Dysfunctional Unity The Road to Nowhere

Dysfunctional Unity: The Road to Nowhere

Speakers: Michael v3ga Aguilar, Principal Consultant, Secure Works

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=iUnPLLvA4Gc

Overview

In "Dysfunctional Unity: The Road to Nowhere," Michael Aguilar, a Principal Consultant with Secure Works' adversary group, delivers a critical examination of the fractured ecosystem surrounding medical device security. Aguilar argues that a fundamental "dysfunction" exists between security researchers, Medical Device Manufacturers (MDMs), and the federal government, primarily the FDA. This talk highlights how this breakdown in communication and accountability directly contributes to the proliferation of vulnerable medical devices in critical healthcare infrastructure, posing significant risks to patient safety and operational integrity.

Aguilar contends that the current regulatory framework, characterized by "recommendations" rather than enforceable "hard rules" from bodies like the FDA, allows manufacturers to evade robust security practices. Compounding this issue, many MDMs act as their own CVE Numbering Authorities (CNAs), creating a conflict of interest that often leads to prolonged stalling of vulnerability disclosures. The presentation serves as a stark warning about the lurking dangers of interconnected medical devices and calls for a concerted effort to foster a more secure and collaborative environment for deploying these essential technologies.

Background

▶ Watch: Speaker introduction and offensive security specialties (0:00)

The core premise of Aguilar's talk revolves around the concept of "dysfunctional unity," which he defines, referencing Merriam-Webster, as "an abnormal or unhealthy interpersonal behavior and interaction within a group." In the context of medical device security, this group comprises three distinct entities: security researchers, Medical Device Manufacturers (MDMs), and the federal government (specifically, the FDA). While these groups theoretically share the common goal of ensuring safe and effective medical devices, their interactions are fraught with systemic issues that impede progress toward true security.

Historically, the landscape of medical device security has been challenging. Unlike traditional IT systems, medical devices often have long lifecycles, operate in highly regulated environments, and are frequently designed without security as a primary consideration. This legacy, combined with rapid advancements in connectivity, has led to a growing attack surface within healthcare systems. Aguilar posits that the primary driver of this dysfunction lies in the nature of federal oversight. The FDA, while issuing guidelines for medical device cybersecurity, often frames these as "recommendations" rather than "hard rules" that carry significant penalties for non-compliance. This distinction is crucial; manufacturers are told they "should" implement certain security measures, not that they "need to" or "must." This permissive language creates a loophole, allowing some MDMs to prioritize expediency and cost-saving over robust security, knowing that compliance with mere recommendations is not strictly enforced. As Aguilar emphasizes, "a lot of people use this to their advantage because again, they're not making the smart choices that they need to make in these devices to deploy them into a critical infrastructure."

Another critical component of this dysfunctional dynamic is the process of vulnerability disclosure, particularly concerning Common Vulnerabilities and Exposures (CVEs). Security researchers, like Aguilar, invest considerable time and expertise to identify and exploit vulnerabilities in these devices. Their motivation, as he clearly states, is not merely to gain recognition through a CVE, but to "get this stuff fixed in the product because obviously I saw it, I experienced it, I exploited it. And if I can do it, then somebody else can." However, the path to remediation is often obstructed. Aguilar highlights that many MDMs act as their own CNAs. While the CNA program is designed to decentralize CVE assignment and streamline disclosure, it creates a significant conflict of interest when the entity responsible for fixing the vulnerability is also the one controlling its public disclosure. This arrangement frequently leads to what Aguilar describes as "wars... won through attrition," where manufacturers can "keep stalling and stalling and stalling" on vulnerability releases. This protracted process, often stretching "six months, a year, two years, three years," exhausts researchers and delays critical patches, ultimately leaving patients and healthcare providers exposed to known risks for extended periods. The absence of a truly neutral third party to mediate these disputes further exacerbates the problem, leaving researchers with limited recourse when faced with an uncooperative MDM.

Key Findings

▶ Watch: Identifying the dysfunctional groups: researchers, manufacturers, regulators (3:30)

Aguilar's talk unveils several critical findings that underscore the pervasive security challenges within the medical device ecosystem:

1. Insufficient Regulatory Enforcement: The most significant finding is the stark difference between regulatory "recommendations" and "hard rules." The FDA's current approach, primarily issuing guidelines that manufacturers "should" follow, is exploited by some MDMs. This lack of mandatory, enforceable standards means that critical security measures are often neglected in the design and deployment of medical devices, leading to a baseline of insecurity.
2. MDM Control Over CVE Disclosure: A major point of friction is the practice of many MDMs acting as their own CVE Numbering Authorities (CNAs). This creates a direct conflict of interest where the manufacturer, incentivized to minimize negative publicity or avoid costly recalls, controls the pace and even the existence of vulnerability disclosures. This power dynamic allows MDMs to stall the release of CVEs for extended periods, sometimes for years, effectively hiding or delaying the public acknowledgment and remediation of critical flaws.
3. Unnecessary Network Connectivity: Aguilar identifies a prevalent issue where medical devices possess network capabilities, particularly Wi-Fi, that are not essential for their intended function or are not meant to be connected to the broader hospital network. This often occurs because developers utilize off-the-shelf boards that come with built-in networking features, and they either "don't know how to disable it or they will just leave the chip on there." This default-on, often unmanaged connectivity unnecessarily expands the attack surface.
4. Increased Risk from Interconnected Devices: The combination of lax security, stalled disclosures, and unnecessary connectivity culminates in a significant increase in risk when these devices are integrated into hospital networks. Placing vulnerable, internet-connected medical devices onto a critical infrastructure network creates pathways for attackers to compromise not only the device itself but potentially other systems within the hospital environment.
5. Researcher Motivation for Remediation: Aguilar emphasizes that security researchers' primary objective is not simply to publish CVEs for notoriety. Instead, their driving force is to "get this stuff fixed in the product." This highlights a fundamental misalignment: researchers seek to improve security and protect patients, while MDMs' actions often suggest a prioritization of commercial interests over timely remediation.

