BIO HACKING VILLAGE - PWN to Own My Heart
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Vee
The increase of pace in the technology field has left the race for manufacturers to increase the security in medical devices. There is the theoretically possibility that your heart can be pwned. Pacemakers have become part of the internet of things. We are putting our hearts on display. This is my journey from regular hacker to gen-one cyborg to pwning my own heart that I can own the vulnerabilities to fix it. We forget that these are devices connected to flesh and blood, a person who depends on this device to have just one more heart beat. This is a journey into the inner sanctum of living with a vulnerable device in a time where technology progression has left behind security. We can no longer have security by obscurity when it comes to devices which cyborg’s like me depend on.We should not be in the business of sacrificing security for convenience or power. As a patient, I would rather sleep knowing my device has been hardened and have the inconvenience of replacing it more regularly than the converse. I feel that we, as the security community, should be addressing and assisting medical manufacturers with the security vulnerabilities in the devices that literally keep people alive. There should be more effort placed on addressing the security vulnerabilities. The simple fact is we are not dealing with just ones and zeroes. This is, for some, a life or death situation.
 Hey everyone, so I'm V, I'm Poison Pixie, and I'm here to talk to you guys about that little device up there that's implanted in my chest. So, one big, I think it's 2012, I read an article by Barnaby Jack, and by then I've had my pacemaker for a good couple of years, and realizing, oh my god, this is a fucking disaster. But being who I am, I find this my motto in life. My aim is to raise awareness of these potential malicious attacks and encourage manufacturers to act to review the security of their code, and not just the traditional safety mechanisms of these devices. This is something that I take with me every day. You'll see at the end there is a little puzzle for you guys to solve that I have a saying, beautifully broken, wonderfully flawed, because that's who I am. My heart is effectively broken in so many ways, and my device is flawed, but I still find the beauty in the science that keeps me here every day something worthwhile. For me, we're moving into an age where human beings in the traditional sense of being flesh and blood will no longer exist. I, in the traditional sense, am no longer human. The most major part that keeps me alive is bionic, mechanical, and technology. And that is the science of heartbreak. That is the science of me and who I am. I refer to myself as a genuine cyborg, a non-human hacker, half technology, half flesh and blood. I passionately live through every beat that my pacemaker gives me, even though it traditionally sometimes does fuck it up. We all know how technology is. It's built by humans. It's not built by machines yet, and it does break. I believe that we as a community need to break things to make them better, because how do we know that a perimeter can be breached? We first have to break in. We cannot anticipate what needs to be fixed unless we know how to break them. This is a brief history. In 1958, the first pacemaker was implanted. That is very long ago. I was not born yet. So this technology has been around for years. Basically, everyone should know what a pacemaker is. It is a little device that listens to your heartbeats and acts as a way, a mechanism to keep your heart beating when your natural pacemaker fails. Last one was the first one to receive this device. At that stage, there was no network connectivity. Today, we find pacemakers that have wireless connectivity that connects to a program and next to a patient's bed, across wireless, that a doctor can interrogate and make changes on a regular basis, sitting across the world, because apparently, according to the manufacturers, that was an excellent idea. I did some research because I thought to myself, I believe we can do better. But how do we know we can do better unless we know what has gone wrong? From 1985 to 1987, six patients received harmful radiation from their pacemaker. So it starts very slow. In 2002, a network was flooded and cardiac patients could not receive critical changes to their devices because the hospital was unable to facilitate these changes. In the 2000s, we started seeing recalls on ICD defibrillators. Now, here's the scary thing with an ICD. Your heart muscle is, in my opinion, your most sensitive organ. If it is over-shocked or overstimulated, it simply dies. There's no way to regenerate it at all. So I have an ICD implanted that acts as a pacemaker. So I'll get to a little later where I did some research on the FDA and how they passed my device and the flaws that they passed within my device. 2006, we saw software updates released for pacemakers, especially when attacks started being facilitated on these devices. And that carries on to 2008, where we started seeing the vulnerabilities being exposed by the likes of Bonobie, Jack and other researchers. 2008, one of the biggest medical manufacturers, Metronik, was taken to the Supreme Court for flaws within their devices. 2011, I think it was at DEF CON when J. Radcliffe displayed how you can hack an incident thumb. And it just carries on. And this is where my journey started in 2012, where I decided that I no longer want to trust what the medical practitioners told me. I want to know how my device works. Now, someone like me that has a device, I have been told that the device is not my own. It belongs to the medical manufacturer. We use the kicker. They might have that user agreement with my doctor. They don't have that legally with me. I feel that my device, if it is there to keep me alive, I should have the right to test it. I should have the right to know how it works. I should not have security through obscurity. I think they should be more open and let security practitioners know how their devices work. And if anyone has ever dealt with medical companies, they will realize that some of them are pure bullies. They are souls. As much as they are awesome in designing innovation, innovation is what they focus on. They don't focus on security. We just want the next new big thing. But I say if we want to be innovative, we should be secure. I'm not saying lock the device down. There is a very fine balance towards having a device that is accessible and secure, having information available to medical practitioners at the touch of a dial. But we don't have to open it for bad people. And it's not necessarily to say that it will be a hacker that will attack a device. If I ask anyone in the audience, who is a murderer? Anyone that can stab someone has now got the ability to access these devices wirelessly and facilitate the attack. We can now have murder from a distance and no longer just from far away. For me, what is important is ensuring the security of these devices for the future. Because if I ask you, for example, what do you think would happen if the first basemaker gets hacked? Do you think someone else would get another device? No. So we go back ten years. That is not the aim. The aim is to fix this going forward, that we are in a position to keep innovation going. Now I'm going to share something very personal. And it's something that I've never shared in public, is how I was diagnosed and what led me on this path of getting my pacemaker. At 19, I was admitted with heart failure. My conductive system simply does not work. And I had to get a pacemaker. Now inside Africa you have medical aid. Our medical aid declined to pay for my pacemaker. Meaning that effectively, according to medical personnel, I had two weeks left to live at the age of 19. I prepared myself to go home because I refused to die in a medical environment. I wanted to be surrounded by my mom, my dad, my brother, my family, my people. And on the way out, my doctor stopped me and said, you know what, you're going in for surgery. I've paid for your pacemaker. So I'm here today doing what I'm doing because I got a second chance. I got a device that has saved my life from the age of 19, has given me two amazing little girls that I would never have had. But I have concerns about my device. In January, I was admitted again because I got a new pacemaker two years ago. And my pacemaker failed. It did not resuscitate me. And I spent eight minutes clinically dead. And I show, here's the kicker, after the device was tested by three technologists from the medical company stating that there's no errors on the device. It still failed. And no one can tell you why. This is a little poem that the medical practitioners use to explain what a third degree heart block is. If the R is far from P, then you have a first degree, longer, longer drop than you have a waken buck. If some P's don't get through, then you have mobids too. If P's and Q's don't agree, then you have third degree. Basically means my heart cannot pump on its own. It is unable to relay communication for it to contract together. So it flatlines. Now, my device that I have has been passed by the FDA. Now, who here knows what a pre-market assessment is? What that means is that one clinical trial with a small amount of people are done to test whether this device works. In the United States, we have more stringent and strict tests for drug FDA posts than we do for medical devices, which for me is a bit of a problem. Because if you take the wrong medication, that can be reversed. If