Take two software updates and see me in the morning: The case for software security evaluations of medical devices

2nd USENIX Workshop on Health Security and Privacy, HealthSec 2011

Volumn , Issue , 2011, Pages

  Hanna, Steven ^a   Rolles, Rolf ^d   Molina Markham, Andrés ^b   Poosankam, Pongsin ^a,c   Fu, Kevin ^b   Song, Dawn ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b The Manning College of Information and Computer Sciences   (United States)

^c Carnegie Mellon University   (United States)

^d NONE

Author keywords

[No Author keywords available]

Indexed keywords

DEFIBRILLATORS; FIRMWARE;

AUTOMATED EXTERNAL DEFIBRILLATOR; CARDIAC ARRHYTHMIA; CRITICAL CARE; FIRMWARE UPDATES; MEDICAL DEVICES; SECURITY VULNERABILITIES; SOFTWARE SECURITY; SOFTWARE UPDATES;

SECURITY OF DATA;

EID: 85092017530     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (20)

1. Cardiopulmonary Resuscitation (CPR) Statistics. American Heart Association. http://www.americanheart.org/presenter.jhtml?identifier=4483.
2. External defibrillator improvement initiative. FDA, Center for Devices and Radiological Health. http://www.fda.gov/downloads/MedicalDevices/ProductsandMedicalProcedures/CardiovascularDevices/ ExternalDefibrillators/UCM233824.pdf.
3. IDA Pro. Hex-Rays SA, http://www.hex-rays.com/idapro/.
4. Safeseh. Microsoft, http://msdn.microsoft.com/en-us/library/9a89h429(VS.80).aspx.
5. A. Bellissimo, J. Burgess, and K. Fu. Secure Software Updates: Disappointments and New Challenges. In Proceedings of USENIX Hot Topics in Security (HotSec), July 2006.
6. BitBlaze: Binary analysis for computer security. http://bitblaze.cs.berkeley.edu/.
7. J. Caballero, P. Poosankam, S. McCamant, D. Babic, and D. Song. Input generation via decomposition and re-stitching: Finding bugs in malware. In Proceedings of the 17th ACM Conference on Computer and Communication Security, Chicago, IL, October 2010.
8. P. S. Chan, H. M. Krumholz, J. A. Spertus, P. G. Jones, P. Cram, R. A. Berg, M. A. Peberdy, V. Nadkarni, M. E. Mancini, and B. K. Nallamothu. Automated External Defibrillators and Survival After In-Hospital Cardiac Arrest. JAMA: The Journal of the American Medical Association, 304(19):2129–2136, November 2010.
9. FDA. FDA Warns Users about Faulty Components in 14 External Defibrillator Models, April 2010. http://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm209874.htm.
10. CDRH preliminary internal evaluations — volume I: Preliminary Report and Recommendations, August 2010. http://www.fda.gov/downloads/AboutFDA/CentersOffices/CDRH/CDRHReports/UCM220784.pdf.
11. Frost and Sullivan. US external defibrillator markets, 2007. http://www.researchandmarkets.com/reports/575550/ u_s_external_defibrillator_markets_2007 .htm as cited in Chan et al., Automated External Defibrillators and Survival After In-Hospital Cardiac Arrest, JAMA 19(304), p.3125, November 2010.
12. K. Fu. Trustworthy medical device software. In Public Health Effectiveness of the FDA 510(k) Clearance Process: Measuring Postmarket Performance and Other Select Topics: Workshop Report, Washington, DC, 2011. Institute of Medicine (IOM), National Academies Press.
13. GlobalData. Global automated external defibrillators (AED) market: Demand to drive growth, June 2009. As cited in Derek Smith, Philips Healthcare, MDR Reporting Factors Over the Past 5 Years, FDA Public Workshop on External Defibrillators, December 2010, http://www.fda.gov/downloads/MedicalDevices/NewsEvents/WorkshopsConferences/UCM249337.pptx.
14. P. Godefroid, N. Klarlund, and K. Sen. Dart: Directed automated random testing. In In Programming Language Design and Implementation (PLDI, 2005.
15. D. Halperin, T. S. Heydt-Benjamin, K. Fu, T. Kohno, and W. H. Maisel. Security and Privacy for Implantable Medical Devices. IEEE Pervasive Computing, 7(1):30–39, 2008.
16. D. Halperin, T. S. Heydt-Benjamin, B. Ransford, S. S. Clark, B. Defend, W. Morgan, K. Fu, T. Kohno, and W. H. Maisel. Pacemakers and implantable cardiac defibrillators: Software radio attacks and zero-power defenses. In Proceedings of the 29th Annual IEEE Symposium on Security and Privacy, May 2008.
17. U. Kahn, K. Kursawe, S. Lucks, A.-R. Sadeghi, and C. Stble. Secure Data Management in Trusted Computing. In J. R. Rao and B. Sunar, editors, Cryptographic Hardware and Embedded Systems CHES 2005, volume 3659 of Lecture Notes in Computer Science, pages 324–338. Springer Berlin / Heidelberg, 2005.
18. J. S. Shah and W. H. Maisel. Recalls and Safety Alerts Affecting Automated External Defibrillators. JAMA: The Journal of the American Medical Association, 296(6):655–660, August 2006.
19. D. Song, D. Brumley, H. Yin, J. Caballero, I. Jager, M. G. Kang, Z. Liang, J. Newsome, P. Poosankam, and P. Saxena. BitBlaze: A new approach to computer security via binary analysis (invited keynote). In International Conference on Information Systems Security (ICISS), pages 1–25, Hyderabad, India, December 2008.
20. D. R. Wallace and D. R. Kuhn. Failure Modes in Medical Device Software: An Analysis of 15 Years of Recall Data. International Journal of Reliability Quality and Safety Engineering, 8:351–372, 2001.