Electroencephalography (EEG) is a non-invasive method for the recording and the study of electrical activity of the brain taken from the scalp. The source of these brain signals is mostly the synapic activity between brain cells (neurons). EEG activity is represented by different waveforms per second (frequencies) that can be used to diagnose or monitor different health conditions such as epilepsy, sleeping disorders, seizures, Alzheimer disease, among other clinical uses. On the other hand, brain signals are used for many other research and entertainment purposes, such as neurofeedback, arts and neurogaming. Nowadays, this technology is being adopted more and more in different industries.
A brief introduction of BCIs (Brain-Computer Interfaces) and EEG will be given in order to understand the risks involved in our brain signals processing, storage and transmission.
Live demos include the visualization of live brain activity, the sniffing of brain signals over TCP/IP as well as flaws in well-known EEG applications when dealing with some corrupted samples of the most widely used EEG file formats (e.g. EDF). These demos are a first approach to demonstrate that many EEG technologies are prone to common network and application attacks.
Finally, best practices and regulatory compliance on digital EEG will be discussed.
1. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Brain Waves Surfing: (In)security in
EEG (Electroencephalography)
Technologies
Alejandro HernĂĄndez (@nitr0usmx)
Senior Consultant
2. IOActive, Inc. Copyright Š2015. All Rights Reserved.
About me
⢠Senior Security Consultant at IOActive
⢠Fuzzing & programming enthusiast
⢠Computer systems engineer (not neuroscientist)
⢠Passionate about security (~12 years now)
⢠From Chiapas, Mexico
3. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Agenda
⢠Why this talk?
⢠Neuroscience 101
⢠EEG / Brain Waves
⢠(In)security aspects
â Design
â Encryption
â Authentication
â Resilience
â The "Tower of Babel" of EEG file formats
â Misc
⢠Regulatory compliance / best practices for digital EEG
⢠Conclusion / further research
4. IOActive, Inc. Copyright Š2015. All Rights Reserved.
This is NOT an invasive-BCI talk to
become Johnny Mnemonic
5. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Why this talk?
⢠Nowadays we mostly care about
â Computer/Network/Information security
â Mobile security
â ICS/SCADA security
â Car security
â IoT security
â What about our biosignals?
⢠Any signal generated by our bodies
⢠EKG, EMG, MMG, MEG, EOG
⢠EEG (brain signals)
â Acquisition, storage, processing and
transmission
6. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Why this talk?
⢠EEG tech is being adopted more and more
⢠Brain stuff is cool, specially in
â Cyberpunk movies
â Sci-Fi literature
11. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Neuroscience 101
⢠Neurons
â Electrically excitable cells
â Processes and transmits information through
chemical and electrical signals
12. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Neuroscience 101
⢠Synapse
â The pass of chemical or electrical signal to another cell
13. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Neuroscience 101
The Effects of Drugs and Disease on Synaptic Transmission
http://outreach.mcb.harvard.edu/animations/synapse.swf
14. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Neuroscience 101
⢠Want more?
â Google hint: âhuman brain is so complexâ
â http://www.med.harvard.edu/AANLIB/
17. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Invasive vs Non-invasive
Schalk, Gerwin, Mellinger, JĂźrgen. (2010). A Practical Guide to Brainâ
Computer Interfacing with BCI2000. General-Purpose Software for Brain-
Computer Interface Research, Data Acquisition, Stimulus Presentation,
and Brain Monitoring. 1st Edition. Springer-Verlag London.
18. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Invasive vs Non-invasive
â Invasive
19. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Invasive vs Non-invasive
â Invasive
⢠E.g. BrainGate
20. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Invasive vs Non-invasive
â Non-invasive: EEG is the most used non-invasive
method
⢠EEG (Electroencephalography)
â Electrodes on the scalp
⢠Not MRI (Magnetic Resonance Imaging)
⢠Not TMS (Transcranial Magnetic Stimulation)
21. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠What is EEG?
