Marie Moe, Eireann Leverett: Unpatchable

Angel: The next talk will start now

and will be "Unpatchable -

living with a vulnerable
implanted device"

by Dr. Marie Moe and Eireann Leverett.

Give them a warm round
of applause please.

applause

Heart Monitor Beep starts

So, we are here today

to talk to you about a subject

that is really close to my heart.

I have a medical implant.

A pacemaker, that is generating

every single beat of my heart.

But how can I trust my own heart,

when it's being controlled by a machine,

running a proprietary code,

and there is no transparency?

So I'm a patient,

but I'm also a security researcher.

I'm a hacker, because I like

to figure out how things work.

That's why I started a project

on breaking my own heart,

together with Eireann

and a couple of friends.

Because I really want to know

what protocols are running

in this machine inside my body.

Is the crypto correctly implemented?

Does it even have crypto?

So I'm here to inspire you today.

I want more people
to hack to save lives.

Because we are all becoming

more and more dependent on machines.

Maybe some of you in the audience

also have medical implants,

maybe you know someone

that's also depending on
medical implants

Imagine that this is your heartbeat

and it's being controlled by a device.

A device, that might fail.

Due to software bugs,

due to hardware failures.

Additional background sound:
real heartbeat

Wouldn't you also like to know

if it has security vulnerabilities?

If it can be trusted?

Sounds stop

beeeeep

Eireann: Something to think about, right?

Marie: Yeah.

Eireann: Marie is an incredibly
brave women.

When she asked me to give this talk

it made me nervous, right?

It's such a personal story.

Such a journey as well.

And she's gonna talk to you

about a lot of things, right?

Not just hacking medical devices

from a safety point of view

but also some of the
privacy concerns,

some of the transparency concerns,

some of the consent concerns.

So, there's a lot to get trough

in the next hour.

But I think you're gonna enjoy it

quite a lot.

Marie: So, let me tell you

the story about my heart.

So, 4 years ago

I got my medical implant.

It was a kind of emergency situation

because my heart was starting to beat

really slow,

so i needed to have the pacemaker.

I had no choice.

After I got the implant,

since I was a security researcher,

of course I started to

look up information about how it worked.

And I googled for information.

I found a technical manual

of my pacemaker

and I started to read it.

And i was quite surprised

when I learned that

my pacemaker has 2 wireless interfaces.

There is one interface, that is really

close field communication,

near field communication

that is being used when I'm at checkups

at the hospital,

where the technician,

the pacemaker technician or doctor

uses a programming device

and places it

really close to my pacemaker.

And it's possible to use that

communication to adjust the settings.

But it also has another

wireless interface,

that I was not aware of,

that I was not informed of
as a patient.

It has a possibility for remote monitoring

or telemetry,

where you can have an
access point in your house

that will communicate

with the pacemaker

at a couple of meters distance.

And it can collect logs from the pacemaker

and send them to a server

at the vendor.

And there is a web interface

where the doctor can log in

and retrieve my information.

And I have no access the data

that is being collected

by my device.

Eireann: So imagine for a moment

that you are buying a new phone

or buying a new laptop.

You would do your homework, right?

You would understand
what interfaces where there.

But in Marie's case she's just

given a device,
and then later she gets

to go and read the manual, right?

So she's the epitome
of a informed consumer

in the space

and we want a lot more informed consumers

in the space,

which is why we are giving this talk.

Now, I don't know about you,

but I'm used to hacking

industrial systems.

I haven't done as much medical research

in the past.

So, when I first started this project

I knew literally nothing

about Marie's heart.

Or even my own.

And she had to teach me
how the heart works

and how her pacemaker works.

So, would you mind explaining

some details to the audience
that will be relevant

through the rest of the presentation?

Marie: Actually I think we're going to

show you a video of
how the heart works.

So, it's a little bit of
biology introduction here

before we start
with the technical details.

So, this.. play the video.

Video: A normal heart beat rate

and rhythm is called
"Normal Sinus Rhythm".

