hello and welcome to owasp and csa iot
impacting medical security
my name is aaron guzman i am the product
security lead
at cisco meraki
in charge of all things hardware
firmware and iot security
i also lead the
owasp iot project along with subprojects
co-chair for the cloud security alliance
iot working group
i've co-authored the iot penetration
testing cookbook
i'm a technical reviewer with packet
publishing and no starch press
practical iot hacking is the latest
publication released in march of this
year 2021 although right on its hills is
bug bounty boot camp which is soon to be
released in the coming months
in practical iot hacking you will find
some medical device oriented
attack techniques for network protocols
such as dicom
so make sure to check them out i will
promise you you will learn a thing or
two
so really happy to be here
you know presenting on you know owasp
and cloud security alliance i will first
you know talk about some of the the hats
that i wear right multiple depending on
the day
and uh we'll get started with owasp for
those who don't know uh for those who
have who are familiar uh you may have
come across oh wasp if you are trying to
remediate a software security
vulnerability
but for those who do not know
o wasp is a an acronym for open web
application security project
is a non-profit started in uh started up
in 2001
and it's actually
the 20th anniversary this year so it's a
big milestone
oh wasp has great uh very smart uh
experts from all paths around the world
there are region regional and global
events and what i mean by events is
conferences and hackathons
so there's global apps like usas
europe apac
latin america
but also regional and and states you
know uh chapters right like upset
california is one that is near and dear
to my heart and and one that i help
organize
you know pre-pandemic at this point
but essentially owasp is an
authoritative source
for software security
so if you get a chance check out the
owasp flagship projects
won't be a waste of time
you might be surprised and find a thing
or two that you didn't know before
whether it's a piece of knowledge or a
tool
or guidance
so i'm here to talk about the owasp iot
project internet of things
this project was founded in 2014
and designed to help manufacturers
developers and consumers better
understand iot security issues
and now the idea was to kind of cast a
net wide and apply our knowledge and
education
you know to as many as many paths and
areas and audiences
uh so
that's the way we've kind of approached
uh some of our projects with uh what
projects our tools and guidance and best
practices
and when you think about medical device
security right medical device security
you know the platforms that they run on
it could be
embedded linux it could be uh windows it
could be bare metal meaning you know
microcontrollers without operating
systems
and software is controlling right is the
crux of of controlling that the
functionality of those devices
and uh what the iot project is is you
know some of the projects that we work
on is you know to help the you know the
security and the awareness aspects of
of of uh you know developing and
deploying right and building
so we've been cited and numerous
publications and information security
standards
the most recent one that i've stumbled
upon was the ftc
had cited us for
building security into internet of
things
in 2021
to our surprise which is which is
awesome
um we collaborate with the like
organizations whether that's a nisa
cloud security alliance uh you know
other other companies you know around
the world
you know we're looking to collaborate
more gsma
other folks in the space
especially in the medical right
we'll talk about you know some of the
the work in the medical space obviously
so the project we've broken it up into a
couple of different categories
namely seek and understand that we'll
talk about today
and uh
we'll also talk about the the validation
and so seek and understand uh we have a
couple couple projects that we'll we'll
talk through today the uh top 10 the iot
top 10 and iot goat
and to make the iot top 10 kind of more
applicable for some groups so we created
a mapping project and mapped them to a
number of sister projects in the
industry
iot top 10 this is essentially our
flagship project
it's
meant to uh you know create the
awareness and supposed to be you know
top 10 things to avoid when building
deploying and managing iot systems
and when we develop this list you know
we have a methodology to which we use
and uh you know we gather data from
different sources right and we look at
sister projects
and the theme was simplicity again
casting that net wide to you know
manufacturers
consumers
at the enterprise as well who are who
are using these devices in their network
and we wanted to to highlight
essentially what are the highest
priority issues you should be aware of
now the list isn't necessarily ranked
from the most uh critical to the least
critical
um although
from the prevalence you'll notice um you
know the you know ranging from one how
common and pervasive some of these
issues are and the impact that
attackers can
can gain uh and and and you know once
exploit once exploited into an
environment and when talking about
medical that gain could be someone's
life right
iot goat
what is iot goat
iot goat is a deliberately vulnerable
firmware and what we did is we based it
off of open wrt and openwrt is a is an
build system
and what build system is it makes it
easy easier essentially to
to compile and build firmware
and it does that in a way right that's
that's open source and and which is why
we chose openwrt
uh the other reason why we chose openwrt
is its
compatibility with
old devices that you may have
uh let's say laying around old routers
or old networking equipment or you know
devices that are compatible with open
wrt and give you that flexibility to
