Jul 28, 2017 · 18m · a16z

Kevin Fu

0:00 / 0:00

gold bands on the timeline = statements, start to end. Hover to read, click to jump. CC turns on captions

In this presentation at the Andreessen Horowitz Academic Roundtable, Professor Kevin Fu examines the risks of analog cybersecurity in IoT and medical devices, demonstrating how hardware vulnerabilities, operational flaws, and physical signal interference expose critical systems to severe real-world security failures.

Chapters · click to jump

2 statements ▾

Fu: Wireless medical devices significantly improved patient safety by preventing infection open →

Fu: Wireless signals could trigger fatal heart rhythms in cardiac defibrillators open →

2 statements ▾

Fu: Few defibrillators last over 10 years unless nuclear-powered open →

Fu: Wireless connectivity is added to devices for marketing, not safety open →

3 statements ▾

Fu: Medical manufacturer bundled malware into a ventilator software update open →

Fu: Hospital medical device malware is mostly decade-old, automated malware open →

Fu: An infusion pump provided unauthenticated root access via telnet open →

4 statements ▾

Fu: Pacemakers can be tricked into shutting down via RF interference open →

Fu: Acoustic tones at 8 kHz can disable drones mid-flight open →

Fu: IoT security fails because devices blindly trust raw sensor data open →

Fu: Computer power draw from wall sockets leaks web browsing activity open →

1 statement ▾

Kevin Fu: The Best Startup Teams Form During Real-World Crises open →

How this conversation actually went

Every chapter scored 0–10 on four independent dynamics. Hover any point for the reasoning behind the score. How this is scored →

The host as informed peer 0.0 Guest teaching 2.0 Guest disagreement 0.0 The host pushing back 0.0

speaking balance: gold is the host, purple is the guest (3 minute bins)

Sharpest disagreement ▶ 8:00 Manufacturer Attaching Malware to Ventilator Update

Fu expresses strong sarcasm and criticism toward medical device manufacturers for distributing malware embedded within official ventilator software patches.

Hardest push from the host ▶ 13:20 Moderator Timekeeper Cue

With no host active in the monologue, the only pushback is an off-camera timekeeper signaling that Fu is running out of time.

Biggest teaching moment ▶ 11:25 Physics-Based Hardware Backdoors

Fu educates the audience on how physical wires act as unintentional antennas that can trick amplifiers and microprocessors using carrier waves.

The host holds their own ▶ 17:50 Presentation Wrap-up to Panel Transition

Because the host did not engage in the presentation, host expertise is absent, leaving only the standard transition cue at the presentation's end.

the scores for every segment, with the reasoning behind each

Topic	Guest teaching	Why
Defining Security Versus Correctness	2	Kevin Fu delivers a solo keynote presentation explaining the difference between software correctness and security models. The host does not speak or participate in this monologue segment.
The Wireless "Bacon" Analogy and Audience Q&A	2	Fu discusses wireless vulnerabilities in medical devices like defibrillators and answers an audience member's question. The host remains absent during the presentation.
Analog Attacks on IoT Sensors and Hardware Vulnerabilities	3	Fu details physical and analog side-channel attacks on sensors and hardware, referencing research on electromagnetic and acoustic interference. Host participation is zero, apart from an off-screen timekeeping signal.
Commercializing Malware Detection and Startup Team History	1	Fu concludes his talk by introducing his startup's power analysis malware detection product and describing his team history before wrapping up for the panel Q&A.

Statements from this episode (12)

Assertion Partly supported

Fu: Wireless medical devices significantly improved patient safety by preventing infection

“Wireless addressed a specific risk, that is infection. So it was a tremendous leap, ah, in, in safety by introducing wireless”

Kevin Fu Jul 28, 2017 ▶ 3:15

Assertion Supported

Fu: Wireless signals could trigger fatal heart rhythms in cardiac defibrillators

“We discovered we could actually generate our own wireless signals that would trigger this, what is effectively a debugging command to wirelessly induce fatal heart rhythms.”

Kevin Fu Jul 28, 2017 ▶ 5:17

Assertion Partly supported

Fu: Few defibrillators last over 10 years unless nuclear-powered

“There are only a few people who have defibrillators more than 10 years old. That's because there used to be some polonium-based batteries, nuclear-powered batteries, and those typically outlast the patient.”

Kevin Fu Jul 28, 2017 ▶ 5:57

Opinion

Fu: Wireless connectivity is added to devices for marketing, not safety

“But the interesting thing about wireless is that, you know, it was used for a specific reason, to address the clinical risk, but now I often see it used sort of willy-nilly on devices, more for the marketing side, less for actually addressing a safety risk, bu…”

Kevin Fu Jul 28, 2017 ▶ 6:09

Assertion Supported

Fu: Medical manufacturer bundled malware into a ventilator software update

“This medical device manufacturer was attaching this bonus piece of malware to the software update for ventilators.”

Kevin Fu Jul 28, 2017 ▶ 8:47

Assertion Not checkable as stated

Fu: Hospital medical device malware is mostly decade-old, automated malware

“There's, it's nothing too sophisticated. We're not talking about nation state adversaries or even the kid in the basement trying to hack into things. This is garden variety malware automated, sometimes 10 or 15 years old getting in.”

Kevin Fu Jul 28, 2017 ▶ 9:09

Assertion Supported

Fu: An infusion pump provided unauthenticated root access via telnet

“He discovered that there was actually if you tell net to port 23, you get a root shell.”

Kevin Fu Jul 28, 2017 ▶ 9:48

Assertion Supported

Fu: Pacemakers can be tricked into shutting down via RF interference

“A fun little trick you can do is if you send a particular pulse at a rate that looks like a normal cardiac rhythm in this case one hertz, so 60 beats per minute we've been able to trick pacemakers into effectively turning off because they say, oh, the heart is…”

Kevin Fu Jul 28, 2017 ▶ 13:28

Assertion Supported

Fu: Acoustic tones at 8 kHz can disable drones mid-flight

“He discovered if you send acoustic tones to a particular drone, you can cause the drone to fall out of the sky, because the MEMS accelerometer on the inside of the chip has a resonant frequency, and if you hit it at eight kilohertz, It just tricks that little …”

Kevin Fu Jul 28, 2017 ▶ 14:36

Insight

Fu: IoT security fails because devices blindly trust raw sensor data

“So the lesson on sensors is basically trust but verify. A lot of IoT devices are taking in sensor data, and they're just acting on it blindly, but you need a way to verify that what you're sensing is actually a real physical phenomena.”

Kevin Fu Jul 28, 2017 ▶ 15:34

Assertion Supported

Fu: Computer power draw from wall sockets leaks web browsing activity

“One of my students discovered that ah, he could actually tell what website I'm browsing by looking at my power consumption from the power outlet.”

Kevin Fu Jul 28, 2017 ▶ 15:47

Insight

Kevin Fu: The Best Startup Teams Form During Real-World Crises

“What I discovered was the best way to find a team for a startup is you get a bunch of people to help you out in crisis, and the people who work well together, they're gonna stick around.”

Kevin Fu Jul 28, 2017 ▶ 16:41

Kevin Fu

How this conversation actually went

Statements from this episode (12)

Turn any episode into a week of clips.