The Harsh Reality of Slow Movers

☤ TM
Not So Fast!
The Harsh Reality of Slow Movers
Ben Ransford, Ph.D.Virta Laboratories, Inc.ben@virtalabs.com
@secthings 2015

Not So Fast! @secthings 2015 © ben@virtalabs.com
TM
–George Santayana, The Life of Reason vol. 1
“Those who cannot remember the past are
condemned to repeat it.”
2

TM
Outline
• Medical-device security: a cautionary tale

• Lessons for IoT

• Outside-the-box anomaly/malware detection
3

TM
Amazing devices!
4
1957
Photos: Medtronic, Computer History Museum

TM
Amazing devices!
5
Therac-25 (ca. 1980s)
Photo: SIUE

TM
Amazing devices!
6
EFIBRILLATOR (AED)
W
mated external defibrillators
ntessential software-based
ty. The term defibrillator
that use large electrical
that might otherwise lead
e divided into two types:
types of defibrillators treat
adically different in design
lowing analogy: implanted
s external defibrillators are
er are prescribed and tuned
er are available for general
two further classifications
automated. Trained health
external defibrillators to
. Our work analyzes the
efibrillators (AEDs) that a
g may use to treat a more
rdiac arrhythmias such as
Fig. 1. The Cardiac Science G3 Plus exploited to install our custom
firmware. The AED displays DEVICE COMPROMISED.
administered can be 150-300 Joules, which can be administered
multiple times on one battery before the device requires a
External Defibrillator (1985–)
Photo: Steve Hanna et al., “Take Two Software Updates and See Me in the Morning…”, USENIX HealthTech 2011

TM
Amazing devices!
7
Patient monitor
Infusion pump
Photos: Philips, Hospira, The Register/Medtronic
Insulin pump

TM
Amazing devices!
8
2003 
pacemaker
2013 
pacemaker prototype
Photos: Ben Ransford; Medtronic

TM
What Could Go Wrong?
• Increasing software dependence

• Increasing software complexity

• Deeper integration with medical records, hospital
IT, patients’ homes & bodies

• 1980s: 6% of recalls due to software*

• 2005–9: 18% of recalls due to software*
9
* Hanna et al., HealthTech 2011

TM
Amazing harmful devices!
10
Therac-25 (ca. 1980s, recalled 1987)
Photo: SIUE

TM
Amazing open devices!
11
EFIBRILLATOR (AED)
W
mated external defibrillators
ntessential software-based
ty. The term defibrillator
that use large electrical
that might otherwise lead
e divided into two types:
types of defibrillators treat
adically different in design
lowing analogy: implanted
s external defibrillators are
er are prescribed and tuned
er are available for general
two further classifications
automated. Trained health
external defibrillators to
. Our work analyzes the
efibrillators (AEDs) that a
g may use to treat a more
rdiac arrhythmias such as
multiple times on one battery before the device requires a
External Defibrillator (1985–)
Photos: Hanna et al., “Take Two Software Updates and See Me in the Morning…”, USENIX HealthTech 2011
return address is checked, which allows us to redirect progra
flow into arbitrary code.
Fig. 2. AEDUpdate buffer overflow. Executed code includes a message b
showing the potential flow of the vulnerability from the AED (if the firmw
were replaced) to the software.

TM
2008: 😺⇠👜
• Academic study of an
implantable deﬁbrillator
(IEEE S&P ‘08)

• Focused security
community on medical
devices… oopsie!
12
Photos: Medtronic, Ben Ransford

TM
13
• No authentication

• No encryption

• Unauthorized shocks
Photos: Ben Ransford

TM
2009–2011
• Insulin pump &
deﬁbrillator hacks
(Barnaby Jack, J.
Radcliﬀe, others)

• No authentication

• Unauthorized bolus
14
Photo: The Register/Medtronic

TM
Wall Street Journal, June 2013, on a catheterization lab shut down by
malware
“...records show that malware had infected
computer equipment needed for procedures to
open blocked arteries after heart attacks.”
15
2013

TM
2013
• Pharmaceutical
compounder
(HealthTech ’13)

• Must be on network,
patching forbidden
16
Photo: Ben Ransford

TM
17
Photo: Ohemaa's MD
Major hospitals say:
3–5 years: >90% of
medical devices will
be on the network

TM
Lessons for IoT!
18

TM
A RECIPE FOR SUCCESS
19

TM
Don’t Patch the OS
• Microsoft has ﬁgured out Windows security by now

• The Linux kernel is perfect, always works

• “Alternative” OSes won’t be targeted
20

TM
Don’t Patch Libraries
• You wrote all of the device’s code & libraries

• No need to update OpenSSL, PHP, Apache, etc.
21

TM
Use Default Secrets
• Use default passwords whenever possible

• Make passwords diﬃcult to change

• Ship master keys w/ devices

• Hard-code credentials
22

TM
Be Very Liberal in What You Accept
• Download software via insecure channels

• Don’t cryptographically sign software

• It’s probably fine

• Who would tamper with firmware?