you receive a shot from an ICD, which is higher than what it should be, you die. We have a whole idea of how these devices are passed. Absolutely confused. And I think that the FDA should start stepping up, start fixing legacy shut, and just do what's right. And here is something that I did with my cardiologist before I came to DEF CON. He's got one of the biggest brands in South Africa that he supports. I cannot name their name. I have been told not to say any manufacturer's names. While I was under racing, so how it works is I go in every six months. I lie down and my heart gets stopped and stopped at a very degree to test my device. I took a rubber ducky and I placed it behind the programmer with permission from my cardiologist. And I managed to capture everything that he changed along with all my PII information. What was wrong? What events were noted for the last six months? Now, it wasn't just for mine. It was everything that has been stored on that device. And that's where the problem comes in. We've got these phenomenal programmers running XP, having USBs activated, hard-coded credentials, no encryption, no command white listing. It's just badly built. It's not that it's just unsecure. It's that the fundamentals and basics of secure development has not been a dear to me. I fight a battle at the moment where I don't have a cardiologist no more. The medical company that owns my device or manufactured my device has effectively put so much pressure on my medical staff that they can no longer help me with any of my research. So I am without a doctor. I'm without support fighting a battle that is pretty much on my own. Until I found a small group of people that let me here today. I don't know, does everyone know who I am? The cavalry is? They're pretty awesome. This one is important. We need to be able to verify the software that we use with any devices. Because most of my problems that I had in January was due to machine learning failing and software bugs. And would you believe that when asking the medical manufacturer to see the code to review what is keeping my heart rate going, I was declined access to this code because it's proprietary. So they are practicing security through obscurity. So I have to trust a big corporate that what they are saying is good, effectively is what is going to keep me alive. This is what the FDA has passed on my specific device and they have said that these are acceptable risks. My electrical component has failed in January and causing me to flat line. It does not connect with the programmer who will not always retain its settings. It will reset to default. I have actually experienced this. I took the chance to go into the wireless village because I like living dangerously. And needless to say, within about half an hour I started feeling ill. And just because we need to be scientifically correct, we replicated it for a second time. So if anyone has got a pacemaker, stay clear of the wireless village. There is way too much signal going about. But these are devices that should not be that sensitive to signals going on outside the body because technology is signal driven. It is simply not there to be that sensitive. I am convinced these medical companies are building snowflake devices because I think my device has got more emotion than I do. This is what my device costs and this is excluding the leads. So I have a little battery running my programs, running my software with two leads. And when they need to be replaced, it is not simply like popping out, open my skin with a little tag. They cut me open. They take up the whole device hoping not to rip up the leads connected to my heart. So you can see that when a device is recalled, it is a bit of a fuck up. You have to go into a hospital and have surgery. For example, since Jude fixed their problem, however the legacy devices are unable to be, from where we update it, those patients will need to have new devices implanted. They will need to have surgery because the manufacturer fucked up. This is just to explain exactly how the FDA passes their information. So one day I decided to sit outside the doctor's offices with a backpack and a hoodie because that is what we wear. That is what I wear every day. I have a black boxed. I just listened and I learned. What do you guys think I picked up? Anyone? I managed to capture communication between the programmer and the pacemaker, meaning I could potentially replicate a man in the middle attack. Sitting outside my doctor's offices, just listening, looking like any normal patient. Again, this is all done with permission from my cardiologist who at that time was very supportive. This is one of the attacks that we theoretically formulated because if you ask any heart association, they will say no patient has been hacked that we know of. It's that we know of situation that worries me is because we don't check, we think it's theoretical. Why is it not showing? I'm going to have to read a bit of technical difficulty over the slides. If you take a pacemaker and you start adjusting the way that it paces, you can take a heart rate up from 60 to 160, meaning that your heart will be exhausted and your battery will be depleted. The standard pacemaker battery will last 10 to 12 years. You will be able with a crash attack theoretically to take that down to about three years, which the patient will be unaware of because effectively he would think it would take 12 years. A denial of life attack is one that has been done successfully where if you send RF signals to a pacemaker at a sequential rate, it will count one, two, up until nine. And who can guess what happens then? What would be good security? That it cuts it off, it just starts counting at one again. That is not how it should be because how do we drain battery life on RF devices? We keep on attacking it. RF signals that I am aware of, the distance from is 50 feet is the furthest that I am aware of. That is pretty far. That means I don't have to stand next to you. I wonder what went wrong with the slides. Anyway, the replay attack basically means that I'm going to replicate whatever your doctor has changed. I've listened, I've reverse engineered these packets, and I'm going to replicate what he's done to authenticate to your device. Once you've authenticated to that device, it's got no white listed commands. It'll effectively open up like a fresh fruit and accept any code that you give it. One of the things that I discussed with friends of mine at university that I was at was you could potentially authenticate to a device which is universal across the world. Upload new firmware. This firmware can update and authenticate to other devices, effectively creating a worm that self-replicates. Those are things that we should be looking at and being aware of. These are some changes that have been found by researchers that you can do within a pacemaker. Identification of a device. As with anything, you don't want too much information to be beaconed out. From studies and work that we've done, these devices will give you their serial number, patient information. It will disclose your cardiac data, which is something I don't want out there, because it's the most personal thing of mine. You will be able to change the clock on your ICD, which is fundamentally an important element in ensuring when the device was implanted to estimate when the device will run out. You can change the therapies. Again, this is what happened to me in January when my device decided that it would be able to learn on its own. I had a software issue. My device thought that when my heart rate fell to 30, it was acceptable. That ended up in its missing, my heart flatlining. That is just like the tip of the iceberg. Here's the interesting thing. I was preparing for my slides and every medical manufacturer said malware is not a problem. At Black Hat, they actually managed to put malware on an ICD programmer. Meaning if I go into the offices with a device that has been compromised, potentially without knowing I can have malware on my ICD. That would mean that it could infect other ICDs. It could mean that it could kill me. I think the one thing that we forget about these medical devices is they are connected to human beings. They might be security devices, electronic of nature, ones and zeros. But there's a human life that is at stake. This might seem a little bit dark, but what would you rather pay for if your pacemaker's ransomed? Your information or your life, your organs, obviously, it's a good business plan, ransoming medical devices. Not that I say you should do it, but I mean people are going to pay for their organs. This is real organized crime situations where we're seeing that it's a monetary situation. If you infect a programmer with ransomware, for example, that reinfects other devices, you have the potential to constantly have revenue. This is not something that should be possible. This is something that should be addressed with reserved memory space within these devices. My device is AES enabled. How many of you think that that is exactly what they use? Anyone? They don't. It's available, but it's not being used. I got a statement from a medical company saying, you are coming to DEF CON and you have a pacemaker. You are going to die. I'm like, well, I think I've got a bigger chance sitting across from you being killed than I do being with the community. Because it's the community that's going to help me fix the problems that you've created. I think that if we start interrogating these devices and being less worried about, oh my God, we're talking about killing people? Well, yes, we need to start talking