Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan • Hacker News Board

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#181

Post by morgante » Sun, May 08, 2016, 3:44 PM UTC

alephu5 wrote: post #179

morgante wrote: post #175

Earlier quoted context omitted.

Oh, I'm well aware of the difficulty of negotiating with product managers over timelines. The difference is that they never should get the decision to cut safety checks. Cutting safety checks should be as ludicrous/impossible as writing half the code of each function to cut time. The conversation should go like this: PM: "Does 3 weeks sound about right for this?" Dev: "No, we'll need 6" PM: "Why?" Dev: "That's how lo…

I agree with your sentiment 100%, but if you insist on doing things safely while your colleagues do not, you might get a reputation for being slow and be earmarked for replacement. Perhaps it's worth losing a job over, but your replacement will cut corners so the net effect is patients unsafe + you have no job. It feels reminiscent of the prisoner's dilemma.

Accreditations and professional standards are literally textbook solutions for solving prisoner's dilemmas.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#182

Post by GunboatDiplomat » Sun, May 08, 2016, 3:48 PM UTC

ars wrote: post #131

riyadparvez wrote: post #10

Earlier quoted context omitted.

That was my first thought too. And why there is an anti-virus running? This equipment should not be connected to the internet nor some staff should plug-in a flash drive on the first place.

That's not true. They have to keep a record of the data for the patient file. So it does have to communicate remotely in some fashion.

Could communicate with a gateway bridging a private medical devices network and a public network. That seems a reasonable way to provide control and access.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#183

Post by Keyframe » Sun, May 08, 2016, 4:00 PM UTC

dchichkov wrote: post #120

Let me surprise you, with the code quality that sometimes is running in what is actually 'life-critical' software. Back in the nineties, I wrote a nice piece of some 300kb of C code, for DOS/x86. It was a complete software package, controlling medical equipment that was testing speed of blood coagulation. These tests are crucial in the patient post-operation recovery. This piece of C code had some hardware control co…

Quite a story! I wrote a program for a dentist office (not my dentist) when I was 13 and got paid! It was a program to track their patients and stuff though, nothing critical. What was peculiar about this was that the dentist asked me if I can write the software in Turbo Pascal. That's the only language he, kind of, understood and he wanted to maintain it later when I write it. I didn't know Pascal, I only knew C at the time, but I accepted the challenge and wrote my first and only program in TP. It was kind of elaborate, especially for a 13 year-old, but also fun (BGI!).

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#184

Post by ryandrake » Sun, May 08, 2016, 4:22 PM UTC

Avernar wrote: post #77

"Merge says the antivirus froze access to crucial data acquired during the heart catheterization. Unable to access real-time data, the app crashed spectacularly. The company claims that they included proper instructions in their documentation, advising companies to whitelist Merge Hemo's folders in order to prevent crashes from happening, so it seems that the whole incident was nothing more than an oversight on the m…

You can't get enough up votes. Crashing because an I/O operation fails? That's sounds like simply a bug in the software. The developer didn't handle an error properly, and QA didn't test the software on an environment with elevated I/O activity. I've done enough code reviews over the years and seen enough ignoring errors from read(), ignoring malloc() returning null, not handling exceptions, etc. Good developers give a shit but many just don't care at all and think crashing or exiting when you're out of disk space is just fine.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#185

Post by rsync » Sun, May 08, 2016, 4:36 PM UTC

11thEarlOfMar wrote: post #2

/rant/ I can't tell you how many times we've chased down field problems that ultimately were the result of antivirus scans. It's been so bad, that one of the first questions we now ask when we get a tool-down report is "is there antivirus running and what is the configuration?" Bringing Windows into the architecture of any type of capital equipment control system is a bane. A scourge. I mean to say, it really is a mi…

"Bringing Windows into the architecture of any type of capital equipment control system is a bane. A scourge."

We need to go much further than this, since many people will "solve" this problem by using a different platform than Windows.

In reality, bringing networking of any type into capital equipment control systems or critical infrastructure is the bane ... the scourge.

Whatever convenience or perceived function that networking (including very local networking, like USB) is dramatically outweighed by the additional attack surface.

Go back to sneakernet and check your facebook at home, Mr. Nuclear Plant Worker.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#186

Post by lfowles » Sun, May 08, 2016, 5:01 PM UTC

JackdawX wrote: post #164

scruple wrote: post #150

Earlier quoted context omitted.

> I find it amazingly short sited that antivirus software is even allowed on a medical device to begin with. Well... Then you should consider yourself blessed to have never had to deal with the bureaucracy of a hospital IT department and administrative staff. Who owns the medical device? Who paid for it? If it's a glorified Windows machine and it's attaching itself to a hospitals WiFi network... Who has to use this m…

> Yes, we do "have to meet FDA compliance." I can't define "have to meet" and I work here. Of course, I'm just an engineer. You are not an engineer. This is a protected term in the US and other countries. If you were a professional engineer, you would be bound by a legal and moral framework preventing you from doing work on unsafe medical equipment. There is a good argument that there should be a software equivalent…

Engineer alone is not a protected term in the US. "Professional Engineer" is.

As of 2012 you can take the PE Exam for Software Engineering [1].

[1]: http://ncees.org/about-ncees/news/ncees-introduces-pe-exam-f...

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#187

Post by nickpsecurity » Sun, May 08, 2016, 5:13 PM UTC

Avernar wrote: post #102

sillysaurus3 wrote: post #98

Earlier quoted context omitted.

