8 ms·

/rant/ I can't tell you how many times we've chased down field problems that ultimately were the result of antivirus scans. It's been so bad, that one of the f

/rant/ I can't tell you how many times we've chased down field problems that ultimately were the result of antivirus scans. It's been so bad, that one of the first questions we now ask when we get a tool-down report is "is there antivirus running and what is the configuration?" Bringing Windows into the architecture of any type of capital equipment control system is a bane. A scourge. I mean to say, it really is a misappropriation of software. Imagine, "Yeah, Frank only knows VB, so that's what we used for the aircraft's cockpit GUI." /xrant/

copperx 11y ago
I would expect these kinds of systems to be running a soft realtime OS. Or at the very least a run of the mill OS with no extraneous software running in the background.
- Dwolb 11y ago
  This. How are these devices not running on some sort of hardened OS seen in airplanes and automotive? Medical applications are mission critical (or some variant) and should have same (or better!) certification procedures set up for correctness and security.
  - aavotins 11y ago
    Second this. It is terrifying to know that mission critical, medical grade software runs on a consumer operating system. Military/aerospace systems have numerous requirements and clearly defined practices and ways of developing these systems, often going through various layers of documentation and using specifically designed programming languages(like the Z programming language) to write specifications, which are then re-written into code, but it seems like medical industry has been neglected.
    - ktRolster 11y ago
      Then this story about viruses at a nuclear power plant won't make you feel any better: http://www.reuters.com/article/us-nuclearpower-cyber-germany-idUSKCN0XN2OS http://www.reuters.com/article/us-nuclearpower-cyber-germany... Some great quotes: "Mikko Hypponen, chief research officer for Finland-based F-Secure, said that infections of critical infrastructure were surprisingly common" "Hypponen said he had recently spoken to a European aircraft maker that said it cleans the cockpits of its planes every week of malware designed for Android phones. The malware spread to the planes only because factory employees were charging their phones with the USB port in the cockpit."
      - zyxley 11y ago
        > The malware spread to the planes only because factory employees were charging their phones with the USB port in the cockpit. The moral of the story: If you include any kind of port in something, people WILL plug things into it sooner or later.
      - ams6110 11y ago
        Sounds suspect to me. Aircraft computers are not running Android.
        copperx 11y ago
        I'm pretty sure the entertainment system runs on some version of Android.
        koluft 11y ago
        They run USB, it doesn't matter what OS is on the other side.
        ams6110 11y ago
        Sure it does. If you plug a USB drive full of Windows viruses into a Linux box, nothing will happen.
        clay_to_n 11y ago
  - radicalbyte 11y ago
    I've been working in Medical for a couple of years... it's because Medical is extremely fault tolerant. They put up with a lot of rubbish that wouldn't be accepted in other industries. Aeronautical and Automotive are both engineering driven, Medical isn't, it's a big grey area.
  - wyldfire 11y ago
    You might be surprised to realize that many applications of medical devices are not used for affirmative life support and therefore should not be held to the same standards as aviation. This application (cath lab activity logging) is not a life-support activity. Product failures of any kind (either due to design error or product defect) represent a diminished capability of diagnosis and treatment. This does not represent a risk of harm to a patient. That said, some medical device manufacturers treat this aspect of design very seriously and go to great pains to use defeatured and heavily restricted OS and settings.
beachstartup 11y ago
correlation doesn't imply causation.... except when someone selected windows, and then made 50 other moronic decisions also. half the work done in this industry is just dealing with stupid decisions made by stupid people. i just accept this now.
- tluyben2 11y ago
  But when Windows is chosen because it is easier to find coders who will 'remain within the budget' (cheapcheap) and cannot even make sure the virus scanner doesn't run during procedures or at all it goes a bit too far.
  - pdkl95 11y ago
    "Cheaper" or "remain within the budget" doesn't excuse using inadequate parts that don't meet the design requirements. Unfortunately, this total disregard for safety isn't just software anymore. When we stat skipping lessons that we've know for a looooooonng time (such as why a split bobbin is an important feature in a transformer[1]), we have evidence of a serious need for strongly enforced regulation. [1] https://news.ycombinator.com/item?id=11474730 https://news.ycombinator.com/item?id=11474730
    - tluyben2 11y ago
      I know it doesn't, but unfortunately it is often how it works. More than I want to remember I have seen things like 'but lives depend on this!' or '100s of millions can get lost if this doesn't work!' and yet when the RFPs come back and something like InfoSys is chosen because big name and cheaper than experts in the field. Edit; > we have evidence of a serious need for strongly enforced regulation. Better education? But I guess strongly enforced regulation will force companies to not go for the cheapest solutions they can get away with which in turn will require people with actual knowledge in the field which will require better education, somehow.
      - pdkl95 11y ago
        Better education is always a great idea. Unfortunately, regulation becomes a necessary fix for immediate problems. Note that regulation is the nicer option; the other way to force people to get the necessary education is liability, which could get really ugly in the case of medical devices.
raverbashing 11y ago
This This machines costs hundreds of thousands of dollars. There should be no excuse for using Windows. None. I would not be surprised if the "antivirus" thing was some PHB requirement
- Amezarak 11y ago
  Is there a reason to believe that choosing Windows was a bad decision? The bad decision was installing antivirus software. Otherwise, most any modern OS would be fine. This machine probably shouldn't be connected to a network (if it was), the USB ports should be disabled; data can come off on burned CDs, autorun should be disabled, etc. That's how you deal with IA concerns on a standalone mission-critical system, not by installing antivirus.
  - raverbashing 11y ago
    You're right. My bet is that they use windows because they want to save or get something from the machine (either to a USB drive or network) And I would have followed the same steps you mentioned. The machine could work with Windows. Windows CE might have been a better pick, so you can have things like RO filesystem, etc "There is no reason to use Windows" is, as you mentioned, not a bad decision in itself, but since they do it the lazy way, it is awful. Not sure if there's an out-of-the-box way of firewalling everything in the Windows versions available at the time that machine was built
    - enraged_camel 11y ago
      A lot of those machines have Windows embedded in them, because a lot of doctors and nurses are really, really bad with technology and cannot use anything more complicated than Windows's familiar user interface. Training involves "OK, now use the mouse and double-click this icon on the desktop to start the program." I wish I was kidding.
      - stephengillie 11y ago
        Windows is a familiar interface for computers. Is there a good reason for not using a familiar user interface?
rwmj 11y ago
And if you want PCI-DSS [credit card handling] certification, then you'd better be running AV software, even when it's completely inappropriate.
rsync 11y ago
"Bringing Windows into the architecture of any type of capital equipment control system is a bane. A scourge." We need to go much further than this, since many people will "solve" this problem by using a different platform than Windows. In reality, bringing networking of any type into capital equipment control systems or critical infrastructure is the bane ... the scourge. Whatever convenience or perceived function that networking (including very local networking, like USB) is dramatically outweighed by the additional attack surface. Go back to sneakernet and check your facebook at home, Mr. Nuclear Plant Worker.
- CaptSpify 11y ago
  The issue with this is: Many of these systems need to send data to other system on the network. You'll have to send the data over some kind of PACS network, or you'll just have to use a USB. I agree that's a "better" setup than networking, but I still don't think having staff plug random usb devices into your medical equipment is a great idea either.