The heart's pumping action

is driven by electrical stimulation

within the heart muscle.

the heart's electrical system

allows it to beat in an

organized, synchronized pattern.

Every normal heart beat

has 4 steps.

Step 1:

As blood flows into the heart

an electrical impulse

from an upper area of the right atrium

also known as the sinus node

causes the atria to contract.

When the atria contract

they squeeze the blood

into the ventricles.

Step 3:

There is a very short pause

only about a fraction of a second.

and Step 4:

The ventricles contract

pumping the blood to the body.

A heart normally beats

between 60-100 times/min.

Electrical signals in your heart

can become blocked or irregular,

causing a disruption

in your hearts normal rhythm.

When the heart's rhythm is too fast,

too slow or out of order,

an arrhythmia,

also called a rhythm disorder occurs.

When your heart beats out of rhythm,

it may not deliver enough blood

to your body.

Rhythm disorders can be caused

by a number of factors

including disease, heredity,

medications or other factors.

Eireann: So for those of you
who are already aware of that,

apologies.

But I needed to learn that.

I needed to learn the basics

before we even got started, right?

So...

Marie: So this is a diagram of the

electrical system of the heart.

So, as you see,
this is the sinus node

that is generating the pulse.

And in my case

I had a problem with the signal

being generated by the sinus node

not reaching the lower
heart chamber.

It's something called an AV block
or a heart block

So, occasionally this will cause

an arrhythmia that makes
the heart pause.

If you don't have a heart beat

for, like ... 8-10 seconds,

you lose your consciousness.

And that was, what happened to me.

I just suddenly found myself

lying on the floor

and I didn't remember how I got there.

And it turned out that it was my heart

that had taken a break.

So that's how I discovered

that I had this issue.

So, this is where the signal is blocked

on the way down to the lower heart chamber

But there's a backup function

in the heart that can make

a so called backup pulse.

And I had that backup pulse

when I went to the emergency room.

So I had a pulse around 30-40 beats/min.

And that's generated by some cells

in the lower heart chamber.

So, after I got the pacemaker

my heart started to become

a little bit more lazy.

So it is not certain,

that I will have this backup pulse

anymore if the pacemaker stops working.

So currently

my heart is 100% running
on the pacemaker.

So, let's also look at
how the pacemaker works.

I have another video of that.

So, this is my little friend

that is running my heart.

Video: A pacemaker
is a miniaturized computer

that is used to treat a slow heart beat.

It is about the size

of a couple of stacked silver dollars

and weights approximately 17-25 grams.

It is usually surgically placed

or implanted just under the skin

in the chest area.

The device sends a tiny electrical pulse

down a thin coated wire,

called a lead, into your heart.

This stimulates the heart to beat.

This impulses are very tiny

and most people do not feel them.

While the device helps your heart

maintain its rhythm,

it also stores information

about your heart that can be

retrieved by your doctor

to program the device.

Eireann: Remember that!

Marie: Yeah... Did you see

the ones and zeros at the end

of the video?

That's what we want to know
more about.

Because this information

that is being collected
by the pacemaker,

how it works,

how the code looks like,

it's all closed source,

it's all proprietary information.

And that's why we need more

security researchers,

we need more 3rd party testing,

to be sure that we can trust this code.

Eireann: And you can imagine that

we're doing some of this research as well.

But I'm not gonna break
Marie's heart on stage,

I'm not gonna drop (???)

on some medical devices,

so if you came for that,

it's not worth staying.

The rest of the presentation

will be about some of the things we found

and how this works and

how you might approach this research.

And some of the people
who did this research before,

because there's plenty of others,

and we like to give a shout-out

to those who've done
great research in advance.

But essentially this point is

very relevant.

That the internet of medical things

is already here.

And Marie is wired into it.

She's a bit younger than the average

pacemaker patient, but, you know,

she was thrust into this situation

where she had to think about things

in a very different way.

Like, you did a Masters,
breaking crypto,

and also a PHD in Information Security.

Did you imagine, that things you learned

about SSH and network security

might one day apply to your
heart and your own body?

Marie: No, I never
figured out that

my research would eventually
end up inside my own body.

