Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan • Hacker News Board

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#111

Post by jcrawfordor » Sat, May 07, 2016, 11:30 PM UTC

rs999gti wrote: post #70

Kristine1975 wrote: post #31

Why is there a virus scanner on a PC inside the operating room? Don't tell me that PC is connected to the internet...

I was going to ask this as well. Why does this PC need to be connected to the internet? If it doesn't need to phone home while operating as a heart monitor then there is no need to have antivirus or have this PC connected to the internet. Also, plenty of devices not connected to the internet run Windows: ATM's, Billboard, Monitors, etc. Dumb IT is to blame for this mistake.

> Also, plenty of devices not connected to the internet run Windows: ATM's, Billboard, Monitors, etc.

I hate to break it to you, but, in practice... these things are all typically connected to the internet.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#112

Post by koluft » Sat, May 07, 2016, 11:38 PM UTC

ams6110 wrote: post #85

ktRolster wrote: post #43

Earlier quoted context omitted.

Then this story about viruses at a nuclear power plant won't make you feel any better: http://www.reuters.com/article/us-nuclearpower-cyber-germany... Some great quotes: "Mikko Hypponen, chief research officer for Finland-based F-Secure, said that infections of critical infrastructure were surprisingly common" "Hypponen said he had recently spoken to a European aircraft maker that said it cleans the cockpits of its p…

Sounds suspect to me. Aircraft computers are not running Android.

They run USB, it doesn't matter what OS is on the other side.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#113

Post by mappu » Sat, May 07, 2016, 11:39 PM UTC

Avernar wrote: post #77

"Merge says the antivirus froze access to crucial data acquired during the heart catheterization. Unable to access real-time data, the app crashed spectacularly. The company claims that they included proper instructions in their documentation, advising companies to whitelist Merge Hemo's folders in order to prevent crashes from happening, so it seems that the whole incident was nothing more than an oversight on the m…

Better to crash (and restart quickly into a known state) than to enter a rare, untested code path.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#114

Post by brians » Sat, May 07, 2016, 11:42 PM UTC

mappu wrote: post #113

Avernar wrote: post #77

"Merge says the antivirus froze access to crucial data acquired during the heart catheterization. Unable to access real-time data, the app crashed spectacularly. The company claims that they included proper instructions in their documentation, advising companies to whitelist Merge Hemo's folders in order to prevent crashes from happening, so it seems that the whole incident was nothing more than an oversight on the m…

Better to crash (and restart quickly into a known state) than to enter a rare, untested code path.

For software critical to human life, test the rare code paths.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#115

Post by Coincoin » Sat, May 07, 2016, 11:55 PM UTC

wyager wrote: post #74

Amezarak wrote: post #47

Earlier quoted context omitted.

> When you evaluate the choice of Windows you have to acknowledge that it brings with it the vulnerability of viruses and so the necessity of anti-virus software. No matter what OS you choose it is vulnerable to viruses. You and I will agree that the odds are your Windows system is much more at risk by at least an order of magnitude. But the IA people who demanded that this system run antivirus are just as likely to…

>No matter what OS you choose it is vulnerable to viruses This may be theoretically true, but it is not practically the case. There is a reason Linux and OS X users almost never use antivirus software. Using Windows on a medical device is inexcusable. It's a heart monitor, not a game system.

Medical devices are used by humans. Humans, for some reason prefer and know Windows better. Why shouldn't the devices use Windows?

Today, doctors from a hospital the other side of the country can diagnose your cancer realtime while you are still in the MRI machine, and they do it with Windows, because that's what humans know and use.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#116

Post by CamperBob2 » Sat, May 07, 2016, 11:59 PM UTC

brians wrote: post #114

mappu wrote: post #113

Earlier quoted context omitted.

Better to crash (and restart quickly into a known state) than to enter a rare, untested code path.

For software critical to human life, test the rare code paths.

The easiest way to be sure a code path will run properly is to avoid writing it in the first place. This kind of application should be designed to run in a highly linear, predictable fashion on robust, fault-tolerant hardware.

Why is nobody questioning the propriety of using an off-the-shelf Windows PC in safety-of-life applications?

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#117

Post by malbs » Sun, May 08, 2016, 12:01 AM UTC

We've had issues with the latest versions of kaspersky. A burst of network activity is almost guaranteed to crash a machine.

It took us a while to isolate Kaspersky 10, and it's not even any particular component inside of Kaspersky, but only when all features are enabled. We tried different permutations of features to try and isolate the cause of our crashes, but as soon as you have any one feature disabled in, the crashes stop, Very frustrating because ultimately our clients laid the blame at my feet (new software feature, new release, blah blah blah), and not exactly much you can do in the way of hardening against this particular crash, the app generates a burst of network data, and boom, blue screen/instant reboot.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#118

Post by et2o » Sun, May 08, 2016, 12:10 AM UTC

enraged_camel wrote: post #40

raverbashing wrote: post #36

Earlier quoted context omitted.

You're right. My bet is that they use windows because they want to save or get something from the machine (either to a USB drive or network) And I would have followed the same steps you mentioned. The machine could work with Windows. Windows CE might have been a better pick, so you can have things like RO filesystem, etc "There is no reason to use Windows" is, as you mentioned, not a bad decision in itself, but since…

A lot of those machines have Windows embedded in them, because a lot of doctors and nurses are really, really bad with technology and cannot use anything more complicated than Windows's familiar user interface. Training involves "OK, now use the mouse and double-click this icon on the desktop to start the program." I wish I was kidding.

Surprised I had to scroll this far to find someone blaming a physicians.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#119

Post by ams6110 » Sun, May 08, 2016, 12:20 AM UTC

koluft wrote: post #112

ams6110 wrote: post #85

Earlier quoted context omitted.

Sounds suspect to me. Aircraft computers are not running Android.

They run USB, it doesn't matter what OS is on the other side.

Sure it does. If you plug a USB drive full of Windows viruses into a Linux box, nothing will happen.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#120

Post by dchichkov » Sun, May 08, 2016, 12:21 AM UTC

Let me surprise you, with the code quality that sometimes is running in what is actually 'life-critical' software.

Back in the nineties, I wrote a nice piece of some 300kb of C code, for DOS/x86. It was a complete software package, controlling medical equipment that was testing speed of blood coagulation. These tests are crucial in the patient post-operation recovery.

This piece of C code had some hardware control code, some statistics, a bit of math, some visualisation, GUI, etc. Normally, you'd imagine a team of 2-3 people, carefully written test cases, dedicated QA person, and a year of time to write something like it. And independend lab, that would certify the thing. Well... in that case, yes, there was independent certification... but...

It was just one developer, and I was 13, when I wrote it ;) During after-school time, in around 4-6 months. And I must say, I still sometimes have chills, when I think of the code quality, and, um, unorthodox solutions of 13-year-old myself. Yes, I've had some years of experience at the time, both writing software and designing hardware, and advice from my parents, who both could write software. But, at the time, I've had zero formal training, aside from reading K&R and PC XT manuals ;). So, you might imagine the code quality ;) Even, no need to imagine, I actually still have it somewhere in the archives :)