copperx 11y ago

I would expect these kinds of systems to be running a soft realtime OS. Or at the very least a run of the mill OS with no extraneous software running in the background.

Dwolb 11y ago
This. How are these devices not running on some sort of hardened OS seen in airplanes and automotive? Medical applications are mission critical (or some variant) and should have same (or better!) certification procedures set up for correctness and security.
- aavotins 11y ago
  Second this. It is terrifying to know that mission critical, medical grade software runs on a consumer operating system. Military/aerospace systems have numerous requirements and clearly defined practices and ways of developing these systems, often going through various layers of documentation and using specifically designed programming languages(like the Z programming language) to write specifications, which are then re-written into code, but it seems like medical industry has been neglected.
  - ktRolster 11y ago
    Then this story about viruses at a nuclear power plant won't make you feel any better: http://www.reuters.com/article/us-nuclearpower-cyber-germany-idUSKCN0XN2OS http://www.reuters.com/article/us-nuclearpower-cyber-germany... Some great quotes: "Mikko Hypponen, chief research officer for Finland-based F-Secure, said that infections of critical infrastructure were surprisingly common" "Hypponen said he had recently spoken to a European aircraft maker that said it cleans the cockpits of its planes every week of malware designed for Android phones. The malware spread to the planes only because factory employees were charging their phones with the USB port in the cockpit."
    - zyxley 11y ago
      > The malware spread to the planes only because factory employees were charging their phones with the USB port in the cockpit. The moral of the story: If you include any kind of port in something, people WILL plug things into it sooner or later.
    - ams6110 11y ago
      Sounds suspect to me. Aircraft computers are not running Android.
      - copperx 11y ago
        I'm pretty sure the entertainment system runs on some version of Android.
      - koluft 11y ago
        They run USB, it doesn't matter what OS is on the other side.
        ams6110 11y ago
        Sure it does. If you plug a USB drive full of Windows viruses into a Linux box, nothing will happen.
      - clay_to_n 11y ago
- radicalbyte 11y ago
  I've been working in Medical for a couple of years... it's because Medical is extremely fault tolerant. They put up with a lot of rubbish that wouldn't be accepted in other industries. Aeronautical and Automotive are both engineering driven, Medical isn't, it's a big grey area.
- wyldfire 11y ago
  You might be surprised to realize that many applications of medical devices are not used for affirmative life support and therefore should not be held to the same standards as aviation. This application (cath lab activity logging) is not a life-support activity. Product failures of any kind (either due to design error or product defect) represent a diminished capability of diagnosis and treatment. This does not represent a risk of harm to a patient. That said, some medical device manufacturers treat this aspect of design very seriously and go to great pains to use defeatured and heavily restricted OS and settings.