That's something I never
thought about.

And also, there's a lot of

people that don't think about

how the medical devices
actually work.

So, when I asked this question

to health care professionals

they look at me like I'm crazy,

they don't ... they have never
thought about this before.

That there's actually code
inside my body

and someone has programmed it,

someone has written this code.

And, did they think about,
that this

would actually control
someone's life,

and be my own personal
critical infrastructure?

Eireann: Yeah, personal
infrastructure, right?

On a physical level.

And also, I think, it's...

You know, the point that you made
is important to reiterate,

that you go and see your doctor

and you ask these questions about

whether anyone can hack into my heart

and they probably look at you
and go like

'Don't you worry your pretty
little head about that', right?

But Marie used to head up

the Norwegian computer
emergency response team

for a couple of years

and knows a lot of hackers

and knows what she's
talking about, right?

So, when she asked her doctor
these questions,

they're very legitimate questions.

And the doctors probably
don't know anything about code,

but they need to move
towards a place

where they can answer
those questions with some

honesty and certainty and
treat them with the dignity

that they deserve.

Should we show them
a little bit more

about the total ecosystem
of devices

that we are talking about,
at least in this particular talk?

Marie: Yeah.

Eireann: So, this was
all new to me.

I mean I've moved around
in networks and done some

penetration testing and
some stuff in the past,

but I didn't know much about
implantable medical devices.

So, we've got a couple
of them there.

The ICD, which is the
in-cardio-defibrillator,

that's some of the work
that you saw from Barnaby Jack

which we will mention later,

was on those particular devices,

We've got the pacemakers
and of course other devices

could be in this diagram as well.

Like, we could be talking
about insulin pumps

or other things in the future.

The device itself speaks
to box number 2,

which we will tell you a little bit
more about in a moment,

using a protocol, commonly
referred to as 'MICS".

A number of different
devices use this

Medical Implant Communication Service.

And Marie shocked me yesterday

when she found
a couple devices

that potentially use Bluetooth.

sigh
laughing

So, would you like to tell them
a little bit more about the access point,

and I'll join in?

Marie: Yeah, so, the access
point is the device

that you can typically have
on your bed stand

and that will, depending
on your configuration,

contact your pacemaker
as regular intervals,

e.g. once during the night.

It will start a communication
with the pacemaker,

couple of meters distance,

and will start
collecting logs.

And this logs will
then be sent,

it can be via SMS
or other means,

to a server.

So, there's a lot of my
personal information

that can end up different
places in this diagram.

So, of course it's
in my own device,

it will be then communicated
via this access point

and also then

via the cellular network.

And then it will also be stored
in the telemetry server.

Potentially when I go
for the checkups

my personal information will
also end up in my

doctor workstation

or in the electronic
patient records.

And there's a lot of things
that can go wrong there.

Eireann: Yeah, you
can see, it's using

famously secure methods
of communication

that have never been backdoored
or compromised by anyone ever before,

even here at this conference,
probably even this time around.

So these are some things
that are concerning.

The data also travels often
to other countries

and so there are questions
about the jurisdiction

in terms of privacy laws
in terms of some of this data.

And some of you can go and
look deeper into that as well.

The telemetry store thing
I think is important,

some of this is a telemetry store,
such as the server at the vendor.

So the vendor owns some
machines somewhere

that collect data
from Marie's heart.

So you can imagine she goes to see her
doctor and the doctor is like:

'Hey, Marie, last weekend, did you, ...
run a half marathon or something?'

And she hasn't told him, right?

Like, he just can look
at the data and see,

that her heart rate was up
for a couple hours.

That's true though, right? You
did actually run a half marathon.

Marie: Yeah, I did run a half marathon.
laugh

Eireann: So, the telemetry
store is one part,

but there's also the
doctors work station

which contains a lot of
this medical data.

So, from privacy perspective
that's part of the attack surface.

But there's also the programmers, right?

There's the device's programmers.

So that's an interesting point, that
I hope a lot of you are interested in

already, that there
is a programmer

for these devices.

