Michael Aguilar (v3ga), Alex Delifer (cheet) - Medical Device Penetration Testing - DCTLV2025 **4-Day training**
**Please note: This is a four-day training that will be held Saturday-Tuesday (August 9-12). Participants will receive DEF CON Human Badge with their registration**
Name of Training: Medical Device Penetration Testing
Trainer(s): Michael Aguilar (v3ga) and Alex Delifer (cheet)
Dates: August 9-12, 2025 **4-day training**
Time: 8:00 am to 5:00 pm PT
Venue: Las Vegas Convention Center
Cost: $3200
Course Description:
The topic of the course is offensive security testing of medical devices and the impact this has on the future of medical device production. The course is a seasoned entry/mid level to advanced course. The students will be learning all that the trainers know about Medical Device hacking and the things they have learned in their interactions as testers with these devices. This is inclusive of skills such as:
- Network attacks against medical protocols
- Reverse engineering binaries for exploitation
- Attacking medical devices using peripheral devices
- Defense bypasses to common defenses used in medical devices
- And more
Course Outline:
Day one will consist of an introduction into the background of medical device testing (laws, necessity, FDA issues, etc.), leading into hands-on exercises attacking flaws in BIOS chips (SPI) and attacks using PCI peripherals.
Day two consists of hands-on attacking medical protocols used in devices (dicom, HL7), with students learning various attacks on these protocols. The day will end with an introduction into medical applications and the application kiosk/bypasses.
Day three will consist of payload delivery and theory, along with programming of custom payloads. Students will learn bypasses to common defenses used by medical devices, along with ways to code the things they need to abuse flaws in lacking defenses.
Day four is the "capstone" project. Students will be broken out into teams and will assess live medical devices for half of the day. They will provide a full report outlining the actions taken and observed findings. Reports will be assessed with feedback provided to assist students in growth.
Difficulty Level:
Moderate beginner to intermediate/advanced
Suggested Prerequisites:
Experience with programming in Python and C# is preferred but not required. Knowledge of using Visual Studio and C# compilation is needed.
What Students Should Bring:
Students will need laptop with a Kali Linux (or comparable) virtual machine and a Windows 10/11 Virtual Machine. We will also be providing an .OVA file for students to use in the class, so a hypervisor such as Virtual Box or VMWare is needed. We will be using Metasploit (https://github.com/rapid7/metasploit-framework) and Havoc C2 (https://github.com/HavocFramework/Havoc).
Trainer(s) Bio:
Michael Aguilar (v3ga) is a Principal Consultant for Sophos Red Team. He leads efforts in Medical Device testing, Adversarial Simulations, Physical Security assessments, Network testing and more. Currently, he has 8 CVE vulnerabilities aligned with security issues located during testing at Defcon's Biohacking Village Device Lab. He has also led the winning team of the Defcon Biohacking Village CTF for two consecutive years.
A seasoned medical device red team hacker with nearly a decade in the trenches, Alex Delifer (cheet) breaks stuff so others can sleep at night. He operates out of an unnamed medtech company, where he regularly tears through embedded systems, surgical robots, industrial controllers, APIs, and BIOS firmware like it’s target practice. A Biohacking Village Capture the Flag Champion at DEF CON, he’s known in some circles as the medical device testing sledgehammer—swinging hard, finding the flaws others miss, and leaving no UART unturned.
Registration Terms and Conditions:
Trainings are refundable before July 8, 2025, minus a non-refundable processing fee of $250.
Trainings are non-refundable after July 8, 2025.
Training tickets may be transferred. Please email us at training@defcon.org for specifics.
If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).
Failure to attend the training without prior written notification, will be considered a no-show. No refund will be given.
By purchasing this ticket you agree to abide by the DEF CON Training Code of Conduct and the registration terms and conditions listed above.
Several breaks will be included throughout the day. Please note that food is not included.
All courses come with a certificate of completion, contingent upon attendance at all course sessions.
Training Justification Request – DEF CON Training
To: [Manager Name]
From: [Employee Name]
Date: [Date]
Subject: Business Justification for Attendance at DEF CON Training
Dear [manager’s name],
I am requesting approval to attend DEF CON Training, one of the cybersecurity industry's most recognized technical training programs. I’ve reviewed the options and selected a course to expand my skills with [1-2 key skills focus areas for the course].
DEF CON has been one of the world’s leading cybersecurity communities for more than three decades, known for convening industry, government, and independent experts to exchange advanced knowledge and practical skills. Building on this tradition, DEF CON Training delivers intensive courses taught by recognized global instructors. DEF CON Training courses offer hands-on instruction in a challenging, fast-paced environment. Many of the courses offered by DEF CON Training align with the National Institute of Standards and Technology (NIST) NICE Framework and Department of Defense Cyber Workforce Framework (DCWF), and attending this course will help me build and sharpen the skills required for my role.
Training: [Name of DEF CON Training Course]
Instructor/Provider: [Trainer Name(s)]
Dates: [Training Dates]
Location: Las Vegas, NV
Cost: [Course Fee]
Travel Expenses: [estimated travel & accommodations costs]
Course Description: [Copy short description of the selected class from the website here]
Trainer Bio: [Copy bio of the trainers of the selected class from the website here]
Once I’ve completed the course, I’ll be able to:
[copy student outcomes from course page where available or choose 3-4 skills or topic areas from the outline that are applicable to your current role, will help you fill a skill gap, etc.]
Business Need
As cyber threats continue to evolve, it is critical that our organization maintains current knowledge of emerging techniques and industry best practices. The selected DEF CON training aligns directly with my responsibilities in [your role/field here - for example, security operations, incident response, threat detection and hunting, application security, cloud security, risk management, security engineering].
The course will provide practical, hands-on experience that can be immediately applied to our environment and security initiatives. DEF CON training emphasizes real-world attack and defense scenarios, enabling participants to develop skills that extend beyond traditional classroom learning.
Request for Approval
I respectfully request approval and funding to attend DEF CON Training this August in Las Vegas. The knowledge, hands-on experience, and industry insights gained will directly support our cybersecurity objectives and contribute to strengthening our organization's security capabilities.
Thank you for your consideration. Please let me know if you have questions or need additional information to support this request.
Sincerely,
[Employee name]