we don't wanna hype that up. We don't wanna...
M: No. E: ... get that kind of an angle
on this talk. We wanna make the point that hacking can save lives,
that hackers are global citizen's resource to save lives, right? So...
M: Yeah, so, this is the result of hacking of the drug infusion pumps.
Earlier this year
the FDA actually issued the first ever recall of a medical device
based on cyber security concerns.
E: I think that's amazing, right? They've recalled products
because of cyber security concerns. They used to have to wait until someone died.
In fact, they had to show something like 500 deaths
before you could recall a product. So now they can ...
the FDA, at least in the US, they can recall products
just based on security considerations.
M: So, this is also,
I guess the first example of that type of pro-active
security research, where you can
make a proof of concept without killing any patients
and then that closes the security holes.
And that potentially saves lives.
And no one has been hurt in the research.
I think that's great.
E: I'm also really excited because we give a lot of presentations
about security that are filled with doom and gloom and depression,
so it's nice to have two major victories in medical device research
in the last few years. One being the DMCA exemptions
and the other being actual product recalls.
M: Yeah, and the FDA are starting to take these issues seriously and
they are really focusing on the cyber security of medical implants now.
I'm going to go to a workshop arranged by the FDA in January
and participate on a panel discussing cyber security of medical implants.
And it's great to have this type of interaction between
the security committee, medical device vendors and the regulators.
So, things are happening.
E: Yeah. How do you feel as an audience,
are you glad that she's going to be your representative in Washington
for some of these issues?
*applause*
And we want you to get involved as well, right?
This is not just about Marie and myself and the other people
who worked on this project, it's meant say
you too can do this research. And you should be.
You have to be a little sensitive, a little bit precise and articulate
about concerns.
We take some inspiration from the former research around hygiene.
Imagine the first time some scientist went to some other scientist and said
'There is this invisible stuff, and it's on your hands,
and if you don't wash your hands people get infections!'
And everyone thought they were crazy.
Well, it's kind of the same with us talking about industrial systems
or talking about medical devices or talking about hacking in general.
People just didn't, sort of, believe it was possible at first.
And so we have to articulate ourselves very, very carefully.
So, we draw inspiration from that early hygiene movement
where they had a couple simple rules that started to save people's lives
while they explained germ theory to the masses.
M: Yeah, so, this type of research is kind of low hanging fruits
where you just, so...
what we show here is an example,
where there's a lot of medical device networks in hospitals
that are open to the internet and that can get infected
by normal type of malware, like banking trojans or whatever.
And this is potentially a safety issue.
So, if your MR scanner or some other
more life-critical device is being unavailable because of
a virus on it,
that's a real concern for patient security and safety.
So we need to think more about the hygiene also in terms of
computer viruses, not only just normal viruses.
E: Yeah. So, you know, some times people will treat you like
this is an entirely theoretical concern, but
I think this is one of the best illustrations that we've found
of how that should be a concern,
and I think all of you will get it,
but I wanna give you a moment to kind of read what's about to come up on the slides.
So I'll just let you enjoy that for a moment.
So if it's not clear or it's not your first language or something,
this guy basically sharded patient data across a bunch of amazon clusters.
And then it was unavailable. And they were very concerned
about the unavailability of their costumer patient data
sharded across amazon instances.
He was complaining to support, like 'Can I get support to fix this?' *laughing*
M: So, all the data of the ...
... the monitoring data of the cardiac patients is unavailable to them
because of the service being downed.
And, well, do you want to outsource your patient's safety to the cloud? Really?
I don't want that. Okay.
E: I wanna get into some other details. We have sort of 10 min left if we can ...
so we can have a lot of questions, and I'm sure there will be some.
But I want you to talk to them about this very personal story.
This is... Remember before, when we said, is this stuff theoretical?
I want you to pay a lot of attention to this story.
It really moved me when she first told me.
M: I know how it feels to have my body controlled by a device
that is not working correctly.
So, I think it was around 2 or 3 weeks after I had the surgery.
I felt fine.
But I hadn't really done any exercise yet.
The surgery was pretty easy, I only had 2 weeks sick leave
and then I came back to work
and I went to London
to participate in a course in ethical hacking and
I did take the London Underground together with some of my colleges
and we went of at this station at Covent Garden
And I don't know if you have been there but
that particular station is really low underground.
They have elevators that you can use to get up,
but usually there are, like, long queues to the elevators...
E: You always have to do things the hard way, right?