Marie: So, we actually
went shopping on eBay

and we found some
of these devices.

Eireann: You can buy them on eBay?

Marie: Yeah.
Eireann: laugh

Marie: So, I found
a programmer

that can program
my device, on eBay

and I bought it.

And I also found a couple of
these access points.

So, that's what we're
now starting to look at.

Eireann: We just wanna to give
you an overview of this system,

and it's fairly similar across the
different device vendors,

and we're not going to talk
about individual vendors.

But if you're gonna go and
do this kind of research

you can see that some of the research
you've already done in the past

applies to different parts
of this process.

Marie: And talking about
patient privacy,

when we got the
programmer from ebay

it actually contained
patient information.

So, that's the
really bad thing.

Eireann: So, I found
this very odd.

I had a similar reaction
to yourselves because

I usually do industrial
system stuff.

One of my friends picked up
some PLCs recently and

they had data from the nuclear plant,
that the PLCs had been used in.

So, decommissioning is a problem
in industrial systems

but it turns out also
in medical devices, right?

I guess that's a useful point
to make as well,

about the costs of doing
this kind of research.

It is possible to get some
devices, some implants

from people who have sadly
passed on,

but that comes with a very high
cost of biomedical decontamination.

So that raises the cost
of doing this research

on the implants themselves,
not necessarily on the rest

of the devices.

Marie: Yeah, so, also want
to say, that in this research

I had not *** with my own device.

So, that would not be a good thing ...

Eireann: You're not gonna let me,
like, SSH in your heart and just ...

Marie: Um.. No.
Eireann: ... just delete some stuff.. No?

Marie: No.
Eireann: I wouldn't do it anyway,

but it's an interesting point, right?

So, like, there are a lot of
safety percussions

that we and the rest
of the team have to take

when we are doing this research.

And one of them is
not pairing Marie's pacemaker

with any of the devices
that are under test.

Do you wanna say a bit more
about connectivity and vulnerability?

Marie: Yeah, so...

I was worried
when I discovered that

I had this possible connectivity
to the medical internet of things.

In my case this is switched off
in the configurations

but it's there.

It's possible to turn it on,
it's possible for me to be

hooked up to the,
this internet of medical things.

And for some patients
this is really benefit.

So you always have to make
a *** decision

on whether or not to
make use of this

connectivity.

But I think it's really important
that you make an informed decision

about that and that the patient

is informed and has given
his or her consent

to have this feature.

The battery lifetime of my pacemaker
is around 10 years.

So in 6 years time

I will have to have a
replacement surgery

and I'm going to be
a really difficult patient.

laughs
audience laughing

So, ...
applause

Eireann: Right on

Marie: I really want to know

how the devices work
by then and

I want to make an informed
decision on whether or not

to have this connectivity.

But of course for lot of patients
the benefit of having this

outweighs the risk.

Because people that had other
heart problems than me

they have to go for more
frequent checkups.

I only have to go once a year.

So, for patients that need to go
frequently for checkups,

it's really good for them
to have the possibility

of having telemetry and
having connectivity to

have remote patient monitoring.

Eireann: Yeah, imagine you
have mobility problems or

you even just live far

from a major city.

And making the journey
to the hospital is quite arduous,

then this kind of remote
telemetry allows your doctor

to keep track of
what's going on.

And that's very important,
we don't wanna, like...

have a big scary testosterone
filled talk where we, like,

hack some pacemakers.

We wanna talk about
how there's a dual use thing

going on here.

And that there is a lot of value
in having this devices

but we also want them to be save
and secure and preserve our privacy

and a lot of other things.

So, these are some
of the issues.

Of course the last one,
the remote assassination scenario,

that' s everyone favorite one
to fantasize about

or talk about, or make
movies about, but

we think there's a lot of
other issues in here

that are more interesting,

some quality issues even, right,

that we'll talk about
in a little bit.

Battery exhaustion,

again something many people
don't think about. But...

I'm very interested in
cyber-physical exploitation

and so some of this elements
were interesting to me

that you might use the device
in a way that wasn't expected.