flash
iot go
and to practice finding and identifying
and exploiting vulnerabilities within
firmware
so when we developed iot code we
incorporated
as much as we could of the iot top 10
and when i say as much as we could
i mean
everything aside from the hardware
and and uh
kind of process base well actually
everything aside from the hardware and
that's actually in our roadmap as well
and so we what we wanted to do is is use
this vulnerable firmware as a you as a
learning platform
for professionals researchers software
developers
anyone who is looking to get into for
more hacking iot hacking
and and give him that playground to
let loose and to practice and to level
up and gain that confidence
if you've ever gotten started into iot
hacking i'm sorry uh firmware hacking
uh it's it's a it's a tall it's a tall
order right uh if you have no previous
exposure or visibility
and so again this is meant as as a
platform to help enable
folks you know get more confident and
and familiar with
the types of vulnerabilities that are
within
firmware
so i'll show
a few screenshots
here's the the login page
by the way this is iot go is up on on
github if you want to have a play
you're more than welcome to
here is the secret developer diagnostics
page
you'll find these somewhat common or
uncommon maybe left over from debug code
for it from devices usually right it is
not a good sign when you find these
types of diagnostic pages that allow
access
uh you know by other means that you know
elevated access
so we've developed challenges to to walk
you through
how to find the vulnerabilities
and
part of a road map is how to fix the
vulnerabilities as well
what you see here on your screen is the
back door for iot go
essentially a a service that is running
on startup
and you can connect to that particular
service
and
get root access
and
practice
post exploitation if you'd like
meaning
going from device to device inside of a
network
or keeping it simple um
simple is always the best right
especially when you're getting started
this screenshot here is the
listening
network services from nmap and you'll
see you know the common http
upnp as well as a couple of services
that run on high ports that are unknown
which might be fruitful if you poke at
them and you find out what they're
running
who knows you may get access to a device
you may
exploit a vulnerability
so good luck have a play
again iot code is is there is there as a
resource for you all
and we'll talk a little bit more of you
know what
what you can use in conjunction with iot
go next
[Music]
our other category
is validate and test
talked about seek and understand this is
validate and test an invalidating test
we have the iot security verification
standard
firmware security testing methodology
and bytesweep
which is a tool a firmware analysis tool
from our security testing methodology
was meant to
lower the barrier of entry
for iot hacking including medical
devices right so this is
this could be used hand in hand with
iot goat and the idea is to enable more
uh professionals or more more folks who
are interested in getting into
firmware hacking and providing those
guide rails
and providing the guidance and kind of a
systematic
you know in a systematic way all in you
know one resource
and if you're like me uh you know you'll
you when you get started in firmware
you'll be like ah there's so much going
on i don't know where to start this is
this this might be for you
uh and like any other methodology right
you can jump from step to step
and what we've done is we broke it down
into nine steps
right and the nine steps again depending
on your your scope and your expertise
and and the foothold you may already
have
you know you can jump around as
mentioned
we've went ahead and provided
tool usage examples uh walkthroughs
right again to be able to sh to to help
and and show and teach
uh essentially you know the common
techniques the common tools
um and and what we've done is
create a companion uh virtual machine
with pre-loaded tools
vulnerable firmware such as you know iot
go but also a few others um that the
industry has provided and even some that
have known vulnerabilities for for
products and manufacturers out there
you know zipped up and you know trying
to keep the space minimal
so again really trying to
try to enable more folks
uh to get going and and get some help
with with firmware hacking and
start poking around into you know iot
devices medical devices right
iot security verification standard
isvs
so isbs what it consists of is is three
verification levels
and we have five chapters or if you want
to call them domains
with a total of 138 controls don't pay
attention to the control so much
uh but the the the aim of the project is
to create a basis
for it for testing
iot applications software and and their
technical controls but also to develop
contextual requirements
for secure development and design
so you can use it as as part of the
hardware design for medical devices you
can use it as a set of product security
requirements to be included
into product requirement documents prds
if you're a manufacturer
if you're buying devices you can use
them for procurement of medical devices
developing medical device security
training
assess the security posture of a medical
device
and provides a basis right to define
verification levels
based off of the medical devices risk
you know today
there isn't uh you know a
a standard to help normalize
you know the coverage of how well my iot
device my medical device
has been has been tested it's
essentially you know tribal knowledge or
maybe there's a
an overview of a methodology
but this this this aims to plug those
gaps
and and help
clear the ambiguity there
and so we we followed our sister sister
projects within oh wasp the asvs is for
the web the m-a-s-v-s
for mobile and the sc vs for software
