Hacking Is Life-or-Death When You Target a Hospital🎙Darknet Diaries Ep. 121: Ed

Darknet Diaries Episode 121 features penetration tester Ed Skoudis sharing a harrowing hospital assessment where his team gained shell access to a surgical laser system during active surgery, highlighting the life-or-death stakes of healthcare cybersecurity 14:00.

Key Takeaways:
• The episode opens with how phishing exploits human trust, using Barbara Corcoran's $400,000 loss to illustrate non-technical attacks 0:05
• During a hospital penetration test, Ed's team found a critical two-year unpatched vulnerability on a Windows system controlling a surgical laser that was actively in use during surgery 14:00
• Medical devices often run standard operating systems that hospitals don't realize need patching, as vendors don't always communicate security updates 12:30
• Organizations like I Am The Cavalry bridge the gap between hackers and medical device manufacturers, with FDA leadership facilitating collaboration at events like Defcon's Biohacking Village 28:00

This episode underscores that penetration testing in healthcare requires extreme caution, clear scoping, and communicating risks in business terms—because real patient lives depend on these systems.

Sources:

• 0:05 Introduction on phishing and social engineering vulnerabilities
• 0:30 Barbara Corcoran phishing case example
• 12:30 Medical device patching challenges
• 14:00 Hospital penetration test and surgical laser discovery
• 28:00 I Am The Cavalry and FDA collaboration efforts