â âRepresentation over time of the voltage generated by
electrodes recorded at different regions of the brain.
The EEG is produced by synaptic activity of cortical
neurons.â
Krauss, G., Fisher, R., Kaplan, P. (September 1st, 2011). The Johns Hopkins
Atlas of Digital EEG: An Interactive Training Guide. 2nd Edition. Johns
Hopkins University Press.
22. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠What is EEG?
â Ease of use non-invasive method to measure the brain
activity over time
â Susceptible to noise
23. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠What is EEG?
â âThe current brain technologies are like trying to
listen to a conversation in a football stadium from a
blimpâ -- John Donoghue
Disruptions: Brain Computer Interfaces Inch Closer to Mainstream
http://bits.blogs.nytimes.com/2013/04/28/disruptions-no-words-no-gestures-
just-your-brain-as-a-control-pad/
24. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Brain waves / Frequencies
â EEG activity is quite small, measured in microvolts
(ÂľV) with the main frequencies of interest up to
approximately 30 Hertz (Hz).
26. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Electrodes / Montages
â 10-20 System (Internationally recognized method)
27. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Electrodes / Montages
â 10-20 System (Internationally recognized method)
28. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠ADC (Analog to Digital conversion)
â Brain Waves = Analog Signals
â Digital EEG = Digital Signals
⢠Filters and amplifiers in between
29. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Sampling
Gotman, J. Digital EEG - From Basics to Advanced Analysis.
Montreal Neurological Institute. McGill University.
30. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Patterns / Artifacts
31. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Patterns / Artifacts
â E.g. Stages of sleep
32. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Patterns / Artifacts
â Artifacts: EEG recording events not due brain activity
⢠Eye movement / fluttering
⢠Blinking
⢠Sweating
⢠Muscle movements
⢠Electrode shake
⢠Etc. etc. etc.
33. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Patterns / Artifacts
34. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Acquisition
â Commercial
⢠Clinical use
â Expensive hardware
(thousands of USD)
⢠Cheap hardware
â NeuroSky MindWave
â EMOTIV EPOC
35. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Acquisition
â Non-commercial
⢠OpenEEG
⢠OpenBCI
⢠Many open
source software
36. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Acquisition
â Demo: Visualization of brain waves with
NeuroSky MindWave
37. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â The importance of security
38. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Clinical
⢠âThe EEG is perhaps most useful in the diagnosis and
classification of seizure disorders⌠EEGs can be
focally abnormal even in the absence of visible change on
an MRI⌠Sleep disorders include narcolepsy, sleep
apnea, various parasomnias, and several other
conditions. Narcolepsy can be diagnosed by a
combination of clinical history and EEG showing rapid
descent into rapid eye movement (REM) sleep.â
Krauss, G., Fisher, R., Kaplan, P. (September 1st, 2011). The Johns Hopkins
Atlas of Digital EEG: An Interactive Training Guide. 2nd Edition. Johns
Hopkins University Press.
39. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Clinical
⢠Demo: EEG recording synchronized with video of a
patient suffering a seizure
40. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Research
⢠Clinical research
http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3900211/
41. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Research
http://tbme.embs.org/2014/07/27/closed-loop-brain-computer-interface-triggering-active-ankle-foot-
orthosis-inducing-cortical-neural-plasticity/
42. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Research
http://learn.parallax.com/inspiration/arduino-prosthesis-using-neurosky-mindwave
43. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Research
⢠B2B - Brain-to-Brain Interface
http://www.kurzweilai.net/first-human-brain-to-brain-interface
44. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Research
⢠B2B - Brain-to-Brain Interface
http://www.kurzweilai.net/first-human-brain-to-brain-interface
45. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Research
⢠Babylab Research Centre
http://www.wired.co.uk/magazine/archive/2013/03/start/this-little-piggy-went-to-the-lab
46. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Research
⢠Controlling stuff
with mind waves
http://www.forbes.com/sites/leoking/2015/02/25/mind-controlled-drone-scientists-work-on-groundbreaking-flight/
47. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Research
48. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Security
⢠Biometric
WHAT COULD
POSSIBLY GO
WRONG ?!
