Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan • Hacker News Board

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#91

Post by HeyLaughingBoy » Sat, May 07, 2016, 10:27 PM UTC

tremon wrote: post #64

x0x0 wrote: post #63

Earlier quoted context omitted.

I worked on similar software that ran on Windows, though the decision was made 18 years ago. It was driven by: * GUI dev tools were an order of magnitude better than under linux * nidaq (very common daq and dio cards) didn't have or had flaky linux drivers. usb may be a better choice today but was not then available. Plus it's convenient/less expensive to push functionality to the computer side and minimize embedded…

every software update to the machine has to be FDA certified Interesting. Does that imply that every Windows update Microsoft releases has been FDA-certified already?

His characterization is not quite accurate. FDA does not certify it; rather, the company building the medical device certifies to the FDA that it has been properly validated for use and the FDA accepts their validation.

Trust in the company's ability to properly validate the device is tempered by regular FDA (and other regulatory bodies) audits of their development process and process data, test reports and a general desire to stay in business. FDA can and will take your product off the market if it appears to be unsafe and the company does not respond appropriately.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#92

Post by DyslexicAtheist » Sat, May 07, 2016, 10:27 PM UTC

Amezarak wrote: post #47

ChuckMcM wrote: post #42

Earlier quoted context omitted.

I think you have it backwards (no disrespect intended). When you evaluate the choice of Windows you have to acknowledge that it brings with it the vulnerability of viruses and so the necessity of anti-virus software. Either you own that decision, and as part of your support your tool provides the necessary antivirus and you also insure through testing configuration management that its configured appropriately, or you…

> When you evaluate the choice of Windows you have to acknowledge that it brings with it the vulnerability of viruses and so the necessity of anti-virus software. No matter what OS you choose it is vulnerable to viruses. You and I will agree that the odds are your Windows system is much more at risk by at least an order of magnitude. But the IA people who demanded that this system run antivirus are just as likely to…

> You and I will agree that the odds are your Windows system is much more at risk by at least an order of magnitude

it is a common misconception that Windows is still worse a platform than Linux when it comes to security. Not trolling ... I'm using Linux since '96 and built my life and career on it. Opinion of some people in infosec circles (@thegrugq @csoghoian ...) is that Windows no longer lags behind:

https://grugq.github.io/presentations/COMSEC%20beyond%20encr...

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#93

Post by Blackthorn » Sat, May 07, 2016, 10:30 PM UTC

symtos wrote: post #90

Blackthorn wrote: post #72

Earlier quoted context omitted.

> Any change to the medical equipment requires another authorization or it's prohibited. Honestly, this isn't a bad decision. If the device was tested and certified with specific software, a software upgrade is not guaranteed to not cause a problem.

using software with known problems in order to avoid potential problems from an upgrade does not seem like a non-bad decision

Is the medical device working right now? Yes. Could, upon upgrading, the device stop working, possibly in a subtle way that might kill somebody? Yes.

The approval process for medical devices is rightfully difficult. Software upgrades, even if they seem trivial, should not be a backdoor process of bypassing testing and approval.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#94

Post by wpietri » Sat, May 07, 2016, 10:31 PM UTC

sillysaurus3 wrote: post #83

Avernar wrote: post #77

"Merge says the antivirus froze access to crucial data acquired during the heart catheterization. Unable to access real-time data, the app crashed spectacularly. The company claims that they included proper instructions in their documentation, advising companies to whitelist Merge Hemo's folders in order to prevent crashes from happening, so it seems that the whole incident was nothing more than an oversight on the m…

Software shouldn't necessarily try to account for errors in that manner. Usually, the most graceful thing to do is to exit cleanly. For example, if there is a massive amount of data, it has to be stored on disk. It's too large to keep in memory. And if the point of the program is to transform that data in real time, then it has to have access to the disk. The antivirus basically unplugged the disk. What can it do to…

I totally disagree.

Sure, usually the most graceful thing to do is exit and hope a human fixes it. But that's usual because the usual condition is that sudden failure is NBD and a human is right there to screw with it.

That's becoming less common, though. When software was mostly something running on a PC doing some boring office task, reliability didn't matter. But as software is running our airplanes, our cars, our medical devices, and even, as with implanted pacemakers and insulin pumps, our bodies, then reliability gos from NBD to BFD.

We see the way forward with things Chaos Monkey [1] and crash-only software [2] and the sort of design for failure you see in things like Agent supervisor hierarchies [3], where the way to reliability is through designing for failure recovery from the beginning and testing thoroughly to make sure it really happens.

[1] https://github.com/Netflix/SimianArmy/wiki/Chaos-Monkey

[2] https://en.wikipedia.org/wiki/Crash-only_software

[3] http://doc.akka.io/docs/akka/snapshot/scala/fault-tolerance....

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#95

Post by sillysaurus3 » Sat, May 07, 2016, 10:32 PM UTC

wpietri wrote: post #94

sillysaurus3 wrote: post #83

Earlier quoted context omitted.

Software shouldn't necessarily try to account for errors in that manner. Usually, the most graceful thing to do is to exit cleanly. For example, if there is a massive amount of data, it has to be stored on disk. It's too large to keep in memory. And if the point of the program is to transform that data in real time, then it has to have access to the disk. The antivirus basically unplugged the disk. What can it do to…

I totally disagree. Sure, usually the most graceful thing to do is exit and hope a human fixes it. But that's usual because the usual condition is that sudden failure is NBD and a human is right there to screw with it. That's becoming less common, though. When software was mostly something running on a PC doing some boring office task, reliability didn't matter. But as software is running our airplanes, our cars, our…

It wasn't a rhetorical question. What could this program possibly do to recover?

If the CPU fails, no one would say the program was unreliable.