Technical Deep Dive

▶ Watch: Critical flaw: FDA guidelines are mere recommendations (4:05)

While Michael Aguilar's talk primarily focuses on the governance, policy, and interpersonal dynamics within the medical device security ecosystem, rather than detailing specific exploits from this particular presentation, he does allude to the technical vulnerabilities he encounters through his professional work and personal passion. His background as a principal consultant specializing in binary exploitations, web exploitations, and his ability to make "medical devices play Doom" offers significant insight into the types of technical weaknesses he routinely uncovers.

The mention of "binary exploitations" refers to vulnerabilities found deep within the compiled code of a device's firmware or operating system. These can include classic memory corruption bugs such as buffer overflows, format string vulnerabilities, use-after-free errors, or integer overflows. Exploiting these often requires reverse engineering the device's firmware, understanding its architecture (e.g., ARM, x86), and crafting precise payloads to achieve effects like arbitrary code execution or privilege escalation. In a medical device context, a successful binary exploitation could allow an attacker to alter device functionality, disable critical safety features, or even take complete control, potentially impacting patient care or data integrity. The ability to make a device "play Doom" is a tongue-in-cheek demonstration of achieving arbitrary code execution, indicating a profound level of control over the device's underlying hardware and software.

"Web exploitations" typically target the web-based interfaces that many modern medical devices now utilize for configuration, monitoring, or data management. These vulnerabilities could encompass a range of issues, including Cross-Site Scripting (XSS), SQL Injection (SQLi), Broken Authentication and Session Management, Insecure Direct Object References (IDOR), or Command Injection. For instance, a vulnerable web interface on a medical imaging workstation could allow an attacker to gain unauthorized access to patient records, manipulate diagnostic data, or pivot to other systems on the hospital network. The speaker's expertise in these areas suggests that medical devices are not immune to common web application security flaws, despite their critical function.

A significant architectural and design flaw highlighted by Aguilar is the presence of unnecessary network connectivity, particularly Wi-Fi, on devices not intended to be network-connected. This issue arises when developers use Commercial Off-The-Shelf (COTS) boards that come with integrated Wi-Fi or Ethernet capabilities. Instead of actively disabling these features, either through hardware modification, firmware configuration, or network segmentation, manufacturers often leave them enabled by default. This creates several technical vulnerabilities:

• Default Configurations: Unnecessary network interfaces often ship with default, weak, or hardcoded credentials that are rarely changed by end-users.
• Unpatched Firmware: The firmware managing these network modules might be outdated, containing known vulnerabilities that are never patched because the manufacturer doesn't consider the networking functionality "active" or critical.
• Eavesdropping and Manipulation: An attacker within range of an enabled Wi-Fi module could potentially connect, intercept device communications, or even inject malicious commands if proper authentication and encryption are absent.
• Lateral Movement: An enabled and vulnerable network interface provides a direct entry point for attackers to gain a foothold on the hospital network, even if the device itself is not the primary target.

The implication is that medical device manufacturers are often failing to adhere to basic security principles such as least privilege (only enabling necessary features) and secure by design (integrating security from the outset). The devices, once deployed in a hospital environment, then become potential conduits for broader attacks due to their intrinsic vulnerabilities and their connection to critical infrastructure. The speaker's emphasis on "secured infrastructure" in his vision for a brighter future directly points to the need for fundamental improvements in how device connectivity and inherent vulnerabilities are managed at both the manufacturing and deployment stages.

Demo / Proof of Concept

▶ Watch: Conflict of interest: Manufacturers acting as their own CNAs (4:45)

The provided transcript does not describe any specific demonstration or proof of concept that was presented during this particular talk. While Michael Aguilar mentions his personal "fun thing to do for medical devices" is to "make medical devices play Doom," this is cited as an example of his general skill and expertise in binary exploitation and gaining deep control over devices, rather than a specific demonstration performed as part of the "Dysfunctional Unity" presentation. The talk focuses more on the systemic issues and governance challenges in medical device security.

Defensive Implications

▶ Watch: Researchers prioritize fixing vulnerabilities over CVE credit (5:45)

The systemic problems highlighted by Michael Aguilar present significant challenges for healthcare organizations, but they also underscore clear areas where defenders can take proactive steps to mitigate risk and advocate for change.