http://mashable.com/2013/04/09/passwords-thoughts/
49. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Security
http://amestrib.com/news/researchers-studying-brain-activity-determine-cybersecurity-threats
50. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Military
http://defensetech.org/2015/08/07/translating-
soldier-thoughts-to-computer-commands/
51. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Military
http://www.executivegov.com/2015/05/jean-vettel-army-research-lab-technology-seeks-to-detect-
battlefield-threats-via-brain-waves/
52. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Neurofeedback
⢠MUSE headband for relaxation
http://www.choosemuse.com
53. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Neurofeedback + Art
⢠Environmental Disturbances by Anni Garza Lau
http://annigarzalau.com/anni-garza-lau--environmental-disturbances.html
54. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Art
⢠Music created with Brainwaves
http://thecreatorsproject.vice.com/blog/eunoia-seeking-enlightenment-by-tracking-brainwaves
55. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Others
http://www.tampabay.com/news/courts/brain-scan-delays-
sentencing-hearing-for-convicted-murderer-in-brooksville/2233777
56. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Others
⢠NeuroGaming
http://www.neurogamingconf.com
57. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Others
⢠NeuroMarketing
58. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Others
http://www.livescience.com/50092-brain-waves-movie-
success.html
59. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Others
⢠Neurowear
http://www.neurowear.com
60. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Others
http://neurogadget.com/2015/02/14/eeg-dating-matches-people-based-brainwave-data
61. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â Others
http://spectrum.ieee.org/tech-talk/biomedical/imaging/neuroscience-gets-radical-how-to-study-surfers-brain-waves
62. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â The Cloud
⢠Neuroelectricsâ NUBE
63. IOActive, Inc. Copyright Š2015. All Rights Reserved.
EEG / Brain Waves
⢠Uses EEG
â The Cloud
⢠Neuromore
http://www.neuromore.com
64. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Attack scenarios
â Reply attacks with saved EEG data to
⢠Control things
â Drones
â Prosthesis
â Etc.
⢠Bypass authentication
â Unauthorized update of EEG data from a criminal patient in
a hospital network
â Trade of EEG data for behavior analysis in neuromarketing
â Client-side attacks on doctors/physiciansâ computers with
malicious EEG (meta)data
65. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Design
â Some of them include security
66. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Design
â Some of them include security
⢠Neuromore
â E.g Biodata to the cloud
through a SSL channel
67. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Design
â However, no security keywords
⢠'secur', 'crypt', 'auth', 'passwâ, etc.
⢠In 90% of the reviewed
â Manuals
â Technical specs
â Brochures
68. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Brain waves on the wire: Digital streaming over TCP/IP
WHAT COULD
POSSIBLY GO
WRONG ?!
69. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Brain waves on the wire: Digital streaming over TCP/IP
â Google dorks:
Âť +<product_name> +tcp +port
Âť neuro acquisition +tcp +port
Âť +eeg +tcp
70. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Brain waves on the wire: Digital streaming over TCP/IP
71. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Brain waves on the wire: Digital streaming over TCP/IP
72. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Brain waves on the wire: Digital streaming over TCP/IP
73. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Brain waves on the wire: Digital streaming over TCP/IP
74. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Brain waves on the wire: Digital streaming over TCP/IP
75. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Brain waves on the wire: Digital streaming over TCP/IP
76. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Case: Neuroelectrics NIC
77. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Case: Neuroelectrics NIC
78. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Case: Neuroelectrics NIC
79. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Case: LabStreamingLayer
80. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Case: LabStreamingLayer
https://github.com/sccn/labstreaminglayer/wiki/
SupportedDevices.wiki
81. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Case: LabStreamingLayer
82. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Case: LabStreamingLayer
83. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Demo: Sniffing raw brain signals through a MITM
attack between the acquisition device (NeuroSky
MindWave) and a remote NeuroServer
â NeuroServer: EEG signal transceiver using TCP/IP
and EDF format
â Old and unmaintained
â Still in use
â Included in BrainBay
84. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Demo: Sniffing raw brain signals through a MITM
attack between the acquisition device (NeuroSky
MindWave) and a remote NeuroServer
EEG Server
192.168.241.149
(@daria)
Acquisition device
192.168.241.1
(NeuroSky MindWave
@win7)
85. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Demo: Sniffing raw brain signals through a MITM
attack between the acquisition device (NeuroSky
MindWave) and a remote NeuroServer
EEG Server
192.168.241.149
(@daria)
Acquisition device
192.168.241.1
(NeuroSky MindWave
@win7)
Attacker
192.168.241.60
(@exiled)
86. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Transit
⢠Demo: Sniffing raw brain signals through a MITM
attack between the acquisition device (NeuroSky
MindWave) and a remote NeuroServer
EEG Server
192.168.241.149
(@daria)
Acquisition device
192.168.241.1
(NeuroSky MindWave
@win7)
Attacker
192.168.241.60
(@exiled)
88. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Rest
⢠File formats, as common
files, no encryption
⢠What about the cloud?
How are they protecting
your brain waves?
89. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Rest
⢠SHODAN + NetBIOS shares
90. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Encryption
â In Rest
⢠SHODAN + NetBIOS shares
91. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Authentication
â The process of determining whether someone or
something is who or what it is declared to be
â Auth mechanism needed before
⢠Read/Update an EEG stream/record
⢠Start/Stop EEG
â Auth mechanism between the acquisition device,
EEG middleware and the endpoints
⢠E.g.:
EEG device <-> EGG Server
<-> Drone/Prosthesis/Etc.
92. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Authentication
â Case: Neuroelectrics NIC
â Same issue described previously (no auth to receive EEG data)
93. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Authentication
â Demo: Patient's name is changed in a MITM attack
before it reaches NeuroServer
⢠NeuroServer: EEG signal transceiver using TCP/IP and
EDF format
⢠Old and unmaintained
⢠Still in use
⢠Included in BrainBay
94. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Authentication
â Demo: Patient's name is changed in a MITM attack
before it reaches NeuroServer
EEG Server
192.168.241.149
(@daria)
Acquisition device
192.168.241.1
(NeuroSky MindWave
@win7)
Alejandro Hernandez
95. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Authentication
â Demo: Patient's name is changed in a MITM attack
before it reaches NeuroServer
EEG Server
192.168.241.149
(@daria)
Acquisition device
192.168.241.1
(NeuroSky MindWave
@win7)
Attacker
192.168.241.60
(@exiled)
97. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Resilience
â Ability to support or recover from adversity
(Denial of Service attacks)
98. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Resilience
â 90âs techniques still killing 21st century tech
#define NCONNS 10000
for(k = 0; k < NCONNS; k++){
sock = socket();
connect();
send(âfoonâ);
sleep();
}
99. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Resilience
â Some EEG (TCP) servers
⢠SPoF
EEG Server
Clients
crash
Acquisition device
192.168.241.1
(NeuroSky MindWave
@win7)
100. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Resilience
â Demo: OpenViBE Acquisition Server Remote DoS
102. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Resilience
â Demo: Neuroelectrics NIC TCP Server Remote DoS
103. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Resilience
â Demo: NeuroServer Daemon Multiple Remote DoS
104. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Resilience
â Demo: NeuroServer Daemon Multiple Remote DoS
105. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Resilience
â Demo: NeuroServer Daemon Multiple Remote DoS
#define MAXCLIENTS 16
...
struct Client clients[MAXCLIENTS];
...