about saving people rather than killing people. I want to explain this to you because this is something, it's almost a show box moment. When I started talking to the FDA, they said, but we've got pre-market assessment. What that means is they go through documentation of a device saying, okay, this is what the device claims it does. And it's a check box exercise. And that is all it is. They try and design these innovative new phenomenal devices that don't even get the fundamental basics right. And you have a patient that could potentially die because the device is bald poorly. I was able to go on to all of the manufacturer's websites and download in excess of about a thousand technical user manuals, meaningful medical practitioners. I could fool them and state that I'm in the United States when I was sitting in South Africa. None of these websites had user authentication. They don't know if I was a doctor or not. But I had access to how these devices were bought. I know exactly what controller it's got, what board it's got implanted, and what memory it has. What do you think I can do with that information when I start reverse engineering it? Because then I can start knowing how these devices work. And that is exactly what I did with my own device. And we were shocked to find that this device has actually got a wireless controller in. Even after I stated when they put this in two years ago, I did not want it. But that is what was available because having a programmer next to your bed that communicates with your device with no username and password seems like an excellent idea. I want to... This is something that's very close to my heart. These people are really working their asses off with the companies. And as I've said, the companies are not nice people. The legal teams, they scare me. Not a lot scare me. Those legal guys scare me. But I am the cavalry needs more researchers. They need people in the device labs interrogating the infusion pumps, the pacemakers, the programmers, and hacking the shit out of these devices. Then we can start shaking up the room and saying these devices are surely fucking unsecure. I want a future where we can say that we not only have innovation, we have security, availability, and accessibility to devices that are working. This lady has been instrumental in supporting me in doing the work that I like to do, getting me in connection with the right people. And this is the reality. I am like her, one of two people having our condition in security, being connected to the wonderful DEF CON internet and IoT and being fucking unprotected. I have never felt vulnerable the way I did two days before DEF CON, realizing that my device was passed by someone that I trust and stating that the vulnerabilities that they have associated with it is acceptable. It is not acceptable to flat line and have to be resuscitated for eight minutes when I have a device I paid for, a fuckload of money, and it doesn't work. That doesn't mean I'm going to get hacked, but surely enough, we just need one skiddy to decide it's a fucking good idea to go toy with these things, write a program, accesses the devices and not realize what they've done. We have situations where researchers at the point of being bullied. Big farmer does not want to play nice, and there is one way to solve that. It's for the community to basically step up and say, enough is enough. Whoever solves that, I will buy a beer form. You guys can run it. If it doesn't work, I was drunk when I wrote it. But I really want to motivate you guys to get involved with I Am The Cavalry. It doesn't even have to be hacking. It's just looking at better ways to get protocols in place for companies to start fixing the stuff. Having support from the community is important, because I can tell you I can access my device through multiple ways and means. I was very shocked to find that no encryption was used. Now I understand, look, I'm going to say, I understand physically I cannot be dying on the floor having a heart attack or having an issue and go to the doctor and say, let me give you my username and password. It's not going to work, but there has to be some balance. At the moment, there is none. So who's going to go to the device lab or who's going to go to I Am The Cavalry? I want to see everyone there, because we need the community to start taking up the research again and start getting shit done. Because the future is coming, we're going to have our first malware. Or we could have had it already, because if you start asking medical companies, what's your incident response plan? Do you check someone that's passed away from a pacemaker? Do you know why they died? No, it's natural causes. They've had a heart problem. Well, how do you know the pacemaker did not fail? They don't do checks and balances. For me, that is a fundamental problem. And I am tired of dealing with the shit alone. I am tired of being bullied. And I want the community to start stepping up. And I want the youngsters, the future, because I'm not the future, I'm old, to start stepping up and doing things. So thank you for your time. Any questions? Yeah. You talked about trying to get these devices fixed by contacting manufacturers and whatnot, but it seems like that it's such a struggle to have work put out. I was wondering what you think about somebody who you try to actually put together a big device like a new company and what kind of entry barriers they would have to face to actually go and put like a market solution that actually has security measures in that way? I can tell you. Can you read the question? I'm sorry to ask you to do that. I wanted to ask what you think about market solutions that would involve security measures that are marketed this way so that the consumer knows they're getting a device and what kind of entry barriers like a new company would have to face to be able to get this on the market and actually be able to kind of solve these problems without having to deal with the current manufacturers of these devices. Thank you. I think if we had a new kid on the block that is able to offer a secure and transparent solution to patients, I wouldn't mind an open source device. Not that I'm saying I would like to program it myself because God, I'm an awful programmer, but I would like to know what the code is doing. I would like to be able to read and understand it because, for example, machine learning is an excellent idea in many applications, but not in a situation where your heartbeat does certain specific things. The doctor knows what it's supposed to do. So I think if a new company can come on board and start doing secure devices and they focus a little bit more on security, I would go get that device every five years. I would have the surgery because I would sleep better. And just on another note, I want to say thank you to the SOC Boons that made time to come visit. Thank you, guys. They've been working hard, so by them it would be a later today. But seriously, we need to build secure medical devices. These aren't little devices that just do something. They keep someone alive. And it's not just about me. It's about, I think there's about 2.2 million people with pacemakers or ICDs or brain implants or any medical device. That could be genocide when we have a Stuxnet situation on our hands. I hope this question isn't too much of a sidetrack, but you've mentioned Barnaby Jack a couple of times who died under somewhat mysterious circumstances shortly before giving a talk about hacking these implanted devices at Black Hat. Do you know of any information sources about any investigations around this death or anything? Or is there anything you would comment on about what you've heard about it? I don't have any information. I would love to have more information. I was not lucky enough to have known him. Heaven alone knows, if I could reanimate someone, that would be probably the one person I would reanimate to have a conversation with. Because that man had a big set of walls. He took on a big manufacturer. That's not a small task. I have had this much in the couple of years that I've done. And the friends that know me very well have heard me cry. And I don't cry often because I don't have feelings. I don't have a heart that works. I've got a metal heart. But frustration has been there. I wish I could tell you what's happened. I don't know. And I don't think there's enough evidence for me to hypothesize about it. And I think it would be disrespectful for me because the man was a legend. It was a very sad thing to happen to the community. And I think it was, this research would have gone much further if that did not happen. So just a quick side note on that. The WikiPia page says that he died of a mixed chemical overdose in the week before giving this discussion. Which seems of this covenant circumstance for a respected speaker to... I don't know. I don't have the answer to you. I filed for it in the training of information. It says multiple drug intoxication, which is new to the man, was not heart-to-heart. Who knows what happened. I think you guys should all have a beer afterwards and discuss it because we're getting sidetracked. And this is not a conversation, I think. Okay, I have to respect you so you can have the stage. The whole thing brought up, they don't seem like tough ones. I'm wondering if it's just more public. If there's a big list of murderers, could it be, we don't even say, hey, this is just people's opposition and corruption. We don't check. I really miss this stuff. But that's exactly what Barnaby said. It is fundamentally small things that if you start thinking the way that malicious