Marie: So personally I'm not afraid
of being remotely assassinated.

Eireann: I've actually never known
you to be afraid of anything

Marie: laughs

I'm more worried about
software bugs in my device,

the things that can malfunction,

Eireann: Is that just theoretical?

Marie: No, actually software bugs

have killed people.

So, think about that!

People that are not here,

they don't have their voice
and they can't really

give there story.

But there are stories about persons
depending on medical devices

dying because their
device malfunctioned.

Eireann: There's even some
great research

from academics about
how the user interface design

of medical devices can have
an impact on patients safety

and how designing UX

much more clearly
and concisely

specifically for the
medical profession

might improve
the care of patients.

Do you wanna say more
about this slide or should we

go on to the previous work,
should we... go ahead!

Marie: Yeah, I think it's really
important also to...

the issue of trusting the vendors.

So, as a patient I'm
expected to just, you know,

trust, that my device
is working correctly,

every security vulnerability
has been corrected by the vendor

and it's safe.

But I want to have more
third party testing,

I want to have more security
research on medical implants.

And as a lot things, like ...
history has shown

we can't always trust that
the vendors do the right thing.

Eireann: I think this is a good
opportunity for us to ask

a very fun question, which is:

Any fans of DMCA in the room?

laughter from the audience

No? No fans? Alright.

Well, you then you'll really enjoy this.

Marie has some very exiting news
about DMCA exceptions.

Maire: Yeah, so... October, this year

there was a ruling of
an DMCA exemption for

security research
on medical devices

also for *** security research.

So, this means, that

as researchers you can

actually do reverse engineering
of medical implants

without infringing copyright laws.

It will take effect
I think October next year.

Eireann: Yeah.
Marie: That is really a big

step forward in my opinion.

And I hope that this will
encourage more research.

And I also want to mention
that there are

fellow activist patients
like myself

that was behind that proposal
of having this exemptions.

So, Jay Radcliff who hacked
his own insulin pump,

Karen Sandler, who is a free and
open software advocat.

And Hugo Campos, who has
an ICD implant, he is very ...

he wants to have access
to his own data

for quantified self reasons.

So this patients,
they actually

made this happen,
that you're allowed to do

security research
on medical devices.

I think that's really great.

applause

Eireann: Do you wanna say something
about Scott Erven's presentation

that you saw at DEF CON?

Marie: Yeah, that was a really
interesting presentation about

how medical devices have
really poor security.

And they have, like,
hard coded credentials,

and you can find them
using *** on the internet.

This were not pacemakers,
but other types of

different medical devices.

There are, like, hospital networks
that are completely open

and you can access
the medical equipment

using default passwords that
you can find in the manuals.

And the vendors claim that

no, these are not hard coded,
these are default,

but then the manuals say:
Do not change this password...

Eireann: Because they want to
integrate with other stuff, right? So...

I've heard that excuse from SCADA,
so I wasn't having it.

Marie: They also put up some
medical device honeypots

to see if they were *** targeted(?)
hacking attempts

but they only picked up malware
on them, which is also ...

Eireann: Only!
Marie: ... of course of a concern laughs

Eireann: Anything else,
about prior(?), Kevin?

Marie: I guess we should mention
that the academic research

on hacking pacemakers,
which was started by

a group led by Kevin Fu

and they had this
first paper in 2008

that they also followed up
with more academic research

and they showed that it's
possible to hack a pacemaker.

They showed that...
this was possible on a, like

a couple of centimeters
distance only,

so, like, the attack scenario
would be, if you have a

device similar to the
programmers device

and you attack me with it
you can laughs

turn off my pacemaker.

That's not really scary,

but then we have the research
by Barnaby Jack

where this range of the attack
is extended to several meters

so you have someone with
an antenna in a room

scanning for pacemakers

and starting to program them.

Eireann: We have a saying
at Cambridge about that.

Some of the other people at the
university have been doing attacks

a lot longer than I have, and
one of the things they say is:

'Attacks only get worse,
they never get better.'

So, the range might be short one year,
then a couple of years later it's worse.