M: You had to take the stairs, or
they were just heading for the stairs and I was following them and
we were starting to climb the stairs and I didn't read this warning sign, which is:
'Those with luggage, pushchairs & heart conditions, please use the lift' *laughing*
Because I was feeling fine,
and this was the first time that I figured out there's something wrong
with my pacemaker or with my heart.
Because I came like half way up this stairs
and I felt like I was going to die.
It was a really horrible feeling.
I didn't have any more breath left,
I felt like I wasn't able to complete the stairs.
I didn't know what was happening to me, but
somehow I managed to drag myself up the stairs
and my heart was really...
it didn't feel right.
So, first thing when I came back from this course
I went to my doctor
and we started to try debug me, tried to find out
what was wrong with my pacemaker.
And this is how that looks like. E: *laughing*
M: So, there's a stack of different programmers
- this is not me by the way, but it's a very similar situation.
E: And we'll come back to those programmers in a moment.
M: Yeah. E: But the bit I want you
to focus on is, like, they're debugging your pacemaker?
Inside you? M: Yeah, I didn't know
what was happening at the time.
We were just trying to get the settings right
and it took like 2 or 3 months before we figured out what was wrong.
And what happened was, that my operate limit was set to low for me,
for my age. So, the normal pacemaker patient is maybe around 80 years old
and the default operate limit was 160 beats/min.
And that's pretty low for a young person.
E: So, imagine, like, you're younger and you're really fit and you know
how to do something really well, like swimming or skiing or skateboarding
or whatever. You're fantastic at it. And then a couple years go past
and you know, you gain some weight and you're not as good at it, right?
But now imagine that happens in 3 seconds.
While you're walking up a set of stairs.
M: So, what happens is that the pacemaker detects
'Oh, you have a really high pulse'. And there's a safety mechanism
that will cut your pulse in half ... E: In half!
*laughter* M: *laughing* So in my case it went
from 160 beats/min to 80 beats/min. In a second, or less than a second,
and that felt really, really horrible.
And it took a long time to figure out what was wrong.
It wasn't until they put me on an exercise bike and
had me on monitoring that they figured out what was wrong, because
the thing was, that what was displayed on the pacemaker technician's view
was not the same settings that my pacemaker actually had.
There was a software bug in the programmer, that caused this problem.
E: So they thought they had updated her settings to be that of a young person.
They were like 'Oh, we've already changed it'.
But they lost the view. They couldn't see the actual state of the pacemaker.
And the only way to figure that out was to put her on a bike
and let her cycle until her heart rate was high enough.
You know, literally physically debugging her to figure out
what was wrong.
Now stop and think about whether or not you would trust your doctor
to debug software.
*laughter*
So, say a little bit more about those programmers and then we'll move on
towards the future.
M: Yeah, so, we got hold of one of these programmers, as mentioned
and looked inside it.
And, well, we named this talk 'Unpatchable', because
originally my hypothesis was that, if you find a bug in a pacemaker
it will be hard to patch it.
Maybe it would require surgery.
But then when we looked inside the programmer
and we saw that it contained firmware for pacemakers we realized that
it's possible to actually patch the pacemaker via this programmer.
E: One of the other researchers finds these firmware blobs inside
the programmer code and, like, my heart stopped at that point, right?
I was just going 'Really, you can just update the code on someones pacemaker?'
We also wanna say something about standardization.
Look at all those different programmers.
Someone goes into a hospital with one of these devices
they have may different programmers so they have to make an estimation
of which... you know, which programmer for which device.
Like, which one are you running.
And, so, some standardization would be an option *laughing*
perhaps, in this case. M: Yeah.
E: Alright. So, we gonna need to move quickly through
the next few slides to talk to you about the future,
but I hope that drives home that this is a very real issue for real people.
M: So, pacemakers are evolving and they are getting smaller
and this is the type of pacemaker that you can actually implant
inside the heart.
So, the pacemaker I have today is outside the heart and it has
leads that are wired to my heart.
But in future they are getting smaller and more sophisticated and
I think this is exciting!
I think that a lot of you, also in the audience will
benefit from having this type of technology when you grow older
and we can have longer lives and we can live more healthier lives
because of the technology E: And keep in mind, right?
Some of you may already have devices and already have this issues,
but others of you will think 'Ah, that won't happen to me for quite a long time'
But it can be a sudden thing, that, you know, you don't necessarily
have a choice to run code inside your body.
Which OS do you wanna implant? *laughing*
You wanna tell them about the..
M: This is also a quite exciting
maybe future type of implants that you can have.