attackers will think, it's easy. So where's the list? Can you first list of those murderers? I can. And then you can. I'm happy to start a formal place. I will do that for you guys. Find me on Twitter at poisonpixie. If you want to know the story behind my nickname, you can come and ask me. But I don't have any information for you guys, unfortunately. So it's kind of related at that point. One of the talks the other day was from the FD, or had a representative of the FDA, who I think was here personally, but still knew what was going on. And she stated that there are cybersecurity regulations in FDA. So I was just kind of curious what's going on. If those exist, are they just not sufficient or that being followed? They do exist. I actually have met with the FDA representative. We will be having more conversations about that. I have a bit of a difference of opinion because a lot of the things are acceptable and acceptable risks. And I'm saying, fuck that. It's not. I cannot explain to you guys lying in bed and ICU. Well, ICU is fine because I'm used to it. I get to scan all some devices lying in bed. They are very used to me where I'm from having multiple computers going while being hooked up to monitors. But feeling the sense of dread, I've never felt that sad. And I'm not supposed to have that feeling when your heart rate heats about 30 and your blood pressure is 40 over 30. And the doctor taps you on the head, obviously I've got you. And you're thinking, what the fuck is about to happen? Because my ICD is supposed to now start doing its thing. And it just switched itself off. It went to default. And at the side of all, I'm not going to do anything. The FDA is trying to fix things, but it's legacy devices. Anyone in IT in the hacking and security knows legacy devices fucks us over. Okay. They difficult to fix. And this is not something that I can go pull off a shelf. This is physically something that's implanted into someone. When you implant cardiac elites, they grow into the rod. If you pull those out, not carefully, you can kill someone that auto can burst. So it is very difficult for the companies to fix these legacy devices. I don't want to come see me after because I'm not quite willing to make the statement publicly yet. But I'll tell you what they told me. Thank you. Thank you very much for the personal sharing of your story. You were in a situation where it was very short time between the decision of having a pacemaker and actually having an employment. What are your concerns about how the general public, people who wear the decision about taking a pacemaker, maybe influence on the way that we as a community of IT specialists is actually influencing the general public into taking another pacemaker because they are afraid. That is what scares me about the future because I'm seeing more and more patients become aware after the recall for St. Jude's, which got a lot of press. And that's sad to me because I have the opportunity to be here today because I got a pacemaker. So that is where my saying beautifully broken wonderfully flawed comes from because yes, the devices are flawed, but we also can't expect miracles. They are built by humans. Humans are flawed by nature. All that we can do is learn to go forward and learn together. There has to be a bridging done and that is what I think I am the Calvary is doing so successfully. They are bridging manufacturers with researchers. They have included the EFF in that as well. They are bringing everything full circle, but it scares me for the future knowing that people might decide not to get devices and pass away, which would be, fuck, being a sidewalk is awesome. I mean, you know, to be sad, I got my second implant, so I'm taking it further now. But I mean, biohacking is a real thing. We as humans will evolve. I mean, why not use technology that's there to keep us a lot longer? It seems stupid, but I can understand someone being concerned about the security of the device. I am as well. Luckily, I'm not a high level target. So, you know, I'm not Dick Cheney. Do you guys know Slash has got a pacemaker? I'm part of the cool kids, eh? He's actually got a pacemaker. There's lots of influential people that have these devices and they're awesome. If you think about it, what it does is it's amazing. It can take over the beat of the human heart. It keeps me yet. It enables me to wake up tomorrow morning and survive another day. I mean, time for me is precious because at 19, I got given two weeks. I cannot describe it to you guys. It is the worst feeling in your world thinking, God, I should have had that for breakfast rather. I should have seen guns and roses live. You should have seen Metallica. Luckily for me, after my pacemaker, I got to see Metallica twice. You see, I'm making up for lost time, but there are people that will not get these devices. I know one person that's refusing to get it because they are afraid of being hacked. And that's sad because I would like to say to them, your device is not as flawed as you think, but that would be lying and untruthful. I am carrying the flaws with me. I'd rather have a flawed device than no device because I can still make a difference. But if I'm dead, I cannot do the same. So that's what I'm saying is we need everyone to step up and do this together. This is not a me thing. It's an us thing. It's a tribe thing. It's a coming together of great minds because I think forensically. You might think some different way or someone might think offensive, defensive. We need to bring that full circle. I think that's what we lacking in the security will be segregating from each other. We actually want family doing the same thing with different skills. But I think that coming together is at events like this, facilitating it with the different villages. So yeah, that's all from my side. Yeah, please do. They're recording. I got maybe the very strange question to program the pacemake that can be 10 meters powerful or can be 30 centimeters. It depends what kind of system that I'm more afraid for a PMG attacks than a malware that somebody use electronic pulse and everything stopping in the 10 meters. I'm more afraid for those things that malware personally. That is one of the fears because I actually read my device is technical manual and went, holy fuck, this was a bad decision. Because it's cold, it's electromagnetic field. It's all those kind of things. So when I go to this is a funny story. So I'm a very nice person, right? You guys think I'm friendly and the sock goes on to the answer because I've been hassling them. But I'm a nice person apparently coming to death, come presenting the talk that I do. I get a freedom fondle at every point. I generally do though, because I can't go through the magnetic, the metal detectors, because effectively that magnetic field switches my pacemaker off. So these are still divide. These are little things that they haven't fixed yet. And that I have experienced. It's not fun. If you have a pacemaker, don't do it. Because I did. I said, let's see what happens. Because I like to live dangerously. I need to know what happens when I go through a metal detector. Don't do it. Trust me, it sucks. So the thing is if you read these technical manuals and go on to any of the website, we had a great chuckle about it. We actually checked the other certificates. What else? Everything. The security sucks. So if I can't get that right, I'm a little bit worried about them doing my device to be quite blunt about it. But you can get the technical manuals and then the precautions in there. I can try to tell you my doctor can tell me about them. He just said, don't go through a metal detector. Well, how do you do when I fly this cosmic radiation internationally? That has an effect on how my device is programmed as well. So effectively after every international travel, I have to go to my doctor, pay a lot of money and have my device reprogrammed. Small things we can fix. But it's labor intensive and time intensive. Yeah, that's all. Anyone else? Is it that bad?
 Hey everyone, so I'm V, I'm Poison Pixie, and I'm here to talk to you guys about that little device up there that's implanted in my chest.  So, one big, I think it's 2012, I read an article by Barnaby Jack, and by then I've had my pacemaker for a good couple of years,  and realizing, oh my god, this is a fucking disaster. But being who I am, I find this my motto in life.  My aim is to raise awareness of these potential malicious attacks and encourage manufacturers to act to review the security of their code,  and not just the traditional safety mechanisms of these devices. This is something that I take with me every day.  You'll see at the end there is a little puzzle for you guys to solve that I have a saying, beautifully broken, wonderfully flawed,  because that's who I am. My heart is effectively broken in so many ways, and my device is flawed,  but I still find the beauty in the science that keeps me here every day something worthwhile.  For me, we're moving into an age where human beings in the traditional sense of being flesh and blood will no longer exist.  I, in the traditional sense, am no longer human. The most major part that keeps me alive is bionic, mechanical, and technology.  And that is the science of heartbreak. That is the science of me and who I am.  I refer to myself as a genuine cyborg, a non-human hacker, half technology, half flesh and blood.  I passionately live through every beat that my pacemaker gives me, even though it traditionally sometimes does fuck it up.  We all know how technology is. It's built by humans. It's not built by machines yet, and it does break.  