Michael Aguilar (v3ga), Alex Delifer (cheet) - Medical Device Penetration Testing - DCTLV2025 **4-Day training**

**Please note: This is a four-day training that will be held Saturday-Tuesday (August 9-12). Participants will receive DEF CON Human Badge with their registration**

Name of Training: Medical Device Penetration Testing
Trainer(s): Michael Aguilar (v3ga) and Alex Delifer (cheet)
Dates: August 9-12, 2025 **4-day training**
Time: 8:00 am to 5:00 pm PT
Venue: Las Vegas Convention Center
Cost: $3200

Course Description: 

The topic of the course is offensive security testing of medical devices and the impact this has on the future of medical device production. The course is a seasoned entry/mid level to advanced course. The students will be learning all that the trainers know about Medical Device hacking and the things they have learned in their interactions as testers with these devices. This is inclusive of skills such as:

• Network attacks against medical protocols
  
• Reverse engineering binaries for exploitation
  
• Attacking medical devices using peripheral devices
  
• Defense bypasses to common defenses used in medical devices
  
• And more
  

Course Outline: 

Day one will consist of an introduction into the background of medical device testing (laws, necessity, FDA issues, etc.), leading into hands-on exercises attacking flaws in BIOS chips (SPI) and attacks using PCI peripherals.

Day two consists of hands-on attacking medical protocols used in devices (dicom, HL7), with students learning various attacks on these protocols. The day will end with an introduction into medical applications and the application kiosk/bypasses.

Day three will consist of payload delivery and theory, along with programming of custom payloads. Students will learn bypasses to common defenses used by medical devices, along with ways to code the things they need to abuse flaws in lacking defenses.

Day four is the "capstone" project. Students will be broken out into teams and will assess live medical devices for half of the day. They will provide a full report outlining the actions taken and observed findings. Reports will be assessed with feedback provided to assist students in growth.

Difficulty Level:

Moderate beginner to intermediate/advanced

Suggested Prerequisites:

Experience with programming in Python and C# is preferred but not required. Knowledge of using Visual Studio and C# compilation is needed.

What Students Should Bring: 

Students will need laptop with a Kali Linux (or comparable) virtual machine and a Windows 10/11 Virtual Machine. We will also be providing an .OVA file for students to use in the class, so a hypervisor such as Virtual Box or VMWare is needed. We will be using Metasploit (https://github.com/rapid7/metasploit-framework)  and Havoc C2 (https://github.com/HavocFramework/Havoc). 

Trainer(s) Bio:

Michael Aguilar (v3ga) is a Principal Consultant for Sophos Red Team. He leads efforts in Medical Device testing, Adversarial Simulations, Physical Security assessments, Network testing and more. Currently, he has 8 CVE vulnerabilities aligned with security issues located during testing at Defcon's Biohacking Village Device Lab. He has also led the winning team of the Defcon Biohacking Village CTF for two consecutive years.

A seasoned medical device red team hacker with nearly a decade in the trenches, Alex Delifer (cheet) breaks stuff so others can sleep at night. He operates out of an unnamed medtech company, where he regularly tears through embedded systems, surgical robots, industrial controllers, APIs, and BIOS firmware like it’s target practice. A Biohacking Village Capture the Flag Champion at DEF CON, he’s known in some circles as the medical device testing sledgehammer—swinging hard, finding the flaws others miss, and leaving no UART unturned.

Registration Terms and Conditions: 

Trainings are refundable before July 8, 2025, minus a non-refundable processing fee of $250.

Trainings are non-refundable after July 8, 2025.

Training tickets may be transferred. Please email us at training@defcon.org for specifics.

If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).

Failure to attend the training without prior written notification, will be considered a no-show. No refund will be given.

By purchasing this ticket you agree to abide by the DEF CON Training Code of Conduct and the registration terms and conditions listed above.

Several breaks will be included throughout the day. Please note that food is not included.

All courses come with a certificate of completion, contingent upon attendance at all course sessions.