500.000 recalled pacemakers 2 billion $ stock value loss - The - - PowerPoint PPT Presentation

▶
500 000 recalled pacemakers 2 billion stock value loss
SMART_READER_LITE
LIVE PREVIEW

500.000 recalled pacemakers 2 billion $ stock value loss - The - - PowerPoint PPT Presentation

May 06, 2023 513 likes •1.11k views

500.000 recalled pacemakers 2 billion $ stock value loss - The story behind Tobias Zillner 2/26/19 2 whoami Tobias Zillner, BSc MMSc Lead IT Security Consultant | Co-Founder Expertise: Industrial Security IoT security /

slide-1
SLIDE 1

500.000 recalled pacemakers
 2 billion $ stock value loss


  • The story behind

Tobias Zillner

slide-2
SLIDE 2

2/26/19 2

slide-3
SLIDE 3

whoami

Tobias Zillner, BSc MMSc

Lead IT Security Consultant | Co-Founder

  • Expertise:
  • Industrial Security
  • IoT security / Embedded
  • OSINT
  • Wireless security (SDR)
  • Threat Modeling
  • CISSP, CISA, CEH, OSCP, OSWP, IEC 62443, PRINCE2, COBIT5, ITIL
  • Lecturer at FH St. Pölten, Uni Wien
  • Speaker at international security conferences


“He’s a cool guy. His name is ‘two beers’.” ”Two beers?” “Yes, it’s a german name!” “Ohh! Tobias!”

2/26/19 3

slide-4
SLIDE 4

How it all started

  • Early 2016 a new medical security company

decided to assess pacemakers

  • Goal: Find 0-day vulns in pacemakers
  • 4 vendors assessed
  • Researcher for St. Jude Medical Project

2/26/19 4

slide-5
SLIDE 5

The ecosystem

2/26/19 5

Pacemaker Implanted cardiac device (ICD) Home monitor Programmer Merlin Net Alias “the cloud“

slide-6
SLIDE 6

First attack vector

2/26/19 6

Pacemaker Implanted cardiac device (ICD) Home monitor Programmer Merlin Net Alias “the cloud“

slide-7
SLIDE 7

First attack vector

  • New generation is able to communicate wireless
  • Medical Implant Communication System (MICS)
  • low-power, short-range (2 m)
  • high-data-rate
  • 401–406 MHz (the core band is 402–405 MHz)
  • accepted worldwide for transmitting data


to support the diagnostic or therapeutic
 functions associated with medical implant devices.

  • Software Defined Radio / GNURadio

2/26/19 7

slide-8
SLIDE 8

Information Gathering

  • Interviews
  • Check FCC ID
  • Fccid.io
  • http://www.comsearch.com/articles/emission.pdf
  • Search for other devices from the vendor
  • Google Patent search
  • Product documentation
  • RF chip, Firmware, Software
  • Visual signal inspection
  • Check frequency bands for legal issues
slide-9
SLIDE 9

FCC ID

slide-10
SLIDE 10

FCC ID

slide-11
SLIDE 11

Google patent

slide-12
SLIDE 12
slide-13
SLIDE 13
slide-14
SLIDE 14

Signal to bits

  • Find a signal
  • Isolate the channel
  • Use filters to remove out-of-band interference
  • Detect symbol rate / baud rate
  • Syncronize clock
  • Symbols to bits
  • Encodings: NRZ, NRZI, Manchester, 4b/5b,…
slide-15
SLIDE 15

First vulns identified :D

  • Energy depletion attack
  • Crash attack

2/26/19 15 https://vimeo.com/180593205

slide-16
SLIDE 16

First vulns identified :D

  • Energy depletion attack
  • Crash attack

2/26/19 16 https://vimeo.com/180593205

slide-17
SLIDE 17

We got stuck…

  • Reverse engineering is very time intensive
  • Researcher time is expensive
  • Weak crypto is also hard to crack only with your eyes
  • Decision point
  • 1. We go into cryptoanalysis
  • 2. Look for other attack vectors

2/26/19 17

slide-18
SLIDE 18

We got stuck…

  • Reverse engineering is very time intensive
  • Researcher time is expensive
  • Weak crypto is also hard to crack only with your eyes
  • Decision point
  • 1. We go into cryptoanalysis
  • 2. Look for other attack vectors

2/26/19 18

slide-19
SLIDE 19

What else to attack?