1. Demand Stronger Regulatory Frameworks: Healthcare providers and industry groups must lobby regulatory bodies like the FDA for a shift from "should" to "must" in cybersecurity guidelines for medical devices. Mandating adherence to specific security standards, including secure development lifecycle practices, vulnerability disclosure policies, and independent security audits, would force MDMs to prioritize security.
2. Robust Procurement and Due Diligence: Before purchasing new medical devices, healthcare organizations should implement rigorous security assessments. This includes:

• Vendor Security Questionnaires: Demand detailed information on the manufacturer's security development lifecycle, penetration testing results, vulnerability management program, and plans for ongoing security updates.
• Contractual Obligations: Include specific clauses in contracts that mandate timely security updates, clear vulnerability disclosure agreements, and defined support periods for security patches.
• Third-Party Security Reviews: Consider commissioning independent security reviews of devices before integration into critical networks, especially for high-risk equipment.

1. Network Segmentation and Isolation: Given the prevalence of unnecessary network connectivity and potential vulnerabilities, strict network segmentation is paramount. Medical devices, especially older or inherently insecure ones, should be isolated on dedicated network segments (e.g., using VLANs or micro-segmentation) with minimal connectivity to the broader hospital network and the internet.

• Zero Trust Principles: Implement Zero Trust Architecture where every device and user must be authenticated and authorized, regardless of its location on the network.
• Strict Firewall Rules: Configure firewalls to allow only essential traffic to and from medical devices, blocking all unnecessary ports and protocols.

1. Disable Unnecessary Functionality: As Aguilar noted, devices often ship with enabled Wi-Fi or other networking features that are not required. Hospital IT and biomedical engineering teams should work together to:

• Identify and Disable: Conduct an inventory of all medical devices, identify unnecessary network interfaces, and disable them where possible (e.g., physically removing modules, disabling through firmware, or using secure configuration).
• Secure Default Configurations: Change all default passwords and configurations on medical devices upon deployment.

1. Proactive Vulnerability Management:

• Asset Inventory: Maintain a comprehensive and accurate inventory of all medical devices, including their software versions, firmware, and network configurations.
• Vulnerability Scanning: Regularly scan medical device networks for known vulnerabilities, although direct scanning of critical devices should be done with extreme caution and vendor consultation.
• Patch Management: Establish a clear process for applying security patches and updates in coordination with MDMs, understanding the complexities of validating patches in a clinical environment.

1. Advocate for Independent Vulnerability Coordination: Healthcare organizations should support initiatives and organizations that provide neutral third-party coordination for vulnerability disclosure, reducing the MDM's ability to unilaterally stall critical information. This could involve supporting industry-specific Information Sharing and Analysis Centers (ISACs) or advocating for government-led coordination efforts.
2. Training and Awareness: Educate clinical staff, IT professionals, and biomedical engineers on the cybersecurity risks associated with medical devices and their role in maintaining security. This includes recognizing suspicious activity, adhering to secure operating procedures, and understanding the importance of reporting anomalies.

By implementing these defensive strategies, healthcare organizations can create a more resilient environment, even as they continue to push for a more secure and accountable medical device ecosystem from manufacturers and regulators.

Key Takeaways

• Dysfunctional Ecosystem: The medical device security landscape is hampered by a "dysfunctional unity" among security researchers, Medical Device Manufacturers (MDMs), and federal regulators like the FDA.
• Weak Regulatory Enforcement: FDA guidelines are often "recommendations" ("should") rather than mandatory "hard rules" ("need to"), allowing MDMs to deprioritize security without significant consequence.
• CVE Disclosure Stalling: Many MDMs acting as their own CVE Numbering Authorities (CNAs) creates a conflict of interest, leading to prolonged delays (months to years) in vulnerability disclosure, exhausting researchers and leaving devices exposed.
• Unnecessary Connectivity Risks: Medical devices frequently include unnecessary network capabilities (e.g., Wi-Fi on COTS boards) that are left enabled, significantly expanding the attack surface and increasing risk when connected to hospital networks.
• Researcher Motivation: Security researchers are primarily driven by the desire to get vulnerabilities fixed in products to protect critical infrastructure and patient safety, rather than solely by the pursuit of CVEs.
• Call for Proactive Security: A "brighter future" requires a shift towards more secure infrastructure deployment, demanding stronger regulatory enforcement, robust procurement practices, and diligent network segmentation by healthcare organizations.

About the Speaker(s)

Michael Aguilar, known as "v3ga," is a Principal Consultant for Secure Works' adversary group. His extensive expertise spans a wide range of offensive security practices, including physical security, social engineering, adversary simulations, binary exploitations, and web exploitations. Aguilar is notably recognized for his unique skill in demonstrating device compromise, humorously stating his "fun thing to do for medical devices" is to make them "play Doom." Beyond his professional work, Michael is an avid reader, constantly honing his offensive coding skills with techniques like AV and AMSI bypasses. To manage stress from his demanding profession, he engages in cycling, running, and swimming. He also enjoys getting tattoos and is a fan of fast, loud music.