We have spent a month inside a modern private hospital where we were granted access to all network segments, communication medias (wired Ethernet, serial, WIFI, ZigBee and other additional wireless protocols) and physical devices, to conduct a controlled penetration test and vulnerability research.
We started by mapping the entire network, comparing our results to what the hospital’s IT staff knows (think they know) – since we discovered a mess, we started a Sisyphean process of pinging, querying walking around the hospital searching for devices, and creating an updated network architecture map. The stuff we discovered was scary, funny and shocking. At the second stage, we conducted a penetration test on each medical device, software and system we could find – that includes Imaging systems of all kinds and sizes, Cardiac pacemakers, Electromechanical technology, Hospital hardware, Laboratory equipment, Gas and drug delivery systems, Surgical instruments, Medical monitoring devices, doctor’s applications, internal portals and databases, rogue WIFI access points, physical security vulnerabilities and more, this time our findings were terrifying, hilarious, and outrages!
Join us in our adventure of technology (cool), security (bad) and hospital staff characters (facepalm) to discover how stuff looks like in the place you want to trust the most. In this talk we will share our methodology, discoveries, conclusions and stories.
