Medical Device Security
Talkat AppSec California 2015 · on Tuesday, 2015-01-27· at 11:00· Annenberg Community Beach House: Track 4, 415 Pacific Coast Hwy·
summary
Three years of research shows hundreds of medical devices and thousands of healthcare systems exposed to direct attack vectors, with scans via Shodan revealing SMB shares and 68,000 internal hosts at one org and pivotable XP boxes vulnerable to MS08-067. Findings include hardcoded credentials (one UI uses 1 2 3 4), open PACS image stores, infusion pump and defibrillator XML configs that accept forged drug libraries, the ability to clear logs, and a patient using a PCA module service credential to self overdose; Epic servers and EMR endpoints also surface.
AI-written summary · about
chapters (31)
- 0:00Intro
- 1:10Who is Scott
- 1:53Why Medical Device Security
- 3:36Device Specific Issues
- 5:35Disclosure Process
- 6:09SMB Issues
- 7:33Medical Devices
- 21:04Negative Alley
- 22:42Asian Viruses
- 25:18Patient Controlled Administration
- 27:25Whats the greatest risk
- 28:58Use case
- 29:15Story time
- 30:07Why are they scared
- 30:37Regulatory requirements
- 32:59Online software clubs
- 33:41Case study
- 35:16Wireless and Bluetooth
- 37:25Config parameters
- 39:08CVS
- 42:11European legislation
- 42:36FDA working groups
- 44:42ITripleE
- 45:46Bluetooth LE
- 46:52Bionic pancreas
- 49:42Data integrity issues
- 52:27Software updates
- 54:02Passwords
- 55:22Pain Industry Groups
- 56:12FDA Regulation
- 57:42FDA Guidance
related talks
01h 01m(In)Security of Medical Devices
19mSecurity in the Medical Internet of Things
58mBreaking Bad: Stealing Patient Data Through Medical Devices
52mInformation Sharing to Mitigate Emerging Vulnerabilities
22mRIS-ky Business: Exploiting Medical Information Systems
37mMillions of Patient Records at Risk: The Perils of Legacy Protocols
51mSecuring Medical Devices—When Cyber Really Is a Life and Death Issue
26mHacking buildings: Security flaws in embedded building control systems