Marie: The worst case scenario
I think would be remotely,

via the internet being able to
hack pacemakers.

but there's no research so far
indicating that that's possible.

Eireann: And we don't wanna
hype that up. We don't wanna...

Marie: No.
Eireann: ... get that kind of an angle

on this talk. We wanna make the
point that hacking can save lives,

that hackers are global citizen's
resource to save lives, right? So...

Marie: Yeah, so, this is the result
of hacking of the drug infusion pumps.

Earlier this year

the FDA actually issued the first ever
recall of a medical device

based on cyber security concerns.

Eireann: I think that's amazing, right?
They've recalled products

because of cyber security concerns. They
used to have to wait until someone died.

In fact, they had to show
something like 500 deaths

before you could recall a product.
So now they can ...

the FDA, at least in the US,
they can recall products

just based on security
considerations.

Marie: So, this is also,

I guess the first example
of that type of pro-active

security research,
where you can

make a proof of concept
without killing any patients

and then that closes
the security holes.

And that potentially
saves lives.

And no one has been hurt
in the research.

I think that's great.

Eireann: I'm also really excited
because we give a lot of presentations

about security that are filled with
*** and depression,

so it's nice to have two major victories
in medical device research

in the last few years.
One being the DMCA exemptions

and the other being
actual product recalls.

Marie: Yeah, and the FDA are starting
to take these issues seriously and

they are really focusing on the cyber
security of medical implants now.

I'm going to go to a workshop
arranged by the FDA in January

and participate on a panel discussing
cyber security of medical implants.

And it's great to have this
type of interaction between

the security committee, medical
device vendors and the regulators.

So, things are happening.

Eireann: Yeah. How do you feel
as an audience,

are you glad that she's going to be
your representative in Washington

for some of these issues?

applause

And we want you to get
involved as well, right?

This is not just about Marie
and myself and the other people

who worked on this
project, it's meant say

you too can do this research.
And you should be.

You have to be a little sensitive,
a little bit precise and articulate

about concerns.

We take some inspiration from the
former research around hygiene.

Imagine the first time some scientist
went to some other scientist and said

'There is this invisible stuff,
and it's on your hands,

and if you don't wash your hands
people get infections!"

And everyone thought
they were crazy.

Well, it's kind of the same with us
talking about industrial systems

or talking about medical devices
or talking about hacking in general.

People just didn't, sort of,
believe it was possible at first.

And so we have to articulate ourselves
very, very carefully.

So, we draw inspiration from
that early hygiene movement

where they had a couple simple rules
that started to save people's lives

while they explained germ theory
to the masses.

M: Yeah, so, this type of research
is kind of low hanging fruits

where you just, so...

*** is an example, where

there's a lot of medical
device networks in hospitals

that are open to the internet
and that can get infected

by normal type of malware,
like *** trojans or whatever.

And this is potentially a safety issue.

So, if your MR scanner or some other

more life-critical device
is being unavailable because of

a virus on it,

that's a real concern for patient
security and safety.

So we need to think more about
the hygiene also in terms of

computer viruses, not only
just normal viruses.

E: Yeah. So, you know, some
times people will treat you like

this is an entirely theoretical
concern, but

I think this is one of the best
illustrations that we've found

of how that should
be a concern,

and I think all of you will get it,

but I wanna give you a moment to kind of
read what's about to come up on the slides.

So I'll just let you enjoy
that for a moment.

So if it's not clear or it's not your
first language or something,

this guy basically *** patient data
across a bunch of amazon clusters.

And then it was unavailable.
And they were very concerned

about the unavailability of their
costumer patient data

*** across amazon instances.

He was complaining to support, like
'Can I get support to fix this?' laughs

M: So, all the data of the ...

... the monitoring data of the cardiac
patients is unavailable to them

because of the service
being downed.

And, well, do you want to outsource your
patient's safety to the cloud? Really?

I don't want that.
Okay.

E: I wanna get into some other details.
We have sort of 10 min left if we can ...

so we can have a lot of questions,
and I'm sure there will be some.

But I want you to talk to them about
this very personal story.

