3 ms·

I can agree with this article. I work in medical equipment R&D and understand criticality. I have personally used competitors systems and am freaked out by the

I can agree with this article. I work in medical equipment R&D and understand criticality. I have personally used competitors systems and am freaked out by their security problems. "Want to see how to infect this system? Plug this thumb drive in. The OS is set to autorun. Or, lets just plug a keyboard in and hit CTRL-ALT-DEL open the task manager and lookie here, full access to the system as an admin user. Plug a network cord in... the C drive is fully shared all permissions. Well, at least the drive is RAIDed so that any malice that happens to this device has a failover backup. facepalm" My devices run Windows Embedded and they are locked down hard so that no unauthorized access. You aren't getting into the bios. You aren't getting into a permanent part of the file system. You aren't getting access via the usb port unless it is exactly what we want. Something on the system changes and fails a checksum test, we will know and the system will not allow usage. Our service people are the only ones allowed to make those types changes. There are replies on this post and the article seem to have a strong anti-Windows for the sake of being anti-Windows sentiment and shows an extreme lack of understanding on software and hardware configurations. "Herp-Derp Window$ BAD, use Linux". Windows itself is not inherently bad. I would make the same statement if someone just went with a full stock release of Ubuntu on a medical device. Most medical devices use Windows Embedded, not a full Windows install, and developers should strip it down to the bare essentials that they need, set up the write filter protection and lock their system down tight and anyone that gives a care about their patients would overprotect above the FDA guidance.

peterwwillis 14y ago
I don't think physical security is an issue. There's usually very little of value on the devices the clinicians use, so there's no reason to break into one. If you want sensitive patient data you go after the servers that receive and store data from the devices, or data entry computers. Hell, most desktops in hospitals contain sensitive patient information and malware is already on all of those because people are clicking on the 'INSTALL A VIRUS SCANNER ON MY PC' banner ads and admins are too lazy to lock down desktops. If anyone ever had the technical skill to sabotage medical device just to hurt or kill someone, it would be an extremely rare event. The real danger comes from automated malware that trawls networks or is attached to media and overwhelms or disables medical devices by accident. Malware that's just trying to find a home for a botnet can spread like wildfire and cause all kinds of havoc and is much more likely to be on the device right now. Alas, medical device manufacturers (like most 3rd-party vendors) design their product to the barest specifications of their customers. If the customer doesn't ask for security or a hardened OS, they aren't going to go out of their way to make it so.
- vacri 14y ago
  malware isn't just used by folks looking for financial gain, but also people that just want to be pricks. While they may not write their malware specifically to destroy a medical devices, it's not hard to see how a bit of malware might prevent system resources from being available at the right time. For example, in my previous career as a medical tech, I've seen multiple diagnoses of epileptic EEG hinge on the timing of a single frame of video.
- jgoewert 14y ago
  Actually, the physical security is important as well. The reason for this is USB viruses. I have seen one that still boggles my mind. It basically autoran on insert without displaying any sort of autorun dialog and then any stick that is inserted gets infected. With a medical device, you don't just worry about the intentionally malicious viruses that try to extort money via fake virus ads or steal record. You must make sure that the system operates as the system is supposed to operate. If in the middle of surgery, your system crashes because some virus tries to link in to a DLL load because the surgeon loaded their profile to the system with an infected usb stick, you have a problem. Imagine that you had a laser on to cut something and now it isn't getting a command to stop from the system. Guess what will happen? It doesn't need to be an intentional sabotage, unintentional does damage quite well. If your product has security issues, you don't just lose customers, you injure people.
arocks 14y ago
I think your comment narrows down only to medical devices. While I have noticed this problem mostly in workstations used by hospital administration which are networked and more prone to viruses. In any hospital, communication between departments is as critical as life support systems. Many times a malware infected system can cause minor but significant annoyances like sluggishness to random reboots. Thanks to a rich malware ecosystem, these systems are almost always based on Windows. So, I don't think that the anti-Windows sentiment is unwarranted. The visitors themselves see the ominous Blue Screen of Death on screens from time to time.

peterwwillis 14y ago

I don't think physical security is an issue. There's usually very little of value on the devices the clinicians use, so there's no reason to break into one. If you want sensitive patient data you go after the servers that receive and store data from the devices, or data entry computers. Hell, most desktops in hospitals contain sensitive patient information and malware is already on all of those because people are clicking on the 'INSTALL A VIRUS SCANNER ON MY PC' banner ads and admins are too lazy to lock down desktops. If anyone ever had the technical skill to sabotage medical device just to hurt or kill someone, it would be an extremely rare event. The real danger comes from automated malware that trawls networks or is attached to media and overwhelms or disables medical devices by accident. Malware that's just trying to find a home for a botnet can spread like wildfire and cause all kinds of havoc and is much more likely to be on the device right now. Alas, medical device manufacturers (like most 3rd-party vendors) design their product to the barest specifications of their customers. If the customer doesn't ask for security or a hardened OS, they aren't going to go out of their way to make it so.

vacri 14y ago
malware isn't just used by folks looking for financial gain, but also people that just want to be pricks. While they may not write their malware specifically to destroy a medical devices, it's not hard to see how a bit of malware might prevent system resources from being available at the right time. For example, in my previous career as a medical tech, I've seen multiple diagnoses of epileptic EEG hinge on the timing of a single frame of video.
jgoewert 14y ago
Actually, the physical security is important as well. The reason for this is USB viruses. I have seen one that still boggles my mind. It basically autoran on insert without displaying any sort of autorun dialog and then any stick that is inserted gets infected. With a medical device, you don't just worry about the intentionally malicious viruses that try to extort money via fake virus ads or steal record. You must make sure that the system operates as the system is supposed to operate. If in the middle of surgery, your system crashes because some virus tries to link in to a DLL load because the surgeon loaded their profile to the system with an infected usb stick, you have a problem. Imagine that you had a laser on to cut something and now it isn't getting a command to stop from the system. Guess what will happen? It doesn't need to be an intentional sabotage, unintentional does damage quite well. If your product has security issues, you don't just lose customers, you injure people.

arocks 14y ago

I think your comment narrows down only to medical devices. While I have noticed this problem mostly in workstations used by hospital administration which are networked and more prone to viruses. In any hospital, communication between departments is as critical as life support systems. Many times a malware infected system can cause minor but significant annoyances like sluggishness to random reboots. Thanks to a rich malware ecosystem, these systems are almost always based on Windows. So, I don't think that the anti-Windows sentiment is unwarranted. The visitors themselves see the ominous Blue Screen of Death on screens from time to time.