Unpatchable: 32C3 edition
•
1 like•5,099 views
Gradually we are all becoming more and more dependent on machines, we will be able to live longer with an increased quality of life due to machines integrated into our body. However, our dependence on technology grows faster than our ability to secure it, and a security failure of a medical device can have fatal consequences. This talk is about Marie's personal experience with being the host of a vulnerable medical implant, and how this has forced her to become a human part of the "Internet-of-Things".
Recommended
Recommended
More Related Content
Similar to Unpatchable: 32C3 edition
Similar to Unpatchable: 32C3 edition (20)
More from Marie Elisabeth Gaup Moe
More from Marie Elisabeth Gaup Moe (11)
Recently uploaded
Recently uploaded (20)
Unpatchable: 32C3 edition
- 1. Concinnity Risks Unpatchable Living with a vulnerable implanted device @MarieGMoe @blackswanburst Marie Moe, PhD, Research Scien?st at SINTEF Eireann LevereE, Founder and CEO of Concinnity Risks
- 2. Hack to save lives!
- 3. A brief history of my heart…
- 4. How the heart works
- 5. Electrical system of the heart
- 6. Pacemaker
- 7. The Internet of Medical ”Things” is real, and Marie’s heart is wired into it…
- 8. ① Implantable medical device – ICD/Pacemaker/other devices – MICS (Medical Implant Communica?on Service) – Bluetooth ② Access point – POTS/GSM/SMS/email ③ GSM/Telephone/Internet ④ Telemetry store – Programmers – Doctor’s worksta?on – Telemetry server at vendor ⑤ Medical staff – Social engineering
- 9. With connec?vity comes vulnerability…
- 10. Poten?al impact Pa?ent privacy issues BaEery exhaus?on Device malfunc?on Death threats and extor?on Remote assassina?on scenario…
- 11. ”We need to be able to verify the soware that controls our lives” Bruce Schneier on “Volkswagen and Chea?ng Soware”
- 12. Previous work • Kevin Fu et al: – Pacemakers and implantable cardiac defibrillators: Soware radio aEacks and zero-‐power defenses (2008) – Mi?ga?ng EMI signal injec?on aEacks against analog sensors (2013) • Barnaby Jack • Hardcoded creden?als • Medical device honeypots • Drug infusion pumps
- 13. Hacking can save lives Source: h*p://www.fda.gov/MedicalDevices/Safety/AlertsandNo>ces/ucm456815.htm
- 14. Medical devices do get infected Source: h*ps://securityledger.com/wp-‐content/uploads/2015/06/AOA_MEDJACK_LAYOUT_6-‐0_6-‐3-‐2015-‐1.pdf
- 15. WTF are you doing with my data?
- 16. The stairs that almost killed me
- 17. Debugging me
- 19. The future?
- 20. Reflec?ons on trus?ng machines
- 21. Why? Legacy technology No soware updates Long life?me of devices No security tes?ng or monitoring Medical devices are ”black boxes” Proprietary soware More connec?vity Lack of regula?ons Increased aEack surface
- 22. How to solve it? Security research Informa?on sharing Third party collabora?on Coordinated disclosure Vendor awareness Regula?on Procurement Safety by design Security tes?ng Security risk monitoring Security updates Incident response Cyber insurance Resilience
- 24. What is the social contract for the code in our bodies?
- 25. Research needed • Open source medical devices • Medical device cryptography • Personal area network monitoring • Jamming protec?on • Forensics evidence capture
- 26. Credits Tony Naggs (@xa329) Gunnar Alendal (@gradoisageek) Alexandre Dulaunoy (@adulau) Joshua Corman (@joshcorman) Claus Cramon Houmann (@ClausHoumann) ScoE Erven (@scoEerven) Beau Woods (@beauwoods) Suzanne Schwartz (US FDA) Family & Friends
- 27. Concinnity Risks Thank you! www.infosec.sintef.no www.iamthecavalry.org www.concinnity-‐risks.com @MarieGMoe @blackswanburst