composition think about it like supply
chain and building
building uh software
so this project is still i'm sorry is in
release candidate stage
it's been a rough year
but we are hoping to get it out fairly
soon for you all and we're just tidying
things up
so we are open to additional con
feedback and contributors and we'll
we'll get to how you can reach us later
on
some honorable mentions that that affect
the you know medical device security
the embedded application security best
practice
best practices
uh were previously released around 2016
time frame
and we are doing a refresh with newer uh
newer techniques newer guidance
different formatting
right now we have a base set of seven
that you see on the screen here with
sensitive data management down at
cryptography
initially we had 10
and again this is still a work in
progress
right and then and if you notice the
octo and open wrt these are
these are very popular uh embedded build
systems for for devices
so likely
you know your medical device that you
that you purchase
if it has a linux operating system
is built with one of these one of these
build systems here
and the hardware security testing
methodology
is something that is that is a work in
progress
and again you know kind of taking that
that that step even even lower from
firmware or actually stage lower
right uh where you you have the hardware
uh and uh
let's say you need to pull the firmware
and to find vulnerabilities and then
exploit them
this hardware methodology testing
methodology
will help you in that endeavor when
you're embarking on those types of
assessments those hardware analysis the
tools you'll need to have in your
toolkit
the the techniques you'll have to keep
in mind when to try which technique
and again it's it's for those for those
folks who again need that that guy a
little bit of a kickstart or something
to you know kind of keep you honest and
reference as like hey you know
i am ensuring i'm covering these certain
areas for these vulnerable hardware
debug interfaces these
uh these uarts these serial interfaces
these jtags
how do i connect to these what do i do
afterwards how do i
gain root access
and gain persistence
so we hope these resources will be
helpful to you all
but you might be asking this is owasp
these are obas projects
why is owasp involved in iot and in
hardware
and an embedded
well
the end of the day
everything is software right
without software hardware would not be
able to function
firmware would not be able to talk to
the hardware the drivers right
wireless protocols
all software
zeros and ones right if you want to take
it down even to the slowest
switching hats now
to my cloud security alliance hat
a brief intro about cloud security
alliance
it's a global organization with a
similar structure than owasp
free to join and participate
resources best practices and and events
as well
i guess that the large the larger
differentiator would be
the cloud security certifications that
they offer and oh wasp is
does not offer such certifications they
are
501 3c
both great groups i give
100
of credit to to both of these
organizations
and where i'm at without either these
organizations i would have not had
opportunities to edit
books and write a book
um so keep that in mind as as you're
pondering whether i should get involved
throughout this presentation
so the cloud security alliance iot
working group
i've been a part of this group since
since the beginning and it was
originally part of the mobile working
group in
2014 uh when we spoke when we spun off
we've also you know worked with with
industry regulatory and corporate
and corporates as well you know from
from the collaboration perspective and
we've been lucky enough to be incited in
rfcs and different standards as well you
can see a couple of screenshots there
with uh one of our rfcs rfc 8576
we've put out a number of different
publications throughout the year
specific to industries specific to the
uh to the enterprise right um and
you know two two medical
publications
have been publi have been released and
we're working on a third which we'll
we'll talk to talk about today
so i guess you know with the
collaboration in mind
you know o wasp and cloud security lines
work together to
release the secure medical device
deployment standard
if you may be wondering so there's a lot
of cross-pollination again we're all
saying the same thing and we should all
be working together so if you all are in
similar groups and you want to
collaborate
let's do it
the iot controls matrix
this is the flagship project for
our iot working group
it is modeled after the cloud the cloud
control matrix the ccm
there is 165 controls aimed at
enterprise iot that incorporate multiple
layers of connected devices
cloud services and networking
technologies
so we have 21 domains security domains
and that's ranging from asset management
like you have to know what you have to
get started from governance
even legal
down to vulnerability management
and security testing activities
whether that is web application security
testing firmware
bug bounties even included so it's
really holistic
so it should be a helpful resource for
helpful uh health wear i'm sorry
healthcare delivery organizations
and any organization deploying connected
devices in their networks
so how we're revolving the iot controls
matrix is
we want to glue the process policy
infrastructure
ecosystem controls with the device
itself
and you know part of that is you know
the industry is changing we have you
know zero trust
zero touch provisioning you know supply
chain issues are you know i don't want
to say at its height but it is it is up
there and it is on top of everyone's
minds especially in 2021 and the day
in remote working now
right and people are sending these
appliances in their networks and these
iot devices and they're just connecting
to corporate environments
