Thread by @nmatt0

I bought the Contec CMS8000 patient monitor that @CISAgov thinks has a Chinese "backdoor".

Down the rabbit hole I went!

Here is the @CISAgov advisory. Honestly, this isn't their best work in my professional opinion.

cisa.gov/news-events/ic…

As far as the backdoor goes, this was probably just some poor security design as laid out by Team82 @Claroty. If you want to backdoor a product you usually don't print the C2 server IP in the user manual. 🙄

claroty.com/team82/researc…

But what interested me was the custom binary protocol used to communicate with a central server.

This protocol was clearly communicating patient data over the network without encryption!

But I wanted to decode the vital readings, not just the text-based patient information.

Watch my video to see my process for decoding the customer binary protocol using Python which contains my live SpO2, BPM and temp sensors readings!