2/26/19 19

Pacemaker Implanted cardiac device (ICD) Home monitor Programmer Merlin Net Alias “the cloud“

slide-20
SLIDE 20

What else to attack?

2/26/19 20

Pacemaker Implanted cardiac device (ICD) Home monitor Programmer Merlin Net Alias “the cloud“

slide-21
SLIDE 21

Merlin@Home

  • Home monitor for patients
  • Transmits health data to doctor
  • Huge comfort benefits for patient
  • Available interfaces
  • RJ11 jack
  • USB interface

2/26/19 21

slide-22
SLIDE 22

A look inside

2/26/19 22

slide-23
SLIDE 23

2/26/19 23

slide-24
SLIDE 24

Hardware hacking ongoing

2/26/19 24

slide-25
SLIDE 25

The hacker‘s perspective

Live Demo

2/26/19 25

slide-26
SLIDE 26

What else to attack?

2/26/19 26

Pacemaker Implanted cardiac device (ICD) Home monitor Programmer Merlin Net Alias “the cloud“

slide-27
SLIDE 27

What else to attack?

2/26/19 27

Pacemaker Implanted cardiac device (ICD) Home monitor Programmer Merlin Net Alias “the cloud“

slide-28
SLIDE 28

What about the programmer?

2/26/19 28

slide-29
SLIDE 29

Removable HDD

2/26/19 29

slide-30
SLIDE 30

The final piece in the puzzle

  • Unencrypted HD
  • Java JAR files :D
  • No obfuscation
  • Reverse engineering of code

2/26/19 30

slide-31
SLIDE 31

Merlin@Home as attack device

  • Emergency shock
  • Disable Tachy
  • Vibrate
  • T-Shock
  • Demo videos released
  • https://vimeo.com/187962970

2/26/19 31

slide-32
SLIDE 32

Which message authentication code (MAC) is used?

  • A. No authentication
  • B. Propriatery (Let‘s build our own „crypto“)
  • C. Hardcoded 24 bit RSA
  • D. 56bit DES
  • E. 1024bit RSA

2/26/19 32

slide-33
SLIDE 33

Which message authentication code (MAC) is used?

  • A. No authentication
  • B. Propriatery (Let‘s build our own „crypto“)
  • C. Hardcoded 24 bit RSA
  • D. 56bit DES
  • E. 1024bit RSA

2/26/19 33

slide-34
SLIDE 34

Other crypto mistakes?

  • A. “homebrewed” cryptographic algorithm
  • B. Hardcoded “Universal Key” as backdoor
  • C. one 32-bit RSA public key for all devices
  • D. Truncate calculated keys because of memory

2/26/19 34

slide-35
SLIDE 35

Other crypto mistakes?

  • A. “homebrewed” cryptographic algorithm
  • B. Hardcoded “Universal Key” as backdoor
  • C. one 32-bit RSA public key for all devices
  • D. Truncate calculated keys because of memory

2/26/19 35

slide-36
SLIDE 36

Technical Summary

  • Critical vulnerabilities with potentially lethal impact discovered
  • Unauthorized user could remotely access a patients implanted cardiac device over

wireless interface

  • Very easy debug access to Merlin@home device using an insecure hardware interface
  • Insecure storage of source code on the home device/programmer
  • Simple replay attacks for battery depletion
  • Reprogramming of the pacemaker using wireless
  • Static keys everywhere

2/26/19 36

slide-37
SLIDE 37

What about security certifications?

2/26/19 37

slide-38
SLIDE 38

The ecosystem

2/26/19 38

Pacemaker Implanted cardiac device (ICD) Home monitor Programmer Merlin Net Alias “the cloud“

slide-39
SLIDE 39

Vulnerability disclosure

What was special?

2/26/19 39

slide-40
SLIDE 40

What was special?

  • MedSec licensed research to Muddy

Waters (Hedge fond)

  • Muddy Waters is an investment company

known for investigating companies, finding problems like accounting fraud, and profiting by shorting the stock of misbehaving companies.

  • Muddy Waters took short position in

St.Jude Medical stock and bought shares from competitors

2/26/19 40

slide-41
SLIDE 41

Muddy Waters published findings report

2/26/19 41

slide-42
SLIDE 42

Muddy Waters published findings report

  • Vulnerability disclosure process?