I believe that we as a community need to break things to make them better, because how do we know that a perimeter can be breached?  We first have to break in. We cannot anticipate what needs to be fixed unless we know how to break them.  This is a brief history. In 1958, the first pacemaker was implanted.  That is very long ago. I was not born yet. So this technology has been around for years.  Basically, everyone should know what a pacemaker is.  It is a little device that listens to your heartbeats and acts as a way, a mechanism to keep your heart beating when your natural pacemaker fails.  Last one was the first one to receive this device. At that stage, there was no network connectivity.  Today, we find pacemakers that have wireless connectivity that connects to a program and next to a patient's bed, across wireless,  that a doctor can interrogate and make changes on a regular basis, sitting across the world,  because apparently, according to the manufacturers, that was an excellent idea.  I did some research because I thought to myself, I believe we can do better.  But how do we know we can do better unless we know what has gone wrong?  From 1985 to 1987, six patients received harmful radiation from their pacemaker.  So it starts very slow. In 2002, a network was flooded and cardiac patients could not receive critical changes to their devices  because the hospital was unable to facilitate these changes.  In the 2000s, we started seeing recalls on ICD defibrillators.  Now, here's the scary thing with an ICD. Your heart muscle is, in my opinion, your most sensitive organ.  If it is over-shocked or overstimulated, it simply dies. There's no way to regenerate it at all.  So I have an ICD implanted that acts as a pacemaker.  So I'll get to a little later where I did some research on the FDA and how they passed my device  and the flaws that they passed within my device.  2006, we saw software updates released for pacemakers, especially when attacks started being facilitated on these devices.  And that carries on to 2008, where we started seeing the vulnerabilities being exposed by the likes of Bonobie, Jack and other researchers.  2008, one of the biggest medical manufacturers, Metronik, was taken to the Supreme Court for flaws within their devices.  2011, I think it was at DEF CON when J. Radcliffe displayed how you can hack an incident thumb.  And it just carries on.  And this is where my journey started in 2012, where I decided that I no longer want to trust what the medical practitioners told me.  I want to know how my device works.  Now, someone like me that has a device, I have been told that the device is not my own.  It belongs to the medical manufacturer.  We use the kicker. They might have that user agreement with my doctor. They don't have that legally with me.  I feel that my device, if it is there to keep me alive, I should have the right to test it.  I should have the right to know how it works. I should not have security through obscurity.  I think they should be more open and let security practitioners know how their devices work.  And if anyone has ever dealt with medical companies, they will realize that some of them are pure bullies. They are souls.  As much as they are awesome in designing innovation, innovation is what they focus on.  They don't focus on security. We just want the next new big thing.  But I say if we want to be innovative, we should be secure.  I'm not saying lock the device down. There is a very fine balance towards having a device that is accessible and secure,  having information available to medical practitioners at the touch of a dial.  But we don't have to open it for bad people. And it's not necessarily to say that it will be a hacker that will attack a device.  If I ask anyone in the audience, who is a murderer? Anyone that can stab someone has now got the ability to access these devices wirelessly  and facilitate the attack. We can now have murder from a distance and no longer just from far away.  For me, what is important is ensuring the security of these devices for the future.  Because if I ask you, for example, what do you think would happen if the first basemaker gets hacked?  Do you think someone else would get another device? No.  So we go back ten years. That is not the aim.  The aim is to fix this going forward, that we are in a position to keep innovation going.  Now I'm going to share something very personal. And it's something that I've never shared in public,  is how I was diagnosed and what led me on this path of getting my pacemaker.  At 19, I was admitted with heart failure. My conductive system simply does not work.  And I had to get a pacemaker. Now inside Africa you have medical aid.  Our medical aid declined to pay for my pacemaker.  Meaning that effectively, according to medical personnel, I had two weeks left to live at the age of 19.  I prepared myself to go home because I refused to die in a medical environment.  I wanted to be surrounded by my mom, my dad, my brother, my family, my people.  And on the way out, my doctor stopped me and said, you know what, you're going in for surgery.  I've paid for your pacemaker.  So I'm here today doing what I'm doing because I got a second chance.  I got a device that has saved my life from the age of 19, has given me two amazing little girls that I would never have had.  But I have concerns about my device. In January, I was admitted again because I got a new pacemaker two years ago.  And my pacemaker failed. It did not resuscitate me. And I spent eight minutes clinically dead.  And I show, here's the kicker, after the device was tested by three technologists from the medical company stating that there's no errors on the device.  It still failed. And no one can tell you why.  This is a little poem that the medical practitioners use to explain what a third degree heart block is.  If the R is far from P, then you have a first degree, longer, longer drop than you have a waken buck.  If some P's don't get through, then you have mobids too. If P's and Q's don't agree, then you have third degree.  Basically means my heart cannot pump on its own.  It is unable to relay communication for it to contract together.  So it flatlines.  Now, my device that I have has been passed by the FDA.  Now, who here knows what a pre-market assessment is?  What that means is that one clinical trial with a small amount of people are done to test whether this device works.  In the United States, we have more stringent and strict tests for drug FDA posts than we do for medical devices,  which for me is a bit of a problem.  Because if you take the wrong medication, that can be reversed.  If you receive a shot from an ICD, which is higher than what it should be, you die.  We have a whole idea of how these devices are passed. Absolutely confused.  And I think that the FDA should start stepping up, start fixing legacy shut, and just do what's right.  And here is something that I did with my cardiologist before I came to DEF CON.  He's got one of the biggest brands in South Africa that he supports. I cannot name their name.  I have been told not to say any manufacturer's names.  While I was under racing, so how it works is I go in every six months.  I lie down and my heart gets stopped and stopped at a very degree to test my device.  I took a rubber ducky and I placed it behind the programmer with permission from my cardiologist.  And I managed to capture everything that he changed along with all my PII information.  What was wrong? What events were noted for the last six months?  Now, it wasn't just for mine. It was everything that has been stored on that device.  And that's where the problem comes in.  We've got these phenomenal programmers running XP, having USBs activated, hard-coded credentials,  no encryption, no command white listing. It's just badly built.  It's not that it's just unsecure.  It's that the fundamentals and basics of secure development has not been a dear to me.  I fight a battle at the moment where I don't have a cardiologist no more.  The medical company that owns my device or manufactured my device has effectively put so much pressure on my medical staff  that they can no longer help me with any of my research.  So I am without a doctor. I'm without support fighting a battle that is pretty much on my own.  Until I found a small group of people that let me here today.  I don't know, does everyone know who I am? The cavalry is? They're pretty awesome.  This one is important. We need to be able to verify the software that we use with any devices.  Because most of my problems that I had in January was due to machine learning failing and software bugs.  And would you believe that when asking the medical manufacturer to see the code to review what is keeping my heart rate going,  I was declined access to this code because it's proprietary.  So they are practicing security through obscurity.  So I have to trust a big corporate that what they are saying is good, effectively is what is going to keep me alive.  This is what the FDA has passed on my specific device and they have said that these are acceptable risks.  My electrical component has failed in January and causing me to flat line.  It does not connect with the programmer who will not always retain its settings.  It will reset to default. I have actually experienced this. I took the chance to go into the wireless village because I like living dangerously.  And needless to say, within about half an hour I started feeling ill.  And just because we need to be scientifically correct, we replicated it for a second time.  So if anyone has got a pacemaker, stay clear of the wireless village. There is way too much signal going about.  