int makeNewClient(sock_t fd) {
int myIndex = clientCount;
clientCount += 1;
memset(&clients[myIndex], 0, sizeof(clients[0]));
clients[myIndex].fd = fd;
clients[myIndex].role = Unknown;
106. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Resilience
â Demo: NeuroServer Daemon Multiple Remote DoS
107. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
108. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
â File Formats
⢠âA major difficulty with current commercial EEG systems is that
they use proprietary file formats, which require dedicated
reader systems.â
⢠âIn some instances, different generation of a single vendorâs
system generate incompatible file formatsâ
⢠âSome vendors of EEG systems do provide an option to save
EEG data in a standard format such as the European Data
Format (EDF) for biosignals⌠In addition, some vendors do not
strictly adhere to the EDF specification, causing problems for
some EDF reader programs.â
Krauss, G., Fisher, R., Kaplan, P. (September 1st, 2011). The Johns Hopkins
Atlas of Digital EEG: An Interactive Training Guide. 2nd Edition. Johns
Hopkins University Press.
109. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
â File Formats
⢠Many old specifications and implementations
â EDF: 1992
â EDF+: 2003
⢠Many new specs and formats, though
⢠Biomedical signals (time series)
â https://en.wikipedia.org/wiki/List_of_file_formats#Biomedical_signals_.28time_series.29
⢠List of Scientific Data Formats
â http://pub.ist.ac.at/~schloegl/matlab/eeg/
110. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
â File Formats
⢠Matrix of formats supported in different
software / hardware
â Took me weeeeeksâŚ
Âť Brochures
Âť Manuals
Âť Specs
112. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
â File Formats
⢠Examples
â Neuroscan
113. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
â File Formats
⢠Examples
â EDF
114. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
â Parsing
⢠Parsing is parsing !
â Bytes in data structures
⢠As any other file format
â PDF, JPG, GIF, PE, ELF, etc. etc.
⢠EEG data and its metadata
115. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
â Parsing
⢠Memory corruption / Buffer overflows
⢠Boundary checking problems (e.g. indexes in arrays)
⢠Loops copying data more times than expected
⢠Invalid memory derefs
⢠Arithmetic calculations
⢠Unexplored file formats
â A new terrain to play
⢠Attack surface reduced
â Specialized formats, not mainstream
116. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
â Parsing
⢠(Perhaps) developers with different backgrounds
â Not fully aware of (in)secure programming
118. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
â Bug hunting
⢠(In)secure programming
$ flawfinder --quiet --minlevel=3 --falsepositive ~/labstreaminglayer/LSL/
...
ANALYSIS SUMMARY:
Hits = 329
Lines analyzed = 1115455 in approximately 47.91 seconds (23281
lines/second)
Physical Source Lines of Code (SLOC) = 958265
Hits@level = [0] 0 [1] 0 [2] 0 [3] 306 [4] 20 [5] 3
119. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
â Bug hunting
⢠(In)secure programming
$ flawfinder --quiet --minlevel=3 --falsepositive ~/biosig4c++-1.6.4/
...
ANALYSIS SUMMARY:
Hits = 117
Lines analyzed = 95048 in approximately 3.63 seconds (26188 lines/second)
Physical Source Lines of Code (SLOC) = 71225
Hits@level = [0] 0 [1] 0 [2] 0 [3] 4 [4] 113 [5] 0
120. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
â Bug hunting
⢠(In)secure programming
$ flawfinder --quiet --minlevel=3 --falsepositive ~/NeuroServer-0.7.4/src/
...