beachstartup 11y ago

correlation doesn't imply causation.... except when someone selected windows, and then made 50 other moronic decisions also. half the work done in this industry is just dealing with stupid decisions made by stupid people. i just accept this now.

tluyben2 11y ago
But when Windows is chosen because it is easier to find coders who will 'remain within the budget' (cheapcheap) and cannot even make sure the virus scanner doesn't run during procedures or at all it goes a bit too far.
- pdkl95 11y ago
  "Cheaper" or "remain within the budget" doesn't excuse using inadequate parts that don't meet the design requirements. Unfortunately, this total disregard for safety isn't just software anymore. When we stat skipping lessons that we've know for a looooooonng time (such as why a split bobbin is an important feature in a transformer[1]), we have evidence of a serious need for strongly enforced regulation. [1] https://news.ycombinator.com/item?id=11474730 https://news.ycombinator.com/item?id=11474730
  - tluyben2 11y ago
    I know it doesn't, but unfortunately it is often how it works. More than I want to remember I have seen things like 'but lives depend on this!' or '100s of millions can get lost if this doesn't work!' and yet when the RFPs come back and something like InfoSys is chosen because big name and cheaper than experts in the field. Edit; > we have evidence of a serious need for strongly enforced regulation. Better education? But I guess strongly enforced regulation will force companies to not go for the cheapest solutions they can get away with which in turn will require people with actual knowledge in the field which will require better education, somehow.
    - pdkl95 11y ago
      Better education is always a great idea. Unfortunately, regulation becomes a necessary fix for immediate problems. Note that regulation is the nicer option; the other way to force people to get the necessary education is liability, which could get really ugly in the case of medical devices.

raverbashing 11y ago

This This machines costs hundreds of thousands of dollars. There should be no excuse for using Windows. None. I would not be surprised if the "antivirus" thing was some PHB requirement

Amezarak 11y ago
Is there a reason to believe that choosing Windows was a bad decision? The bad decision was installing antivirus software. Otherwise, most any modern OS would be fine. This machine probably shouldn't be connected to a network (if it was), the USB ports should be disabled; data can come off on burned CDs, autorun should be disabled, etc. That's how you deal with IA concerns on a standalone mission-critical system, not by installing antivirus.
- raverbashing 11y ago
  You're right. My bet is that they use windows because they want to save or get something from the machine (either to a USB drive or network) And I would have followed the same steps you mentioned. The machine could work with Windows. Windows CE might have been a better pick, so you can have things like RO filesystem, etc "There is no reason to use Windows" is, as you mentioned, not a bad decision in itself, but since they do it the lazy way, it is awful. Not sure if there's an out-of-the-box way of firewalling everything in the Windows versions available at the time that machine was built
  - enraged_camel 11y ago
    A lot of those machines have Windows embedded in them, because a lot of doctors and nurses are really, really bad with technology and cannot use anything more complicated than Windows's familiar user interface. Training involves "OK, now use the mouse and double-click this icon on the desktop to start the program." I wish I was kidding.
    - stephengillie 11y ago
      Windows is a familiar interface for computers. Is there a good reason for not using a familiar user interface?

rwmj 11y ago

And if you want PCI-DSS [credit card handling] certification, then you'd better be running AV software, even when it's completely inappropriate.

rsync 11y ago

"Bringing Windows into the architecture of any type of capital equipment control system is a bane. A scourge." We need to go much further than this, since many people will "solve" this problem by using a different platform than Windows. In reality, bringing networking of any type into capital equipment control systems or critical infrastructure is the bane ... the scourge. Whatever convenience or perceived function that networking (including very local networking, like USB) is dramatically outweighed by the additional attack surface. Go back to sneakernet and check your facebook at home, Mr. Nuclear Plant Worker.

CaptSpify 11y ago
The issue with this is: Many of these systems need to send data to other system on the network. You'll have to send the data over some kind of PACS network, or you'll just have to use a USB. I agree that's a "better" setup than networking, but I still don't think having staff plug random usb devices into your medical equipment is a great idea either.