• Anyway tampering is illegal
23
II. AUTOMATED EXTERNAL DEFIBRILLATOR (AED)
OVERVIEW
In this section, we introduce automated external defibrillators
and discuss why they represent a quintessential software-based
medical device to investigate security. The term defibrillator
refers to a broad class of devices that use large electrical
shocks to treat cardiac arrhythmias that might otherwise lead
to a fatal outcome. Defibrillators are divided into two types:
implantable or external. While both types of defibrillators treat
cardiac arrhythmias, the devices are radically different in design
and purpose. One could draw the following analogy: implanted
defibrillators are to mobile phones as external defibrillators are
to public phone call boxes. The former are prescribed and tuned
to a particular person whereas the latter are available for general
use when you can find one. There are two further classifications
of external defibrillators: manual or automated. Trained health
care professionals may use manual external defibrillators to
treat a wide range of arrhythmias. Our work analyzes the
second class: automated external defibrillators (AEDs) that a
person with limited medical training may use to treat a more
limited (but common) number of cardiac arrhythmias such as
ventricular fibrillation.
Photo: Steve Hanna et al., “Take Two Software Updates and See Me in the Morning…”, USENIX HealthTech 2011

TM
Obscurity == Security
• Nobody will scan your
devices

• Nobody will obtain your
ﬁrmware via JTAG

• Compilation is the
same as encryption

• Leave a network port
open for “debugging”
24
Photo: Dotmed

TM
25
VOILÀ!

TM
Deep Integration → Fixity
• Once something works,
don’t want to touch it

• Sometimes replacement is
really hard

• Environment changes →
threats change too
26
Major surgery, 
~10yr battery
Photo: Ben Ransford

TM
IoT and Slow Movers
• You want integration + customer dependence?

• All bets are oﬀ once a Thing is deployed

• Customers will depend on your old/stale code

• Customers will depend on your old URLs

• You think you know how customers will use your
product, but you don’t

• Optimize products & processes for patchability
27

TM
The Mess We’re In
• Major healthcare breaches afoot (Anthem: 80M!)

• Attackers roost on systems that won’t get
patched (TrapX “Medjack” report)

• Backward thinking about patching

• Perimeter security is not a solution

• “Endpoint security” vendors ignore medical
devices (as they ignore Things)
28

TM
29

TM
Outside the Box
• Nonintrusive monitoring

• No software installation

• Devices stay in service

• Use the power side
channel to infer tasks,
detect unusual behavior
incl. malware
30
(In beta!)
Photo: Ben Ransford/Virta Labs

TM
31
Photo: Atomic Toasters

TM
32

TM
Current Consumption Varies
• Today’s CPUs and software are careful to use
power management!

• Modern systems exhibit high dynamic range

• Workloads ➞ patterns of high/low

• CPU busy ➞ more current

• Peripherals busy ➞ more current

• Idle time ➞ less current
33
Image: Apple

TM
Learning from Analog Data
• Collect data during representative activity

• Constantly collect power signals

• Featurize signals, feed features to machine learning

• Feed analysis results back to customers

• Crowdsource problems across customers
34

TM
Q’s We Can A
• What state is the device in? Have we seen this
state before?

• Does the device have certain kinds of malware?

• How fast is it doing its work?
35

TM
36
VIRTA LABORATORIES
UNKNOWN MALWARE

TM
Takeaways
• For IoT manufacturers: Recognize security debt,
plan for long lifecycle
• For users: Insist on coherent patching strategies
that have a time dimension

• For security researchers: Roll up sleeves 
 
 
Twitter: @virtalabs / @br_ 
Beta program: https://www.virtalabs.com/
37

The Harsh Reality of Slow Movers

Recommended

Recommended

More Related Content

What's hot

What's hot (18)

Similar to The Harsh Reality of Slow Movers

Similar to The Harsh Reality of Slow Movers (20)

Recently uploaded

Recently uploaded (20)

The Harsh Reality of Slow Movers