ANALYSIS SUMMARY:
Hits = 17
Lines analyzed = 2938 in approximately 0.08 seconds (35282 lines/second)
Physical Source Lines of Code (SLOC) = 2481
Hits@level = [0] 0 [1] 0 [2] 0 [3] 0 [4] 17 [5] 0
121. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
â Bug hunting
⢠Fuzzing
â Only the EDF format was approached
Âť Most supported amongst EEG software/hardware
â Trivial fuzzing
Âť mangle.c
by Ilja van Sprundel
Âť Microsoft MiniFuzz
122. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
â Bug hunting
⢠Fuzzing
â Sample EDF
recordings
Âť My own
brain waves
in EDF
Âť PhysioNet
123. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
124. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
â Bug hunting
⢠Demos: Flaws discovered in well-known EEG analysis
software
â Unhandled exceptions / Seg faults
â Potential memory corruption bugs
â Still in the bug discovery phase
125. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠The "Tower of Babel" of EEG File Formats
â Bug hunting
⢠Demos: Flaws discovered in well-known EEG analysis
software
â Persyst Advanced Review (Insight II)
â Natus Stellate Harmonie Viewer
â BrainBay
â SigViewer (uses libbiosig)
129. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Misc
https://www.usenix.org/system/files/conference/usenixsecurity
12/sec12-final56.pdf
130. IOActive, Inc. Copyright Š2015. All Rights Reserved.
(In)security Aspects
⢠Misc
â âWe use inexpensive electroencephalography (EEG)
based BCI devices to test the feasibility of simple, yet
effective, attacks. The captured EEG signal could
reveal the userâs private information about, e.g.,
bank cards, PIN numbers, area of living, the
knowledge of the known persons. This is the
first attempt to study the security implications of
consumer grade BCI devices. We show that the
entropy of the private information is decreased
on the average by approximately 15 % - 40 %
compared to random guessing attacks.â
https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final56.pdf
131. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Regulatory Compliance / Best Practices for digital EEG
⢠Privacy
http://searchsecurity.techtarget.com/opinion/McGraw-asks-whos-in-charge-of-medical-device-security
132. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Regulatory Compliance / Best Practices for digital EEG
⢠Privacy
http://searchsecurity.techtarget.com/opinion/McGraw-asks-whos-in-charge-of-medical-device-security
133. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Regulatory Compliance / Best Practices for digital EEG
⢠Privacy
http://searchsecurity.techtarget.com/opinion/McGraw-asks-whos-in-charge-of-medical-device-security
134. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Regulatory Compliance / Best Practices for digital EEG
⢠Privacy
http://blogs.fda.gov/fdavoice/index.php/tag/collaborative-approaches-for-medical-device-and-healthcare-cybersecurity/
135. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Regulatory Compliance / Best Practices for digital EEG
⢠Guidelines by the ACNS (American Clinical Neurophysiology Society)
136. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Regulatory Compliance / Best Practices for digital EEG
⢠Guidelines by the ACNS (American Clinical Neurophysiology Society)
â (2008) Standard for Transferring Digital Neurophysiological Data
Between Independent Computer Systems
â (2006) Guideline 8: Guidelines for Recording Clinical EEG on
Digital Media
⢠Magnetic storage and CD-ROMs
â Clinical Practice Guideline 1: Recording and Analysis of
Spontaneous Cerebral Activity
⢠âLong-term storage should be of sufficient capacity to handle the
projected annual volume of data with appropriate information
security, backup, and data recovery.â
137. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Conclusion / Further Research
⢠We need more security "in mind" for brain signals
treatment
⢠Efforts in file format standardization
⢠More secure programming practices
⢠Create or update the guidelines / best practices
⢠A new terrain to play: Networking + parsing
138. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Conclusion / Further Research
⢠Test your medical devices and software
⢠Brain signals exposed on the Internet?
â Zmap scannings of ports used by known EEG
acquisition software / hardware (who is in? ď)
⢠By now, security could be improved by implementing
controls surrounding the EEG tech
â SSL tunnels
â Like in ICS/SCADA networks⌠Bio-signals firewalls /
IPSs with DPI in L7? In the near future perhaps?
139. IOActive, Inc. Copyright Š2015. All Rights Reserved.
Thanks !
Alejandro HernĂĄndez
http://www.brainoverflow.org
http://chatsubo-labs.blogspot.mx
@nitr0usmx