and you know managing and and you know
the whole complexities that come with
that
and so for the next version we're
looking to not only evolve and refine
our controls
but introduce a shared responsibility
matrix
tailored towards iot
and again to kind of expand the
applicability
we create mappings to
either sister projects such as you know
anissa's
iot you know baseline security baseline
and the variousness standards out there
and of course
cloud security alliance projects like
ccm
as you may have noticed securing iot
is not an easy task
right medical device manufacturers must
trust their supply chain partners and
the supply chain partners must do their
due diligence and that cascades down
right
even further to the enterprise and
consumers which they must trust the
connected products that they meet you
know minimum minimum standards and
controls
and typically this trust is obtained
through you know a series of
questionnaires and back and forth the
interaction with with each group or each
party
or some or a sort of trust portal that
satisfies
uh procurement requirements so when
you're purchasing things
but at the end of the day right
given the complexity of iot and the the
scope
right there is not one size fits all
solutions and controls must be
interoperable
it must provide automation to scale
and they have to be validated right
there has to be you know internal and
external validation to ensure these
controls are are working and that the
lights flicker you know the alarms the
alarms are going off when they should be
so an ongoing project is is zero trust
for iot
and this this is really important for
those medical devices that you may be
plugging in and hey now all of a sudden
they are paired and they are working
they are on boarded with you know uh
again zero zero zero trust or or uh
touch i guess you can say
and uh you know there's there's
a methodology to the architecture
in which you know we'll break it down
from the onboarding the authentication
the authorization
and then how you monitor those types of
devices and the different policies you
want to employ
and then you know if there is a route of
trust hardware route of trust how do you
leverage those for that kind of secure
identity
otherwise you know if the added identity
could be
tampered with uh so could that trust
right
the cloud security alliance medical
device incident response playbook
the goal of this project is to establish
the best containment eradication and
recovery practices for for each category
while minimizing the risk those
practices have on patient care
so we've modeled this playbook after you
know the nist sp 861r2
but we created our own kind of
differentiators here in the sense of
you know we're defining incidents
in this context as a vulnerability
disclosure and one or more cves
affecting medical devices within a
health healthcare delivery organization
inventory
or
the discovery of malware
ransomware
or loss of availability of a medical
device
so this might sound all too common
you you may have heard all the
vulnerabilities reported for medical
devices in the past
or what about the novel uh wannacry
a few years back
three four years back now which took
down a number of hospitals and was
devastating for some and cost cost lives
so this playbook is supposed to be used
as a basis
as a starting point to incorporate into
a an hdo a healthcare delivery
organization's program
and so we we've defined these seven
clinical scenarios
and these clinical scenarios range on uh
based on the the
the types of devices that are being used
so for example uh
number one would be you know if it's
safe to connect from the patient and the
network
is it safe to connect from
uh
is it safe to disconnect from the
network
can the devices be shut down safely and
removed from the patient
is the disconnection possible
but with clinical impact
so we'll we'll go through a couple of
these or i'll just show you the
the workflow that example workflows
again these will be contextualized or
should be contextualized to internal
processes
but what is always step one with an
incident response right you can see you
can see the uh
the list here right the the five phases
the most important one of the most
important
is
is to prepare
right and and we've helped we've helped
kind of shape you know high level
activities that
that medical facilities can can employ
you know kind of expanding on on some of
these activities
you know again you have to know what you
have so starting with inventory
classify the clinical impacts
and the data impacts what happens when
you know patients are affected devices
are affected
creating a you know a list of
stakeholders
not only within the medical facility or
health delivery organization but also
with the device manufacturers and anyone
else
but also you know backing up and
monitoring
so on and so forth
so
check out the playbook we have some
great details in there
so after preparing
right you have to be able to detect
analyze and contextualize
you know and and
within within this phase you'll have to
maintain a number of different
initiatives and programs
what i mean by programs are your threat
intelligence programs
communication and relationships with
information sharing and analysis centers
icesax
vulnerability management program
how do you find vulnerabilities how do
you how do you remediate vulnerabilities
internally and externally are you
asking for software building materials
for devices for devices to understand
their software composition what they're
made out of their essential
essentially their nutritional facts
you get their versioning information and
and compare them to
[Music]
databases
cve
databases so you can understand the risk
that they're they're introducing into
your network
[Music]
other considerations for programs are to
maintain a catalog of iocs indicators of
compromise
and having a sim and monitoring for for