This is... Remember before, when we
said, is this stuff theoretical?

I want you to pay a lot of
attention to this story.

It really moved me
when she first told me.

M: I know how it feels to have
my body controlled by a device

that is not working correctly.

So, I think it was around 2 or 3
weeks after I had the surgery.

I felt fine.

But I hadn't really done
any exercise yet.

The surgery was pretty easy,
I only had 2 sick leave

and then I came back to work

and I went to London

to participate in a course
in ethical hacking and

I did take the London Underground
together with some of my colleges

and we went of at this station
at Covent Garden

And I don't know if you
have been there but

that particular station is
really low underground.

They have elevators that you
can use to get up,

but usually there are, like,
long queues to the elevators...

E: You always have to do
things the hard way, right?

You had to take the stairs, or

they were just heading for the stairs
and I was following them and

we're starting to climb the stairs and
I didn't read this warning sign, which is:

'Those with luggage, pushchairs & heart
conditions, please use the lift' laughs

Because I was feeling fine,

and this was the first time that I
figured out there's something wrong

with my pacemaker or with my heart.

Because I came like
half way up this stairs

and I felt like I was going to die.

It was a really horrible feeling.

I didn't have any more breath left,

I felt like I wasn't able
to complete the stairs.

I didn't know what was
happening to me, but

somehow I managed to
drag myself up the stairs

and my heart was really...

it didn't feel right.

So, first thing when I came
back from this course

I went to my doctor

and we started to try
debug me, tried to find out

what was wrong with my pacemaker.

And this is how that looks like.
E: laughs

M: So, there's a stack
of different programmers

- this is not me by the way, but it's
a very similar situation.

E: And we'll come back to those
programmers in a moment.

M: Yeah.
E: But the bit I want you

to focus on is, like, they're
debugging your pacemaker?

Inside you?
M: Yeah, I didn't know

what was happening
at the time.

We were just trying to
get the settings right

and it took like 2 or 3 months before
we figured out what was wrong.

And what happened was, that my
operate limit was set to low for me,

for my age. So, the normal pacemaker
patient is maybe around 80 years old

and the default operate
limit was 160 beats/min.

And that's pretty low for
a young person.

E: So, imagine, like, you're younger
and you're really fit and you know

how to do something really well,
like swimming or skiing or skateboarding

or whatever. You're fantastic at it.
And then a couple years go past

and you know, you gain some weight
and you're not as good at it, right?

But now imagine that
happens in 3 seconds.

While you're walking
up a set of stairs.

M: So, what happens is that
the pacemaker detects

'Oh, you have a really high pulse'.
And there's a safety mechanism

that will cut your pulse in half ...
E: In half!

laughing
M: laughs So in my case it went

from 160 beats/min to 80 beats/min.
In a second, or less than a second,

and that felt really, really horrible.

And it took a long time
to figure out what was wrong.

It wasn't until they put me on
an exercise bike and

had me on monitoring that they
figured out what was wrong, because

the thing was, that what was displayed
on the pacemaker technician's view

was not the same settings that
my pacemaker actually had.

There was a software bug in the
programmer, that caused this problem.

E: So they thought they had updated
her settings to be that of a young person.

They were like
'Oh, we've already changed it'.

But they lost the view. They couldn't
see the actual state of the pacemaker.

And the only way to figure that out
was to put her on a bike

and let her cycle until her
heart rate was high enough.

You know, literally physically
debugging her to figure out

what was wrong.

Now stop and think about whether or not
you would trust your doctor

to debug software.

laughing

So, say a little bit more about those
programmers and then we'll move on

towards the future.

M: Yeah, so, we got one of these
programmers, as mentioned

and looked inside it.

And, well, we named this talk
'Unpatchable', because

originally my hypothesis was that,
if you find a bug in a pacemaker

it will be hard to patch it.

Maybe it would require surgery.

But then when we looked
inside the programmer

and we saw that it contained firmware
for pacemakers we realized that

it's possible to actually patch the
pacemaker via this programmer.

E: One of the other researchers
finds these firmware blobs inside

the programmer code and, like,
my heart stopped at that point, right?

