Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

news.softpedia.com

Post reply on HN
Print view View original

61–70 of 211 posts

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#61

Post by chapium »

raverbashing wrote: post #15
11thEarlOfMar wrote: post #2

/rant/ I can't tell you how many times we've chased down field problems that ultimately were the result of antivirus scans. It's been so bad, that one of the first questions we now ask when we get a tool-down report is "is there antivirus running and what is the configuration?" Bringing Windows into the architecture of any type of capital equipment control system is a bane. A scourge. I mean to say, it really is a mi…

This This machines costs hundreds of thousands of dollars. There should be no excuse for using Windows. None. I would not be surprised if the "antivirus" thing was some PHB requirement

To be honest, there is an excuse, although not a very good one. The machine is costly because it is in high demand. R&D and pushing this through regulatory control are costly. This company has great incentives to cut costs to remain competitive.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#62

Post by tremon »

stephengillie wrote: post #44
enraged_camel wrote: post #40

Earlier quoted context omitted.

A lot of those machines have Windows embedded in them, because a lot of doctors and nurses are really, really bad with technology and cannot use anything more complicated than Windows's familiar user interface. Training involves "OK, now use the mouse and double-click this icon on the desktop to start the program." I wish I was kidding.

Windows is a familiar interface for computers. Is there a good reason for not using a familiar user interface?

Huh? Of course there is. "Familiar interface" isn't even a functional requirement, it is only of secondary importance for any system. Actual functionality is much more important.

As an aside, if "familiar interface" is your only requirement, I'd suggest to install a door handle or light switch.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#63

Post by x0x0 »

raverbashing wrote: post #36
Amezarak wrote: post #32

Earlier quoted context omitted.

Is there a reason to believe that choosing Windows was a bad decision? The bad decision was installing antivirus software. Otherwise, most any modern OS would be fine. This machine probably shouldn't be connected to a network (if it was), the USB ports should be disabled; data can come off on burned CDs, autorun should be disabled, etc. That's how you deal with IA concerns on a standalone mission-critical system, not…

You're right. My bet is that they use windows because they want to save or get something from the machine (either to a USB drive or network) And I would have followed the same steps you mentioned. The machine could work with Windows. Windows CE might have been a better pick, so you can have things like RO filesystem, etc "There is no reason to use Windows" is, as you mentioned, not a bad decision in itself, but since…

I worked on similar software that ran on Windows, though the decision was made 18 years ago. It was driven by:

* GUI dev tools were an order of magnitude better than under linux

* nidaq (very common daq and dio cards) didn't have or had flaky linux drivers. usb may be a better choice today but was not then available. Plus it's convenient/less expensive to push functionality to the computer side and minimize embedded development.

* in the beginning (though we fixed this mistake), we shipped software, our machine, and a ni-daq card; users provided a computer. This was a nightmare. We ended up shipping whole computers custom built by Dell to our specs with ni-daq cards installed (and later glued in to prevent them slipping out during shipping) plus our custom system images. At the time, I don't think Dell would do this for linux; you could find other vendors that would, but they weren't easy to work with or much more expensive.

* Nobody is eager to switch OSes because every software update to the machine has to be FDA certified (ie kiss at least $100k goodbye), so the company is very risk averse. Beyond even the cost to rewrite what has evolved into a relatively complicated gui app.

* As mentioned elsewhere, once you leave windows you have to train people to use linux guis that historically had window managers / gui toolkits that didn't work like windows.

All of the above is complicated by the fact most of these medical device companies pay their devs shit and have trouble hiring good devs. (Engineering shortage, obviously!)

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#64

Post by tremon »

x0x0 wrote: post #63
raverbashing wrote: post #36

Earlier quoted context omitted.

You're right. My bet is that they use windows because they want to save or get something from the machine (either to a USB drive or network) And I would have followed the same steps you mentioned. The machine could work with Windows. Windows CE might have been a better pick, so you can have things like RO filesystem, etc "There is no reason to use Windows" is, as you mentioned, not a bad decision in itself, but since…

I worked on similar software that ran on Windows, though the decision was made 18 years ago. It was driven by: * GUI dev tools were an order of magnitude better than under linux * nidaq (very common daq and dio cards) didn't have or had flaky linux drivers. usb may be a better choice today but was not then available. Plus it's convenient/less expensive to push functionality to the computer side and minimize embedded…

every software update to the machine has to be FDA certified

Interesting. Does that imply that every Windows update Microsoft releases has been FDA-certified already?

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#65

Post by afarrell »

enraged_camel wrote: post #40
raverbashing wrote: post #36

Earlier quoted context omitted.