So, this is actually a cardiac sock, it's 3D-printed and it's making
a rabbit's heart beat outside the body of the rabbit.
So, there's a lot of technology and sensors and things that
are going to be implanted in our bodies
and I think more of you will become cyborgs like me in the future
E: And there's a lot of work that you could be doing.
You know, 3D-printing this devices,
and open sourcing as much of this as possible.
There's a lot to say here, right?
I think it's time to address the really scary issue.
The informed consent issue around patching, right?
Remember earlier we were talking about the programmers
and we pointed out that there were firmware blobs in there
and that these people, you know, your doctor or nurse
could upgrade the code running on your medical implant.
Now, is there a legal requirement for them to inform you,
before they alter the code that's running inside your body?
As far as we can tell
- and we need to look at a lot of different countries at the same time,
so we gonna ask you to help us -
as far as we can tell there are not laws requiring your doctor
to tell you that they are upgrading the firmware in your device.
M: Yeah, think about that * laughs*
It's a quite scary thing.
I want to know what's happening to my implant, the code,
if someone wants to alter the code inside my body, I would like to know
and I would like to make an informed decision on that
and give my consent before it happens.
E: You might even choose a device where that's possible or not possible
because you're making a risk-based decision and you're an informed consumer
but how do we help people, who don't wanna understand
software and firmware and upgrades make those decisions in the future as well.
Alright.
M: So now, if we're going to go through
all this, but there's a lot of reasons why we're in the situations of having
insecure medical devices.
There's a lot of legacy technology because there's a long lifetime of this devices
and it takes a long time to get them on the market.
And they can be patched, but in some cases
they are not patched or there are no software updates applied to them.
We don't have any third party security testing of the devices,
and that's really needed in my opinion.
E: Right, an underwriters laboratory
or consumer laboratory that's there to check some of these details.
And I don't think that's unreasonable, right? That sort of approach.
M: And there's a lack of regulations, also. So there's a lot of things
that should be worked on.
E: So, there's a lot of ways to solve this
and we're not gonna give you *the* answer, because we're not
geniuses, so we're gonna say that
these are some different approaches that we see all
playing in a solution space.
So, vendor awareness is obviously important, but
that's not the only thing. A lot of the vendors have been
very supportive and very open to discussion,
of transparency, that needs to happen more in the future, right?
Security risk monitoring, I've been working in the field
of cyber insurance, which I'm sure sounds like insanity to the rest of you,
and it is, there are bad days. But that could play a part
in this risk equation in the future.
What about medical incidence response, right? Or medical device forensics.
M: If I suddenly drop dead I really would like to have
a forensic analysis of my pacemaker, to ...
E: Please remember that, all of you! Like, if anything is going to happen
to Marie... everyone asked that, right? Like, 'Aren't you afraid of giving this talk?'
And we thought about it, we talked about it a lot and
she's got a lot of support from her husband and her son
and her family and a bunch of us. If anything happens to this woman
I hope that we will all be doing forensic analysis
of everything.
*applause*
Cool. So, we'll say a little bit about 'I Am The Cavalry' and social contract
and then we'll wrap it up, okay?
So, 'I Am The Cavalry' does a lot of grassroots research
and support and lobbying and tries to articulate these messages.
They have a medical implant arm that has a bunch of
different researchers doing this kind of stuff.
Do you wanna say more about them?
M: Yeah, so we are both part of the Cavalry,
because no one is coming to save us from the future
of being more depended on trusting our lives on machines
so, that's why we need to step up and do the research and
encourage and inspire the research.
So, that's why I joined 'I Am The Cavalry'
and I think it's a good thing to have
a collaboration effort between researchers, between the vendors
and the regulators, as they are, or we are working with.
E: We also think that even if you don't do reverse engineering
or you're not interested in security details or the opcodes
that are inside the firmwares or whatever,
this question is a question that any of you here can talk about
for the rest of the congress and going forward into the future.
Right?
This is Marie's, so go ahead.
M: Yeah, so, I really want to know what code is running inside my body.
And I want to know ...
or I want to have a social contract with my medical doctors and
my physician that is giving me this implants.
It needs to be based on a patient-to-doctor trust relationship.
And also between me and the vendors.
So I really want to know that I can trust this machine inside...
E: And we think many of you will be facing similar questions
to these in the future.
I have questions. Some of my questions are serious,
some of my questions are not serious, like this one:
Is the code on your dress from your pacemaker?
M: No, actually it's from the computer game 'Doom'.
But ... *laughter*
once I have the *laughing* code of my pacemaker
I'm going to make a custom- ordered dress and get it...