In this case, the disk failed, because the antivirus unplugged it. Was the program unreliable?

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#96

Post by Avernar » Sat, May 07, 2016, 10:33 PM UTC

sillysaurus3 wrote: post #83

Avernar wrote: post #77

"Merge says the antivirus froze access to crucial data acquired during the heart catheterization. Unable to access real-time data, the app crashed spectacularly. The company claims that they included proper instructions in their documentation, advising companies to whitelist Merge Hemo's folders in order to prevent crashes from happening, so it seems that the whole incident was nothing more than an oversight on the m…

Software shouldn't necessarily try to account for errors in that manner. Usually, the most graceful thing to do is to exit cleanly. For example, if there is a massive amount of data, it has to be stored on disk. It's too large to keep in memory. And if the point of the program is to transform that data in real time, then it has to have access to the disk. The antivirus basically unplugged the disk. What can it do to…

> When the disk is plugged back in, it should be able to restart without any problems. But I think that's a different kind of resiliency than what you're referring to.

Yes and no. I was referring to restarting internally when the error condition went away but restarting the app and waiting for telemetry to return can be a valid solution.

Think of your torrent software. If you crank your firewall to block it while it's running it will not crash. If your disk fills up it won't crash. When the network comes back or more drive space if freed it will restart it's internal mechanisms. You wouldn't want it to restart in these conditions. If it runs out of memory however choosing to exit might be the best recovery mechanism.

I think a life critical medical application can at least strive for internal restart and do an external restart if all else failed. The article stated they had to reboot the machine to get it back. Now that's way worse.

> The situation in the article seems closer to hardware failure than a design oversight.

Hardware failure is almost always a permanent condition. This was a "my I/O stopped briefly and would have came back if my code could handle it".

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#97

Post by copperx » Sat, May 07, 2016, 10:34 PM UTC

ams6110 wrote: post #85

ktRolster wrote: post #43

Earlier quoted context omitted.

Then this story about viruses at a nuclear power plant won't make you feel any better: http://www.reuters.com/article/us-nuclearpower-cyber-germany... Some great quotes: "Mikko Hypponen, chief research officer for Finland-based F-Secure, said that infections of critical infrastructure were surprisingly common" "Hypponen said he had recently spoken to a European aircraft maker that said it cleans the cockpits of its p…

Sounds suspect to me. Aircraft computers are not running Android.

I'm pretty sure the entertainment system runs on some version of Android.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#98

Post by sillysaurus3 » Sat, May 07, 2016, 10:40 PM UTC

Avernar wrote: post #96

sillysaurus3 wrote: post #83

Earlier quoted context omitted.

Software shouldn't necessarily try to account for errors in that manner. Usually, the most graceful thing to do is to exit cleanly. For example, if there is a massive amount of data, it has to be stored on disk. It's too large to keep in memory. And if the point of the program is to transform that data in real time, then it has to have access to the disk. The antivirus basically unplugged the disk. What can it do to…

> When the disk is plugged back in, it should be able to restart without any problems. But I think that's a different kind of resiliency than what you're referring to. Yes and no. I was referring to restarting internally when the error condition went away but restarting the app and waiting for telemetry to return can be a valid solution. Think of your torrent software. If you crank your firewall to block it while it'…

During a surgery, the program doesn't have the luxury of showing a screen that says "No telemetry available." Such a program would be considered equally unreliable. Worse, it would lead to confusion: "Why is the telemetry unavailable? What does 'Error Code 2931' mean?"

A spectacular crash immediately led to pinpointing the problem: The antivirus.

If the program's sole purpose is to transform a massive amount of data in real time, it must have disk access by definition. It can't not have disk access. What would you suggest it do?

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#99

Post by Avernar » Sat, May 07, 2016, 10:40 PM UTC

sillysaurus3 wrote: post #95

wpietri wrote: post #94

Earlier quoted context omitted.

I totally disagree. Sure, usually the most graceful thing to do is exit and hope a human fixes it. But that's usual because the usual condition is that sudden failure is NBD and a human is right there to screw with it. That's becoming less common, though. When software was mostly something running on a PC doing some boring office task, reliability didn't matter. But as software is running our airplanes, our cars, our…

It wasn't a rhetorical question. What could this program possibly do to recover? If the CPU fails, no one would say the program was unreliable. In this case, the disk failed, because the antivirus unplugged it. Was the program unreliable?

The disk did not fail. An I/O operation failed. The first is a permanent condition, the second can be permanent or transient. Big difference.

In Linux a signal can cause an I/O to fail. In Windows it's antivirus and other background tasks can cause I/O to fail.

What can it do to recover? Retry the I/O operation! It should keep trying until the operator tells it to stop.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#100

Post by sillysaurus3 » Sat, May 07, 2016, 10:49 PM UTC

Avernar wrote: post #99

sillysaurus3 wrote: post #95

Earlier quoted context omitted.

It wasn't a rhetorical question. What could this program possibly do to recover? If the CPU fails, no one would say the program was unreliable. In this case, the disk failed, because the antivirus unplugged it. Was the program unreliable?

The disk did not fail. An I/O operation failed. The first is a permanent condition, the second can be permanent or transient. Big difference. In Linux a signal can cause an I/O to fail. In Windows it's antivirus and other background tasks can cause I/O to fail. What can it do to recover? Retry the I/O operation! It should keep trying until the operator tells it to stop.

In that scenario, your surgeon would see the program suddenly freeze.

The program likely looks like this: data acquisition -> transformation -> display transformation on monitor.

If the transformation step fails, the monitor will end up displaying (a) nothing, (b) random data, or (c) the most recent image. None of these help the surgeon continue surgery. It's the same as a crash.

If your environment fails, there's nothing you can do to recover. Planes aren't designed to survive the loss of a wing. Why is this case any different?