You're right. My bet is that they use windows because they want to save or get something from the machine (either to a USB drive or network) And I would have followed the same steps you mentioned. The machine could work with Windows. Windows CE might have been a better pick, so you can have things like RO filesystem, etc "There is no reason to use Windows" is, as you mentioned, not a bad decision in itself, but since…

A lot of those machines have Windows embedded in them, because a lot of doctors and nurses are really, really bad with technology and cannot use anything more complicated than Windows's familiar user interface. Training involves "OK, now use the mouse and double-click this icon on the desktop to start the program." I wish I was kidding.

> I wish I was kidding

I know that "tired person in a hurry" is a trope, but considering how masochistic the health professions are about sleep, it really applies here.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#66

Post by seanp2k2 »

tremon wrote: post #62
stephengillie wrote: post #44

Earlier quoted context omitted.

Windows is a familiar interface for computers. Is there a good reason for not using a familiar user interface?

Huh? Of course there is. "Familiar interface" isn't even a functional requirement, it is only of secondary importance for any system. Actual functionality is much more important. As an aside, if "familiar interface" is your only requirement, I'd suggest to install a door handle or light switch.

Your comment may sound sarcastic on the first read, but I agree with the point; don't use Windows when what you needed could be done with a micro controller or a physical circuit. Not sure if the application here fits that at all, but I've definitely seen things like you-do-it check-outs, ATMs, billboards, etc running Windows. I would think that these systems would be much better off with something like a hardened micro controller running a remote display system vs a multi-gigabyte operating system.

With Windows 10, this problem will likely get a whole lot worse. What do you do when MS pushes a forced update to your deployed devices and it bricks some of them? http://m.theregister.co.uk/2016/05/06/microsoft_update_asus_...

What about when you can't disable Cortana (without breaking the start menu) and you're in a HIPAA / PCI environment? http://winaero.com/blog/how-to-uninstall-and-remove-cortana-...

As we've seen with things like SCADA, switching from Windows is not a silver bullet, but in terms of minimizing the complexity and attack surface, Windows seems to be starting at the opposite end of the spectrum.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#67

Post by makomk »

pdkl95 wrote: post #23
tluyben2 wrote: post #9

Earlier quoted context omitted.

But when Windows is chosen because it is easier to find coders who will 'remain within the budget' (cheapcheap) and cannot even make sure the virus scanner doesn't run during procedures or at all it goes a bit too far.

"Cheaper" or "remain within the budget" doesn't excuse using inadequate parts that don't meet the design requirements. Unfortunately, this total disregard for safety isn't just software anymore. When we stat skipping lessons that we've know for a looooooonng time (such as why a split bobbin is an important feature in a transformer[1]), we have evidence of a serious need for strongly enforced regulation. [1] https://n…

Sometimes it's all about tradeoffs. For example, a split bobbin is actually undesirable in most transformers because it reduces coupling between the windings, reducing the efficiency of the power supply. That's why if you look inside a better-quality power supply you'll often find that they have a split bobbin for the input common-mode choke and then a single bobbin with layered windings for the main transformer.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#68

Post by tremon »

fencepost wrote: post #53

I see a bunch of folks talking about whether PCs are connected to the Internet and "why was it running antivirus in the first place?" It's called Defense in Depth. It Does Not Matter if the device is connected to/able to reach the Internet. First, it probably can reach the Internet in some way simply by being networked. I don't think I've ever seen a medical office (can't speak about hospitals) where medical diagnost…

it probably can reach the Internet in some way simply by being networked

That is simply untrue, you can (and in many cases should) have unroutable subnets. But even if true, that only slightly changes the question: why is operating room equipment networked in the first place? That you've never encountered a proper setup doesn't excuse not having it.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#69

Post by Cheapshot1 »

Diederich wrote: post #59
Amezarak wrote: post #47

Earlier quoted context omitted.

> When you evaluate the choice of Windows you have to acknowledge that it brings with it the vulnerability of viruses and so the necessity of anti-virus software. No matter what OS you choose it is vulnerable to viruses. You and I will agree that the odds are your Windows system is much more at risk by at least an order of magnitude. But the IA people who demanded that this system run antivirus are just as likely to…

Is the day to day impact of antivirus on Linux the same as on Windows?

even better analogy is. Is the day to day impact of your own customized OS the same as windows. If the medical equipment ran independently we wouldn't have anything really to worry about.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#70

Post by rs999gti »

Kristine1975 wrote: post #31

Why is there a virus scanner on a PC inside the operating room? Don't tell me that PC is connected to the internet...

I was going to ask this as well. Why does this PC need to be connected to the internet? If it doesn't need to phone home while operating as a heart monitor then there is no need to have antivirus or have this PC connected to the internet.

Also, plenty of devices not connected to the internet run Windows: ATM's, Billboard, Monitors, etc.

Dumb IT is to blame for this mistake.

Post reply on HN