E: Which is pretty cool, right? M: ... get it with my own code.
*applause*
So, let's wrap up with... what we want to have of future research.
So, we encourage more research, and these are some things that
could be looked into.
Like open source medical devices, that doesn't really exist,
at least not for pacemakers.
But I think that's one way of going forward.
E: I think it's also an opportunity for us to mention a really scary idea,
which is, you know, should anyone have a golden key to Marie's heart,
should there be backdoored encryption inside of her heart?
We think no *laughing* but that...
M: I don't see any reason why the NSA should be able to
have a back door to my heart, do you?
E: You would be an extremist, that's why you don't want them
to have a back door to your heart. But this is a serious question, right?
If you start backdooring any kind of crypto anywhere,
how do you know, where it's gonna end up.
It might end up in medical devices and we think that's unacceptable.
*applause*
M: And we should also mention that we're not doing this alone,
we have other researchers helping us forward doing this.
Angel: So, thank you very much for this thrilling talk,
we're now doing a little Q&A for 10 min,
and for the Q&A please keep in mind to respect Marie's privacy, so
don't ask for details about
the implant or something like that.
E: Yeah, the brands and stuff.
We're gonna tell you, what OS she's running.
Angel: People, who are now leaving the room, they will not be able
to come back in, because
of measures *laughing* *laughter*
So, let's start with the Q&A! Let's start with this microphone there.
Q: Hi, first of all thank you very much for a very fascinating talk.
I'm not going to ask you about specific vendors.
However, I thought it was very interesting what you said, that
most vendors were really supportive I would like to know whether
there have been exceptions to that rule,
not who it was or anything like that but what kind of arguments
you may have heard from vendors e. g. have they referred to anything
such as trade secrets or copyright or any other legal reasons
why not to give you, or not to give public access
to information about devices? Thank you.
E: So, we haven't had any legal issues so far in this research.
And in general they haven't been concerned about copyright.
I think they're more concerned about press, bad press,
and a hype, you know, what they would see as hype.
they don't wanna see us scaring people away from these things
with, you know, these stories.
M: Yeah, that's also something I'm concerned of, of course,
as a patient. I don't want to scare my fellow patients
from having life-critical implants in their body.
Because a lot of people need them, like me, to survive.
So, the benefit clearly outweighs the risk in my case.
E: But that seems to be their main concern, like, you know,
'Don't give us too much bad press'
Angel: Ok, next question from over there.
Q: Hello. I wanted to ask you, if you know about any existing initiatives
on open sourcing the medical devices,
on mandating the open sourcing of the software and firmware
through the legal system, in European Union, in United States
because I think I've read about such initiatives
about 1 year ago or so, but it was just a glimpse.
M: So, there are some patients that have reverse engineered their
*no audio*
(insu)lin pumps. I know, that there are groups of patients
like the parents of children with insulin pumps.
They have created software to be able...
to have an app on their mobile phone to be able
to monitor their child's blood sugar levels.
So that's one way of doing this open source
and I think that's great.
Q: But nothing in the legal systems,
no initiatives to mandate this, e.g. on European level?
E: Not so far that we've seen,
but that's something that can be discussed now, right?
M: I think it's really interesting, you could look into the legal
aspects and the regulations around this, yeah.
Q: Thank you.
Angel: Ok, can we have a question from the internet?
Q: Yes, from the IRC someone asks:
'Does your pacemaker have a biofeedback,
so in case something bad happens it starts to defibrillate?
M: No, I don't have an ICD, so in my case I'm not getting a shock
in case my heart stops. Because I have a different condition
I only need to have my rhythm corrected.
But there are other types of conditions,
that require pacemakers that can deliver shocks.
Angel: Ok, one question from that microphone there.
Q: Thank you very much. At one point you mentioned
that the connectivity in you pacemaker is off. For now.
And, is that something, that patients are asked during the process,
or is that something, patients have to require?
And generally: What role do you see for the choice
not to have any connectivity or any security for that matter,
that technology would make available to you?
So, how do you see the possibility to choose a more risky life
in terms of trading in for privacy, whatever?
M: Yeah, I think that's really a relevant question.
As we mentioned in the social contract,
I really would like, that the doctors informed patients about
their different wireless interfaces and that there's an informed decision
whether or not to switch it on.
So, in my case, I don't have it switched on and ...
I don't need it, so there's no reason why I need to have it switched on.
But then, again, why did I get an implant that has this capability?
I should have had the option of opting out of it, but I didn't get that.