I was just going 'Really, you can just
update the code on someones pacemaker?'

We also wanna say something
about standardization.

Look at all those
different programmers.

Someone goes into a hospital
with one of these devices

they have may different programmers
so they have to make an estimation

of which... you know, which
programmer for which device.

Like, which one are you running.

And, so, some standardization
would be an option laughs

perhaps, in this case.
M: Yeah.

E: Alright. So, we gonna need
to move quickly through

the next few slides to talk
to you about the future,

but I hope that drives home that
this is a very real issue for real people.

M: So, pacemakers are evolving and
they are getting smaller

and this is the type of pacemaker
that you can actually implant

inside the heart.

So, the pacemaker I have today
is outside the heart and it has

leads that are wired to my heart.

But in future they are getting
smaller and more sophisticated and

I think this is exiting!

I think that a lot of you,
also in the audience will

benefit from having this type of
technology when you grow older

and we can have longer lives and
we can live more healthier lives

because of the technology
E: And keep in mind, right?

Some of you may already have devices
and already have this issues,

but others of you will think 'Ah, that
won't happen to me for quite a long time"

But it can be a sudden thing, that,
you know, you don't necessarily

have a choice to run code
inside your body.

Which OS do you wanna implant?
laughing

E: You wanna tell them about the..
M: This is also a quite exciting

maybe future type of implants
that you can have.

So, this is actually a cardiac sock,
it's 3D-printed and it's making

a rabbit's heart beat outside
the body of the rabbit.

So, there's a lot of technology
and sensors and things that

are going to be implanted ***
and I think more of you

will become cyborgs like me
in the future

E: And there's a lot of work
that you could be doing.

You know, 3D-printing
this devices,

and open sourcing as much
of this as possible.

There's a lot to say here, right?

I think it's time to address
the really scary issue.

The informed consent issue
around patching, right?

Remember earlier we were
talking about the programmers

and we pointed out that there
were firmware blobs in there

and that these people,
you know, your doctor or nurse

could upgrade the code
running on your medical implant.

Now, is there a legal requirement
for them to inform you,

before they alter the code
that's running inside your body?

As far as we can tell

- and we need to look at a lot of
different countries at the same time,

so we gonna ask you to help us -

as far as we can tell there are not
laws requiring your doctor

to tell you that they are upgrading
the firmware in your device.

M: Yeah, think about that laughs

It's a quite scary thing.

I want to know what's happening
to my implant, the code,

if someone wants to alter the code
inside my body, I would like to know

and I would like to make
an informed decision on that

and give my consent
before it happens.

E: You might even choose a device
where that's possible or not possible

because you're making a risk-based
decision and you're an informed consumer

but how do we help people,
who don't wanna understand

software and firmware and upgrades
make those decisions in the future as well.

Alright.
M: So now, if we're going to go through

all this, but there's a lot of reasons
why we're in the situations of having

insecure medical devices.

There's a lot of legacy technology because
there's a long lifetime of this devices

and it takes a long time
to get them on the market.

And they can be patched,
but in some cases

they are not patched or there are
no software updates applied to them.

We don't have any third party
security testing of the devices,

and that's really needed in my opinion.
E: Right, an underwriters laboratory

or consumer laboratory that's there
to check some of these details.

And I don't think that's unreasonable,
right? That sort of approach.

M: And there's a lack of regulations,
also. So there's a lot of things

that should be worked on.

E: So, there's a lot of
ways to solve this

and we're not gonna give you
the answer, because we're not

geniuses, so we're
gonna say that

these are some different
approaches that we see all

playing in a solution space.

So, vendor awareness is
obviously important, but

that's not the only thing.
A lot of the vendors have been

very supportive and
very open to discussion,

of transparency, that needs to
happen more in the future, right?

Security risk monitoring,
I've been working in the field

of cyber insurance, which I'm sure
sounds like insanity to the rest of you,

and it is, there are bad days.
But that could play a part

in this risk *** in the future.

What about medical incidence response,
right? Or medical device forensics.