But these are devices that should not be that sensitive to signals going on outside the body because technology is signal driven.  It is simply not there to be that sensitive.  I am convinced these medical companies are building snowflake devices because I think my device has got more emotion than I do.  This is what my device costs and this is excluding the leads.  So I have a little battery running my programs, running my software with two leads.  And when they need to be replaced, it is not simply like popping out, open my skin with a little tag.  They cut me open. They take up the whole device hoping not to rip up the leads connected to my heart.  So you can see that when a device is recalled, it is a bit of a fuck up.  You have to go into a hospital and have surgery.  For example, since Jude fixed their problem, however the legacy devices are unable to be, from where we update it,  those patients will need to have new devices implanted.  They will need to have surgery because the manufacturer fucked up.  This is just to explain exactly how the FDA passes their information.  So one day I decided to sit outside the doctor's offices with a backpack and a hoodie because that is what we wear.  That is what I wear every day.  I have a black boxed. I just listened and I learned.  What do you guys think I picked up?  Anyone?  I managed to capture communication between the programmer and the pacemaker,  meaning I could potentially replicate a man in the middle attack.  Sitting outside my doctor's offices, just listening, looking like any normal patient.  Again, this is all done with permission from my cardiologist who at that time was very supportive.  This is one of the attacks that we theoretically formulated because if you ask any heart association,  they will say no patient has been hacked that we know of.  It's that we know of situation that worries me is because we don't check,  we think it's theoretical.  Why is it not showing?  I'm going to have to read a bit of technical difficulty over the slides.  If you take a pacemaker and you start adjusting the way that it paces,  you can take a heart rate up from 60 to 160, meaning that your heart will be exhausted  and your battery will be depleted.  The standard pacemaker battery will last 10 to 12 years.  You will be able with a crash attack theoretically to take that down to about three years,  which the patient will be unaware of because effectively he would think it would take 12 years.  A denial of life attack is one that has been done successfully  where if you send RF signals to a pacemaker at a sequential rate, it will count one, two, up until nine.  And who can guess what happens then?  What would be good security?  That it cuts it off, it just starts counting at one again.  That is not how it should be because how do we drain battery life on RF devices?  We keep on attacking it.  RF signals that I am aware of, the distance from is 50 feet is the furthest that I am aware of.  That is pretty far.  That means I don't have to stand next to you.  I wonder what went wrong with the slides.  Anyway, the replay attack basically means that I'm going to replicate whatever your doctor has changed.  I've listened, I've reverse engineered these packets,  and I'm going to replicate what he's done to authenticate to your device.  Once you've authenticated to that device, it's got no white listed commands.  It'll effectively open up like a fresh fruit and accept any code that you give it.  One of the things that I discussed with friends of mine at university that I was at was  you could potentially authenticate to a device which is universal across the world.  Upload new firmware.  This firmware can update and authenticate to other devices,  effectively creating a worm that self-replicates.  Those are things that we should be looking at and being aware of.  These are some changes that have been found by researchers that you can do within a pacemaker.  Identification of a device.  As with anything, you don't want too much information to be beaconed out.  From studies and work that we've done, these devices will give you their serial number, patient information.  It will disclose your cardiac data, which is something I don't want out there,  because it's the most personal thing of mine.  You will be able to change the clock on your ICD, which is fundamentally an important element  in ensuring when the device was implanted to estimate when the device will run out.  You can change the therapies.  Again, this is what happened to me in January when my device decided that it would be able to learn on its own.  I had a software issue.  My device thought that when my heart rate fell to 30, it was acceptable.  That ended up in its missing, my heart flatlining.  That is just like the tip of the iceberg.  Here's the interesting thing.  I was preparing for my slides and every medical manufacturer said malware is not a problem.  At Black Hat, they actually managed to put malware on an ICD programmer.  Meaning if I go into the offices with a device that has been compromised,  potentially without knowing I can have malware on my ICD.  That would mean that it could infect other ICDs.  It could mean that it could kill me.  I think the one thing that we forget about these medical devices is they are connected to human beings.  They might be security devices, electronic of nature, ones and zeros.  But there's a human life that is at stake.  This might seem a little bit dark, but what would you rather pay for if your pacemaker's ransomed?  Your information or your life, your organs, obviously, it's a good business plan, ransoming medical devices.  Not that I say you should do it, but I mean people are going to pay for their organs.  This is real organized crime situations where we're seeing that it's a monetary situation.  If you infect a programmer with ransomware, for example, that reinfects other devices,  you have the potential to constantly have revenue.  This is not something that should be possible.  This is something that should be addressed with reserved memory space within these devices.  My device is AES enabled.  How many of you think that that is exactly what they use?  Anyone?  They don't.  It's available, but it's not being used.  I got a statement from a medical company saying,  you are coming to DEF CON and you have a pacemaker.  You are going to die.  I'm like, well, I think I've got a bigger chance sitting across from you being killed than I do being with the community.  Because it's the community that's going to help me fix the problems that you've created.  I think that if we start interrogating these devices and being less worried about, oh my God, we're talking about killing people?  Well, yes, we need to start talking about saving people rather than killing people.  I want to explain this to you because this is something, it's almost a show box moment.  When I started talking to the FDA, they said, but we've got pre-market assessment.  What that means is they go through documentation of a device saying,  okay, this is what the device claims it does.  And it's a check box exercise.  And that is all it is.  They try and design these innovative new phenomenal devices that don't even get the fundamental basics right.  And you have a patient that could potentially die because the device is bald poorly.  I was able to go on to all of the manufacturer's websites and download in excess of about a thousand technical user manuals,  meaningful medical practitioners.  I could fool them and state that I'm in the United States when I was sitting in South Africa.  None of these websites had user authentication.  They don't know if I was a doctor or not.  But I had access to how these devices were bought.  I know exactly what controller it's got, what board it's got implanted, and what memory it has.  What do you think I can do with that information when I start reverse engineering it?  Because then I can start knowing how these devices work.  And that is exactly what I did with my own device.  And we were shocked to find that this device has actually got a wireless controller in.  Even after I stated when they put this in two years ago, I did not want it.  But that is what was available because having a programmer next to your bed that communicates with your device  with no username and password seems like an excellent idea.  I want to...  This is something that's very close to my heart.  These people are really working their asses off with the companies.  And as I've said, the companies are not nice people.  The legal teams, they scare me.  Not a lot scare me.  Those legal guys scare me.  But I am the cavalry needs more researchers.  They need people in the device labs interrogating the infusion pumps, the pacemakers, the programmers,  and hacking the shit out of these devices.  Then we can start shaking up the room and saying these devices are surely fucking unsecure.  I want a future where we can say that we not only have innovation,  we have security, availability, and accessibility to devices that are working.  This lady has been instrumental in supporting me in doing the work that I like to do,  getting me in connection with the right people.  And this is the reality.  I am like her, one of two people having our condition in security,  being connected to the wonderful DEF CON internet and IoT and being fucking unprotected.  I have never felt vulnerable the way I did two days before DEF CON,  realizing that my device was passed by someone that I trust  and stating that the vulnerabilities that they have associated with it is acceptable.  