They didn't ask me, or they didn't inform me of that,
before I got the implant. It was chosen for me.
And at that time I hadn't looked into the security of medical devices,
and I needed to have the implant,
so I couldn't really make an informed decision.
A lot of patients that are, like, older and not so...
that don't really understand the technology,
they can't make that informed decision, like I can.
So, it's really a complex issue
and something that we need to discuss more.
Angel: Ok, another question from there.
Q: Yeah, thanks.
As a hacker, connected personally
and professionally to the medical world:
How can I educate doctors, nurses, medical people
about the security risks presented by connected medical devices?
What can I tell them? Do you have something
from your own experience I could somehow ...
M: Yeah, so, the issue of software bugs in the devices
I think is a real scenario that can happen and ...
E: Yeah, if you can repeat that story of debugging her,
like, I think, that makes the point. And then try in adopt that
hygiene-metaphor that we had before, where, you know,
people didn't believe in germs, and these problems before,
we're in that sort of era, and we're still figuring out
what the scope of potential security and privacy problems are
for medical devices. In the meantime
please be open to new research on this subject, right?
And that story is a fantastic illustration,
that we don't need evil hacker typer, you know, bond villain,
we just need failure to debug programming station, properly, right?
Q: Thank you very much.
Angel: Ok, another question from the internet.
Q: Yes, from the IRC:
'20 years ago it was common, that a magnet had to be placed
on the patients chest to activate the pacemakers remote configuration interface.
Is that no longer the case today?'
E: It's still the case with some devices, but not with all of them I think.
M: Yeah, it varies between the devices, how they are programmed and
how long distance you can be from the device.
Q: Thank you for the talk. I've some medical devices
in myself to, an insulin pump and sensors to measure the blood sugar levels,
I'm busy with hacking that and to write the software for myself,
because the *** doesn't have the software.
Have you ever think about it, to write your own software for your pacemaker?
E: *laughing* M: *laughing*
M: No, I haven't thought about that until now. No. *laughing*
E: Fantastic, I think that deserves a round of applause, though,
because that's exactly what we're talking about.
*applause*
Angel: Another question from there.
Q: First off, I want to say thank you that you gave this talk, because
once it's quite interesting, but it's not that talk,
anyone of that is effected could hold,
so, it takes quiet some courage and
I want to say thank you. So
*applause*
Secondly, thank you for giving me the
update. I started medical technology but
I finished ten years ago and I didn't work
in the area and it's quiet interesting to
see what happened in the meantime, but
now for my actual question:
You said you got devices on ebay, is it
possible to get the hole
communication chain?
So you can make a sandbox test or ..
M: Yes it's possible to get devices,
it's not so easy to get the pacemaker
itself , it's quite expensive.
E: And even when we get one,
we have some paring issues and like
Marie can't be in the same room , when
we were doing a curtain types of testing
and right, so that last piece is difficult
but the rest of the chain is pretty
available for the research.
Q: Ok, thank you.
Angel: So, time is running out, so we,
only time left for one question and from
there please.
Q: Thank you. I'm also involved in
software quality checks and software qs
here in Germany also with medical developments
and as far as I know, it is the most
restricted area of developing products
I think in the world,
it's just easier to manipulate software
in a car X-source system or breaking guard
or something like this, where you don't
have to show any testing certificate or
something like this, the FDA is a very
high regulation part there.
Do you have the feeling that it's a
general issue that patients do not have
access to these FDA compliant tests and
software q-a-systems?
M: Yeah, I think that we should have
more openness and more transparency
about, around this issues , really.
E: I mean, it's fantastic you do quality
assurance, i used to be in quality assurance
at a large cooperation and I got tiered
and landed in strategy and pen testing and
then I just thought of myself as paramilitary
quality assurence , ..
now I just do it on ever I wanne test, so
thank you for doing q-a and keep doing it
and hopefull you don't have to many regulations
but companies sharing more of this
information, its really the transparency
and the discussion, the open dialogue
with patients and doctor and a vendor is
really what we wanna focus on and make
our final note ? M: Yeah.
M: We see some problems already
the last year, the MI Undercover Group has
had some great progress on having good
discussions with the FDA and also involving
the medical device vendors in the discussions
about cyber security of medical devices
and implants. so thats great and I hope
that this will be even better the next year.
E: And I think you wanne to say
one more thing to congress before we leave
which is:
M: Hack to save lives!
*applaus*
♪ postroll music ♪
subtitles created by c3subtitles.de Join, and help us!