2/26/19 42

slide-43
SLIDE 43

Muddy Waters published findings report

  • Vulnerability disclosure process?
  • No notification to vendor

"We were worried that they would sweep this under the rug or we would find ourselves in some sort of a hush litigation situation where patients were unaware of the risks they were facing," said Bone, an experienced security researcher and the former head of risk management for Bloomberg LP, the parent of Bloomberg News. "We partnered with Muddy Waters because they have a great history of holding large corporations accountable."

2/26/19 43

slide-44
SLIDE 44

The Impact

  • Stock price fell 12% before

trading being halted the day they went public

  • 2 billion $ value loss
  • 2.000.000.000 $ value loss

2/26/19 44

slide-45
SLIDE 45

Official response

"We have examined the allegations made by Capital and MedSec on August 25, 2016 regarding the safety and security of our pacemakers and defibrillators, and while we would have preferred the opportunity to review a detailed account of the information, based on available information, we conclude that the report is false and misleading. Our top priority is to reassure our patients, caregivers and physicians that our devices are secure and to ensure ongoing access to the proven clinical benefits of remote monitoring. St. Jude Medical stands behind the security and safety of our devices as confirmed by independent third parties and supported through our regulatory submissions."

2/26/19 45

slide-46
SLIDE 46

The Reaction

  • St. Jude disputed vulnerability claims and sued the researches and Muddy Waters

2/26/19 46

slide-47
SLIDE 47

The Reaction

  • In October 2016 an independent 3rd Party verified the

claims

2/26/19 47

slide-48
SLIDE 48

Officiall statements released

2/26/19 48

slide-49
SLIDE 49

2/26/19 49

slide-50
SLIDE 50

FDA - Official statement

The FDA has reviewed information concerning potential cybersecurity vulnerabilities associated with St. Jude Medical's RF- enabled implantable cardiac pacemakers and has confirmed that these vulnerabilities, if exploited, could allow an unauthorized user (i.e. someone other than the patient's physician) to access a patient's device using commercially available equipment. This access could be used to modify programming commands to the implanted pacemaker, which could result in patient harm from rapid battery depletion or administration of inappropriate pacing.

2/26/19 50

slide-51
SLIDE 51

Official security update

2/26/19 51

slide-52
SLIDE 52

The end?

2/26/19 52

slide-53
SLIDE 53

VulnDisclosure - The traditional way

  • Billy Rios & Jonathan Butts
  • Security assessment of Medtronic Pacemakers
  • Disclosed bugs they had discovered in 


Medtronic's software delivery network

  • Discovered a chain of vulnerabilities in Medtronic's infrastructure that an attacker

could exploit to control implanted pacemakers remotely, deliver shocks patients don't need or withhold ones they do, and cause real harm.

  • Medtronic took 10 months to vet the submission, at which point it opted not to

take action to secure the network.

2/26/19 53

slide-54
SLIDE 54

Vendor response

  • "Medtronic has assessed the vulnerabilities per our internal

process," the company wrote in February. "These findings revealed no new potential safety risks based on the existing product security risk

  • assessment. The risks are controlled, and residual risk is acceptable.”
  • "Medtronic deploys a robust, coordinated disclosure process and

takes seriously all potential cybersecurity vulnerabilities in our products and systems. ... In the past, WhiteScope, LLC has identified potential vulnerabilities which we have assessed independently and also issued related notifications, and we are not aware of any additional vulnerabilities they have identified at this time."

2/26/19 54

slide-55
SLIDE 55

Communication issues

"The time period Medtronic spent discussing this with us, if they had just put that time into making a fix they could have solved a lot of these issues," Butts says. "Now we’re two years down the road and there are patients still susceptible to this risk of altering therapy, which means we could do a shock when we wanted to or we could deny shocks from happening. It’s very frustrating."

2/26/19 55

slide-56
SLIDE 56

18 month after initial discloure

  • Still unpatched vulnerabilities
  • Medtronic downplays the findings
  • No firmware signing
  • Plaintext username / password on the devices
  • Some vulnerabilities are even neglected

What is the better way?

2/26/19 56

slide-57
SLIDE 57

Key take aways

  • If it is not secure, it is not safe
  • ISO 27001 certificate is not equal „I am secure“
  • Lot‘s of potential attack vectors
  • New way of monetising vulnerabilities
  • Is it ethical to profit from shorting stock while

dropping 0day?

2/26/19 57

slide-58
SLIDE 58

Everybody needs a hacker!

Alpha Strike Labs GmbH

Mail: tobias.zillner@alphastrike.io Web: www.alphastrike.io Mobile: +43 (0) 664 8829 8290 Fax: You think I have fax?