It is not acceptable to flat line and have to be resuscitated for eight minutes  when I have a device I paid for, a fuckload of money, and it doesn't work.  That doesn't mean I'm going to get hacked, but surely enough,  we just need one skiddy to decide it's a fucking good idea to go toy with these things,  write a program, accesses the devices and not realize what they've done.  We have situations where researchers at the point of being bullied.  Big farmer does not want to play nice, and there is one way to solve that.  It's for the community to basically step up and say, enough is enough.  Whoever solves that, I will buy a beer form.  You guys can run it. If it doesn't work, I was drunk when I wrote it.  But I really want to motivate you guys to get involved with I Am The Cavalry.  It doesn't even have to be hacking.  It's just looking at better ways to get protocols in place for companies to start fixing the stuff.  Having support from the community is important, because I can tell you I can access my device  through multiple ways and means.  I was very shocked to find that no encryption was used.  Now I understand, look, I'm going to say, I understand physically I cannot be dying on the floor  having a heart attack or having an issue and go to the doctor and say,  let me give you my username and password. It's not going to work, but there has to be some balance.  At the moment, there is none.  So who's going to go to the device lab or who's going to go to I Am The Cavalry?  I want to see everyone there, because we need the community to start taking up the research again  and start getting shit done.  Because the future is coming, we're going to have our first malware.  Or we could have had it already, because if you start asking medical companies,  what's your incident response plan?  Do you check someone that's passed away from a pacemaker?  Do you know why they died?  No, it's natural causes. They've had a heart problem.  Well, how do you know the pacemaker did not fail?  They don't do checks and balances.  For me, that is a fundamental problem.  And I am tired of dealing with the shit alone.  I am tired of being bullied.  And I want the community to start stepping up.  And I want the youngsters, the future, because I'm not the future, I'm old,  to start stepping up and doing things.  So thank you for your time.  Any questions?  Yeah.  You talked about trying to get these devices fixed by contacting manufacturers and whatnot,  but it seems like that it's such a struggle to have work put out.  I was wondering what you think about somebody who you try to actually put together  a big device like a new company and what kind of entry barriers they would have to face  to actually go and put like a market solution that actually has security measures  in that way?  I can tell you.  Can you read the question?  I'm sorry to ask you to do that.  I wanted to ask what you think about market solutions that would involve security measures  that are marketed this way so that the consumer knows they're getting a device  and what kind of entry barriers like a new company would have to face  to be able to get this on the market and actually be able to kind of solve these problems  without having to deal with the current manufacturers of these devices.  Thank you.  I think if we had a new kid on the block that is able to offer a secure and transparent solution  to patients, I wouldn't mind an open source device.  Not that I'm saying I would like to program it myself because God, I'm an awful programmer,  but I would like to know what the code is doing.  I would like to be able to read and understand it because, for example,  machine learning is an excellent idea in many applications, but not in a situation  where your heartbeat does certain specific things.  The doctor knows what it's supposed to do.  So I think if a new company can come on board and start doing secure devices  and they focus a little bit more on security, I would go get that device every five years.  I would have the surgery because I would sleep better.  And just on another note, I want to say thank you to the SOC Boons that made time to come visit.  Thank you, guys.  They've been working hard, so by them it would be a later today.  But seriously, we need to build secure medical devices.  These aren't little devices that just do something.  They keep someone alive.  And it's not just about me.  It's about, I think there's about 2.2 million people with pacemakers or ICDs or brain implants  or any medical device.  That could be genocide when we have a Stuxnet situation on our hands.  I hope this question isn't too much of a sidetrack, but you've mentioned Barnaby Jack a couple of times  who died under somewhat mysterious circumstances shortly before giving a talk about hacking these implanted devices at Black Hat.  Do you know of any information sources about any investigations around this death or anything?  Or is there anything you would comment on about what you've heard about it?  I don't have any information.  I would love to have more information.  I was not lucky enough to have known him.  Heaven alone knows, if I could reanimate someone, that would be probably the one person I would reanimate to have a conversation with.  Because that man had a big set of walls.  He took on a big manufacturer.  That's not a small task.  I have had this much in the couple of years that I've done.  And the friends that know me very well have heard me cry.  And I don't cry often because I don't have feelings.  I don't have a heart that works.  I've got a metal heart.  But frustration has been there.  I wish I could tell you what's happened.  I don't know.  And I don't think there's enough evidence for me to hypothesize about it.  And I think it would be disrespectful for me because the man was a legend.  It was a very sad thing to happen to the community.  And I think it was, this research would have gone much further if that did not happen.  So just a quick side note on that. The WikiPia page says that he died of a mixed chemical overdose in the week before giving this discussion.  Which seems of this covenant circumstance for a respected speaker to...  I don't know. I don't have the answer to you.  I filed for it in the training of information. It says multiple drug intoxication, which is new to the man, was not heart-to-heart.  Who knows what happened.  I think you guys should all have a beer afterwards and discuss it because we're getting sidetracked.  And this is not a conversation, I think.  Okay, I have to respect you so you can have the stage.  The whole thing brought up, they don't seem like tough ones. I'm wondering if it's just more public.  If there's a big list of murderers, could it be, we don't even say, hey, this is just people's opposition and corruption.  We don't check. I really miss this stuff.  But that's exactly what Barnaby said.  It is fundamentally small things that if you start thinking the way that malicious attackers will think, it's easy.  So where's the list? Can you first list of those murderers?  I can.  And then you can. I'm happy to start a formal place.  I will do that for you guys. Find me on Twitter at poisonpixie.  If you want to know the story behind my nickname, you can come and ask me.  But I don't have any information for you guys, unfortunately.  So it's kind of related at that point. One of the talks the other day was from the FD, or had a representative of the FDA, who I think was here personally, but still knew what was going on.  And she stated that there are cybersecurity regulations in FDA. So I was just kind of curious what's going on.  If those exist, are they just not sufficient or that being followed?  They do exist. I actually have met with the FDA representative.  We will be having more conversations about that. I have a bit of a difference of opinion because a lot of the things are acceptable and acceptable risks.  And I'm saying, fuck that. It's not.  I cannot explain to you guys lying in bed and ICU. Well, ICU is fine because I'm used to it. I get to scan all some devices lying in bed.  They are very used to me where I'm from having multiple computers going while being hooked up to monitors.  But feeling the sense of dread, I've never felt that sad.  And I'm not supposed to have that feeling when your heart rate heats about 30 and your blood pressure is 40 over 30.  And the doctor taps you on the head, obviously I've got you.  And you're thinking, what the fuck is about to happen?  Because my ICD is supposed to now start doing its thing.  And it just switched itself off. It went to default.  And at the side of all, I'm not going to do anything.  The FDA is trying to fix things, but it's legacy devices. Anyone in IT in the hacking and security knows legacy devices fucks us over.  Okay. They difficult to fix. And this is not something that I can go pull off a shelf.  This is physically something that's implanted into someone.  When you implant cardiac elites, they grow into the rod.  If you pull those out, not carefully, you can kill someone that auto can burst.  So it is very difficult for the companies to fix these legacy devices.  I don't want to come see me after because I'm not quite willing to make the statement publicly yet.  But I'll tell you what they told me.  Thank you.  Thank you very much for the personal sharing of your story. You were in a situation where it was very short time between the decision of having a pacemaker and actually having an employment.  What are your concerns about how the general public, people who wear the decision about taking a pacemaker, maybe influence on the way that we as a community of IT specialists is actually influencing the general public into taking another pacemaker because they are afraid.  