Penetration Test Report (Bishop Fox): stj expert witness report

CASE 0:16-cv-03002-DWF-JSM Document 25-1 Filed 10/24/16 Page 2 of 27
Preliminary Expert Report of Carl D. Livitt, October 23, 2016
Table of Contents
Nature of Involvement ..................................................................................................................... 1
Credentials ......................................................................................................................................... 1
Information Considered ................................................................................................................... 2
Background ....................................................................................................................................... 3
Summary of Opinion ........................................................................................................................ 4
Detail of Opinion ............................................................................................................................... 6
Merlin@home Emergency Shock and T-wave (“Shock-on-T”) Attacks ............................ 6
Merlin@home Disable Tachy Therapy Attack ................................................................. 12
RF Protocol Vulnerabilities ................................................................................................ 13
Attainable Distance of RF Communications .................................................................... 15
Attacks against Merlin@home .......................................................................................... 17
Attacks against the PCS Programmer .............................................................................. 25
Merlin@home Battery Drain Attack ................................................................................. 27
Merlin@home Crash Attack .............................................................................................. 32
Security by Obscurity ......................................................................................................... 40
Large-Scale Attacks ............................................................................................................. 41
Potential Additional Analyses ........................................................................................................ 42
References ....................................................................................................................................... 43
Glossary ........................................................................................................................................... 46
Nature of Involvement
1. Bishop Fox (“BF”) has been retained to provide an expert opinion on behalf of
Muddy Waters, LLC, Muddy Waters Capital LLC (collectively “Muddy Waters”), Carson C.
Block, MedSec Holdings Ltd., MedSec LLC (collectively “MedSec”), Justine Bone and Dr.
Hemal M. Nayak (collectively “Defendants”) versus St. Jude Medical, Inc. (“Plaintiff” or “St.
Jude Medical”) in case no. 16-cv-03003, a lawsuit filed in federal court in Minnesota. For the
purposes of this report, I have been asked to provide my opinion in relation to Muddy
Waters’ claims regarding the security vulnerabilities in specific St. Jude Medical devices.
2. The involvement of Bishop Fox and that of the independent evaluation team we
assembled is limited to providing technical evaluation of security matters relating to the St.
Jude Medical lawsuit, and no position is held by Bishop Fox or the evaluation team in
respect to the Defendants or the Plaintiff. Any statements made by MedSec or Muddy
Waters are wholly their own and do not necessarily represent the opinions of Bishop Fox or
the independent team.
Credentials
3. I am one of five Partners at Stach & Liu, LLC d/b/a Bishop Fox, a security consulting
firm specializing in providing cybersecurity services to Fortune 500, global financial
2016/10/23 1
CASE 0:16-cv-03002-DWF-JSM Document 25-1 Filed 10/24/16 Page 3 of 27
Preliminary Expert Report of Carl D. Livitt, October 23, 2016
institutions, high-tech startups, medical institutions, media companies and law offices.
Bishop Fox was founded in 2005, and I joined the firm in 2007. We have offices in New
York, Atlanta, and San Francisco, and we are headquartered in Phoenix, Arizona. We have
satellite offices in Colorado, Texas, and Tokyo. My practice focuses on offensive security by
providing penetration testing services (break-and-enter hacking), social engineering (people
hacking), as well as web application, mobile/cellular, and Internet of Things security. Over
the past 9 years at Bishop Fox I have performed security assessments for organizations
around the world. A large part of my role is to mentor members of my team in many
security disciplines, from circuit board hacking to global-scale penetration test
engagements. I was a contributing author to Hacking Exposed: Web Applications 3rd
Edition13 and was a technical advisor for Network Security Assessment 1st Edition14. I have
been quoted in several publications, including USA Today15,16, eWeek17,18, PCWorld19,20,
eSecurity Planet21, and I was interviewed on NPR22 in relation to the security of Apple
payment systems. I am an active security researcher34,35,36 and have published several
reports23,24,25 on security26,27,28 vulnerabilities29,30,31 in common software32,33. I was guest
speaker on the topic of Responding to Cybersecurity Risks at The Association of Corporate
Counsel’s annual Compliance and Risk Management Forum in Denver, 201637. A UK citizen,
I immigrated to the USA in 2007. Prior to that I worked for Agenda Security Services, a UK
security firm specializing in biomedical and pharmaceutical industries. I worked as a
penetration tester; much like Bishop Fox, my job was to hack into computer systems and
report my findings. It was in this role that I was invited to be an advisor and guest speaker
on cybersecurity matters for a small number of UK police and domestic counter-terrorism
agencies, including Special Branch38, the National Extremism Tactical Coordination Unit
(“NETCU”)39, and the National Counter Terrorism Security Office (“NaCTSO”)40.
Information Considered
4. My opinions in this case are based on careful analysis and replication of MedSec’s
research into security vulnerabilities pertaining to St. Jude Medical devices. The analysis
was conducted at the MedSec offices in Miami by two consultants from Bishop Fox: myself
and Baker Hamilton, Security Analyst at Bishop Fox and licensed physician, specializing in
penetration testing and emergency medicine. We were joined by four independent 3rd-
party subject matter expert consultants: Drew Porter, founder of Red Mesa, specializing in
radio frequency security; Joe Grand, founder of Grand Idea Studio, specializing in hardware
security; Nick Selby, Director at Secure Ideas Response Team, specializing in cybersecurity
incident response, legal compliance, and forensics; and Matthew D. Green, Assistant
Professor at Johns Hopkins University, specializing in cryptography. The analysis was
conducted between September 26, 2016 and September 29, 2016. Further analysis of
additional security research by MedSec was carried out by myself and Rob Ragan,
Managing Security Associate at Bishop Fox, on October 17, 2016 at MedSec’s offices in
2016/10/23 2
CASE 0:16-cv-03002-DWF-JSM Document 25-1 Filed 10/24/16 Page 4 of 27
Preliminary Expert Report of Carl D. Livitt, October 23, 2016
Miami. All of the St. Jude Medical devices used during our tests were provided by MedSec.
During the analysis my team replicated where possible, and using only the technical details
provided by MedSec, the research and attacks described by Muddy Waters in its report
dated August 25, 2016. The results of our hands-on testing and analysis form the basis of
my opinion in this matter, and while my opinions are formed on the basis of work
performed by a team of which I was a part, the opinions and con