![“This is my [pipette]. There are many like it, but this one is mine.”
- Rifleman’s Creed, adapted by Prof. John Castorino](https://image.slidesharecdn.com/biobrightpresentation20160806defcon-160829222625/85/DEF-CON-24-Reverse-engineering-biomedical-equipment-for-fun-and-open-science-5-320.jpg)
DEF CON 24: Reverse engineering biomedical equipment for fun and open science
- 1. Reverse engineering biomedical equipment for fun and open science Charles Fracchia & Joel Dapello BioBright DEFCON BioHacking Village - Aug 6 2016
- 2. What to expect from this talk 1. What is a biolab & its equipment 2. How we reverse engineered two pieces of equipment 3. Call to arms: how YOU can help
- 3. The Bio Lab
- 4. The Bio Lab
- 5. “This is my [pipette]. There are many like it, but this one is mine.” - Rifleman’s Creed, adapted by Prof. John Castorino
- 11. What should have happened ≠ What actually happened
- 12. But Wait!
- 13. Reverse engineering a pipette
- 14. What is a pipette? The equivalent of the computer mouse for biological research Single-channel Multi-channel
- 15. How does a pipette work?
- 18. Step 1: choose target carefully Criteria: ● Easy to obtain ● Made by a leading brand (aka trusted) ● Elegant hack: ○ One that could be used by anyone ○ No irreversible modifications
- 19. Step 1: choose target carefully Mettler Toledo / Rainin EDP3 Plus ✔ Purchasable on eBay ● around $50 ? Remote control ● mentioned on product sheet, but no details
- 20. Step 2: hunt for more documentation
- 21. Step 2: hunt for more documentation
- 22. Step 2: REMOTE CONTROL !!!
- 23. But... Heu, can I haz remote control softwarez plz? No. Discontinued product...
- 24. Heu, can I haz remote control softwarez plz? “I think I have one in a secret stash in the factory” Step 3: find an engineer
- 25. Step 4: find remote control port Oh hi there :)
- 26. Step 4: figure out pinout
- 27. Step 4: figure out pinout Try pressing a button while sniffing but nothing...
- 28. Step 4: figure out pinout How about using the software? Success! Here’s the FW version: 1.5
- 29. Step 4: figure out pinout We have a pinout
- 30. Step 5: make it easy for others to use This hack enables actual remote control Use the simple board to relay messages via XBee You can even use encryption on the XBee link
- 31. Step 6: document the comms
- 32. Other machines?
- 33. Reverse engineering a -80ºC freezer
- 34. Step 1: find documentation
- 35. Step 1: find documentation
- 36. But... Hmm, more details please?
- 37. Step 2: collect samples from the RS-232 port Sending random characters through the port yields interesting behavior ● “N” → Dumps NVRAM ● “T” → Temperature packet
- 38. Step 3: reverse temperature encoding Increase the temperature by known amounts and collect the temperature bytes Still a bit cryptic, until...
- 39. Step 3: reverse temperature encoding This is very likely to be linear ! Calculate the slope: m = ( 20221 - 20608 ) / ( -87 + 84 ) = 129 Get the Y-intercept: 31444 → 243.75ºC Hmm, strange: 0 Kelvin → -243.15 not 243.75ºC Temp ºC ≈ n/129 - 243.75
- 40. Step 4: make it easy to use for biologists Complete with alerts & maintenance/downtime prediction algorithms !
- 41. Transform the way biology is done
- 43. These tools are essential in curing disease, finding new drugs, etc.
- 44. What we need help with Create a repository of open & interoperable device “drivers” Create a framework to teach these skills to biologists and doctors Recruit hackers & reverse engineers to this cause
- 45. We need the Arduino & Redhat for Biology
- 46. open @ biobright.org Contact us!
- 47. Questions?