That is what scares me about the future because I'm seeing more and more patients become aware after the recall for St. Jude's, which got a lot of press.  And that's sad to me because I have the opportunity to be here today because I got a pacemaker.  So that is where my saying beautifully broken wonderfully flawed comes from because yes, the devices are flawed, but we also can't expect miracles.  They are built by humans. Humans are flawed by nature.  All that we can do is learn to go forward and learn together.  There has to be a bridging done and that is what I think I am the Calvary is doing so successfully.  They are bridging manufacturers with researchers.  They have included the EFF in that as well.  They are bringing everything full circle, but it scares me for the future knowing that people might decide not to get devices and pass away, which would be, fuck, being a sidewalk is awesome.  I mean, you know, to be sad, I got my second implant, so I'm taking it further now.  But I mean, biohacking is a real thing.  We as humans will evolve.  I mean, why not use technology that's there to keep us a lot longer?  It seems stupid, but I can understand someone being concerned about the security of the device.  I am as well.  Luckily, I'm not a high level target.  So, you know, I'm not Dick Cheney.  Do you guys know Slash has got a pacemaker?  I'm part of the cool kids, eh?  He's actually got a pacemaker.  There's lots of influential people that have these devices and they're awesome.  If you think about it, what it does is it's amazing.  It can take over the beat of the human heart.  It keeps me yet.  It enables me to wake up tomorrow morning and survive another day.  I mean, time for me is precious because at 19, I got given two weeks.  I cannot describe it to you guys.  It is the worst feeling in your world thinking,  God, I should have had that for breakfast rather.  I should have seen guns and roses live.  You should have seen Metallica.  Luckily for me, after my pacemaker, I got to see Metallica twice.  You see, I'm making up for lost time, but there are people that will not get these devices.  I know one person that's refusing to get it because they are afraid of being hacked.  And that's sad because I would like to say to them,  your device is not as flawed as you think, but that would be lying and untruthful.  I am carrying the flaws with me.  I'd rather have a flawed device than no device because I can still make a difference.  But if I'm dead, I cannot do the same.  So that's what I'm saying is we need everyone to step up and do this together.  This is not a me thing. It's an us thing.  It's a tribe thing. It's a coming together of great minds because I think forensically.  You might think some different way or someone might think offensive, defensive.  We need to bring that full circle.  I think that's what we lacking in the security will be segregating from each other.  We actually want family doing the same thing with different skills.  But I think that coming together is at events like this, facilitating it with the different villages.  So yeah, that's all from my side.  Yeah, please do. They're recording.  I got maybe the very strange question to program the pacemake that can be 10 meters powerful or can be 30 centimeters.  It depends what kind of system that I'm more afraid for a PMG attacks than a malware that somebody use electronic pulse and everything stopping in the 10 meters.  I'm more afraid for those things that malware personally.  That is one of the fears because I actually read my device is technical manual and went, holy fuck, this was a bad decision.  Because it's cold, it's electromagnetic field. It's all those kind of things.  So when I go to this is a funny story. So I'm a very nice person, right?  You guys think I'm friendly and the sock goes on to the answer because I've been hassling them.  But I'm a nice person apparently coming to death, come presenting the talk that I do. I get a freedom fondle at every point.  I generally do though, because I can't go through the magnetic, the metal detectors, because effectively that magnetic field switches my pacemaker off.  So these are still divide. These are little things that they haven't fixed yet.  And that I have experienced. It's not fun.  If you have a pacemaker, don't do it. Because I did. I said, let's see what happens.  Because I like to live dangerously. I need to know what happens when I go through a metal detector. Don't do it.  Trust me, it sucks.  So the thing is if you read these technical manuals and go on to any of the website, we had a great chuckle about it.  We actually checked the other certificates. What else? Everything. The security sucks.  So if I can't get that right, I'm a little bit worried about them doing my device to be quite blunt about it.  But you can get the technical manuals and then the precautions in there. I can try to tell you my doctor can tell me about them.  He just said, don't go through a metal detector.  Well, how do you do when I fly this cosmic radiation internationally?  That has an effect on how my device is programmed as well.  So effectively after every international travel, I have to go to my doctor, pay a lot of money and have my device reprogrammed.  Small things we can fix. But it's labor intensive and time intensive.  Yeah, that's all.  Anyone else?  Is it that bad?
DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_0_179.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_180_359.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_360_1955.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_1956_2711.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_2712_3911.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_3912_5363.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_5364_7571.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_7572_7715.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_7716_8531.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_8532_8879.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_8880_11699.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_11700_12455.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_12456_13367.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_13368_15311.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_15312_15359.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_15360_16331.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_16332_17975.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_17976_18035.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_18036_20243.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_20244_21263.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_21264_21335.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_21336_21383.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_21384_21503.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_21504_21623.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_21624_21683.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_21684_21803.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_21804_21851.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_21852_21959.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_21960_22031.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_22032_22355.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_22356_22427.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_22428_22499.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_22500_24359.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_24360_25739.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_25740_26051.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_26052_27215.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_27216_28835.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_28836_30011.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_30012_31415.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_31416_33311.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_33312_36071.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_36072_37043.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_37044_37091.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_37092_39803.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_39804_41063.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_41064_43391.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_43392_46727.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_46728_47615.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_47616_48155.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_48156_50387.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_50388_50459.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_50460_54359.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_54360_54431.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_54432_54503.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_54504_54599.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_54600_55175.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_55176_55775.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_55776_55823.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_55824_58319.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_58320_59075.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_59076_64403.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_64404_64463.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_64464_68351.png DEF_CON_26_BIO_HACKING_VILLAGE_-_Vee_-_PWN_to_Own_My_Heart_skUydi_4bIA_68352_68361.png