During a surgery, the program doesn't have the luxury of showing a screen that says "No telemetry available." Such a program would be considered equally unreliable. Worse, it would lead to confusion: "Why is the telemetry unavailable? What does 'Error Code 2931' mean?" A spectacular crash immediately led to pinpointing the problem: The antivirus. If the program's sole purpose is to transform a massive amount of data…

Yes it does! Showing "no telemetry available" is exactly what it should do. Crashing = unreliable. Reporting an error condition = reliable. Immediately? Took them 5 minutes to reboot the computer. The scan of the folder would take seconds let alone minutes. Pinpointing the problem is secondary. Not killing the patient is primary. > If the program's sole purpose is to transform a massive amount of data in real time, i…

" Avernar 18 hours ago

Yes it does! Showing "no telemetry available" is exactly what it should do. Crashing = unreliable. Reporting an error condition = reliable.

Immediately? Took them 5 minutes to reboot the computer. The scan of the folder would take seconds let alone minutes. Pinpointing the problem is secondary. Not killing the patient is primary."

Well-put. Far back as Burroughs B5000, the best way to handle erroneous software or I/O was to freeze it, notify the administrator/user of the problem, and give them sensible options for how to proceed. They might restart the I/O, restart the app, modify erroneous data to proceed (rare here), and so on. Crash and reboot is a Windows 95/NT strategy where incompetence dominated. Today's Windows OS and tooling can do much better with little effort by developers.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#188

Post by nickpsecurity » Sun, May 08, 2016, 5:17 PM UTC

Amezarak wrote: post #47

ChuckMcM wrote: post #42

Earlier quoted context omitted.

I think you have it backwards (no disrespect intended). When you evaluate the choice of Windows you have to acknowledge that it brings with it the vulnerability of viruses and so the necessity of anti-virus software. Either you own that decision, and as part of your support your tool provides the necessary antivirus and you also insure through testing configuration management that its configured appropriately, or you…

> When you evaluate the choice of Windows you have to acknowledge that it brings with it the vulnerability of viruses and so the necessity of anti-virus software. No matter what OS you choose it is vulnerable to viruses. You and I will agree that the odds are your Windows system is much more at risk by at least an order of magnitude. But the IA people who demanded that this system run antivirus are just as likely to…

"No matter what OS you choose it is vulnerable to viruses. You and I will agree that the odds are your Windows system is much more at risk by at least an order of magnitude. But the IA people who demanded that this system run antivirus are just as likely to demand that Linux run antivirus"

That's not true for what those systems should be really running which is separation kernel platforms. These isolated tasks in partitions using high-assurance kernels designed to not fail in every way you can think of and with almost no code to hit. The apps even donate their own resources for kernel calls. Interface is in untrusted VM that sends checked commands to real software running on isolated partition optionally on Ada or Java runtime for memory-safety. Anti-virus is not available and not necessary given the untrusted part is strongly contained & the trusted part is memory safe.

http://www.ghs.com/products/safety_critical/integrity-do-178...

https://os.inf.tu-dresden.de/papers_ps/nizza.pdf

Just a matter of using right tools for the job. Any medical device using Windows or any other complex OS isn't doing it right. Even OpenBSD would've been a better choice given it rarely is hacked, crashes, or needs updates. Antivirus software wouldn't run as it's not available for these. It would be a network appliance or something that didn't affect running system.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#189

Post by CaptSpify » Sun, May 08, 2016, 5:20 PM UTC

rsync wrote: post #185

11thEarlOfMar wrote: post #2

/rant/ I can't tell you how many times we've chased down field problems that ultimately were the result of antivirus scans. It's been so bad, that one of the first questions we now ask when we get a tool-down report is "is there antivirus running and what is the configuration?" Bringing Windows into the architecture of any type of capital equipment control system is a bane. A scourge. I mean to say, it really is a mi…

"Bringing Windows into the architecture of any type of capital equipment control system is a bane. A scourge." We need to go much further than this, since many people will "solve" this problem by using a different platform than Windows. In reality, bringing networking of any type into capital equipment control systems or critical infrastructure is the bane ... the scourge. Whatever convenience or perceived function t…

The issue with this is: Many of these systems need to send data to other system on the network. You'll have to send the data over some kind of PACS network, or you'll just have to use a USB.

I agree that's a "better" setup than networking, but I still don't think having staff plug random usb devices into your medical equipment is a great idea either.

Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan

#190

Post by sathackr » Sun, May 08, 2016, 6:18 PM UTC

morgante wrote: post #176

sathackr wrote: post #173

Earlier quoted context omitted.

That sounds nice...but then you will be replaced by a developer that will toe the company line. You're making 'unreasonable' demands and holding up progress. 'We can fix that with version 2.0' If every developer on the planet suddenly had a pang of consciousness, then something like this would work. Fortunately I have never found myself in such a position, but I have seen it many many times.

That's why we should probably require engineering certifications for working on safety-critical software. Working on such software should require demonstrating a certain level of knowledge and upholding a code of ethics. I generally oppose certification for engineers, but solving collective action dilemmas like this and saving lives in the process is exactly where it would help.

How do you ensure someone upholds a code of ethics? Licensing is not the answer. I'm sure there are many PEs that find themselves in similar situations.

I know examples of people in licensed fields who have sworn to uphold a code of ethics, but have been caught up in very similar situations.

I can't find it now but I just saw a video recently of a rail bridge with a crumbling foundation that had just been signed off on by a PE and declared safe by the railroad.