security events using that sim
and incorporating a behavioral profiling
mechanism whether that is something that
a vendor provides or something
internally
but it is it is it is needed
and this is this is part of detecting
analyzing and contextualizing according
to
your organization
contain eradicate and recover
so the activities in in this phase of
the ir process are dependent on a set of
incident response classifications
so these these response classifications
take into account the clinical
considerations associated with the usage
of each device
and you'll understand what i'm saying in
just a moment right so
this is the scenarios i was mentioning
so safe to disconnect from the patient
and network
so there are no patient safety issues
with immediately removing the device
from the patient or the network
an example could be a wireless
blood pressure cuff
disconnection from the network possible
but with clinical impact
while the device can
operate independently of the network his
disconnection will have clinical impact
a telemetry monitor which is often used
to constantly collect and monitor the
vitals of patients in icus and other
critical units is an example of this
scenario
[Music]
shut down or disconnect from
[Music]
from the patient with safety
implications
so the medical devices is providing like
clinic clinical necessary functions and
the device is required to be online to
performance function
so an example of this could be
a ct machine
right these are very real relatable
maybe you know some you know you or
someone in your family
has interacted with these types of
scenarios
um and one scenario that is near to me
and i didn't mention it here is you know
the implantable scenario
you know what happens you know when a
pacemaker there's an incident there
um and what do you do and what do
clinicians do and and how do they loop
in the third parties the the
manufacturers and
and uh how do you respond right
so i found this this image uh quite
funny
you cut a virus from your computer
and we had to erase your brain
i hope you've got a backup copy
and the in the age of ransomware and the
white's
you know exploitation of ransomware and
wearables and implantables
you're you know it is not possible to to
back up right in those cases but you can
back up your your it infrastructure and
and and
uh you know telehealth devices or maybe
not even telehealth devices but other
devices within
a hospital network
the next phases
are analyze a post incident
sharing and updating with
stakeholders and stakeholders could also
be the information sharing groups the
isacs
and then you're looping back around to
prepare and incorporating the lessons
learned into the playbook into your
processes
and uh helping right with that sharing
part you're helping others learn from
what you learn so that they can
incorporate into their programs as well
so these isacs if you're not familiar
they do have you know a sort of
confidentiality agreement
uh which is which is beneficial right
and in these cases and obviously
probably needed right
wrapping up
i wanted to
provide a table to to help illustrate
medical
device security activities
and applicable projects we talked about
today
so securely developing medical device
software you can take a look at the top
10
isvs embedded appsec best practices
and zero trust for iot
identify medical device
vulnerabilities you can use iot goat as
as a playground
and replicate that into a real device
the former security testing methodology
the hardware security testing
methodology byte sweep as the tool to
help you with your firmware analysis
isvs
right to to figure out which
which test cases
i should be
incorporating into
my workflow into my assessment
isbs not i think i may have skipped over
this it is written in a way
that uh well it is written in and verify
that so every
every uh
every control is verified that
obviously verification levels there's
three of them so when you're purchasing
deploying managing and maintaining
connected medical devices
use the iot controls framework
the secure medical device deployment
standard
you can also use the medical device
incident response playbook
because there are some good bits in
there from
the the uh
the kind of
managing and purchasing as well
from the preparing detecting containing
and post medical device security
incidents
the medical device ir response playbook
right
uh one that we just spoke about
how to get involved hopefully one of
these excited you or you've you've found
uh that you know there is room where
there is a gap perhaps and some of the
the work that that we've performed or
you want to be a fly on the wall and you
want to get involved and just listen in
to learn
you were available on slack for cloud
security alliance and owasp
for oauth to get access to slack go to
owasp.org and go to about and there is a
slack
section there just input your email
you'll get an invite
you can also reach out to project
leaders
whether they're active project leaders
or current project leaders like myself i
will help you i will i will help you
route you know your route it to the
appropriate person if it's not me
we're pretty easy to get a hold of on on
socials you can see uh you know my
twitter at the bottom right hand corner
you know linkedin as well
with cloud security alliance we do have
a monthly meeting again free to attend
and join
and keep in mind with contributing and
getting involved
it's technical and non-technical
opportunities you don't have to be an
expert you don't have to be a super hard
worker you know a super hacker or
anything like that
user experience design format
viewing editing those are all needed
skills
so again free and open to all who are
interested
here is my contact info if you want to
reach me directly
thank you for your time
have fun at biohacking village and def
con if you're there
appreciate your time
take care all
you